Cybersecurity Audit of Exhibition Place - Phase One: Physical Security, User Access Management and Staff Training

Given the size of the operations, and the services that Exhibition Place provides, the Auditor General included a cybersecurity audit of the Exhibition Place in her 2025 Work Plan. This audit is conducted in two phases. Phase One of this audit focused on: Physical security at selected facilities, User access management, and Social engineering and staff awareness. Phase Two, which is in progress, will include an overall assessment of Exhibition Place's networks, systems, and application security and will be reported to the Board in April 2026. This report includes five administrative recommendations. The confidential findings and recommendations are contained in Confidential Attachment 1 to this report. A separate confidential detailed technical report has been provided to management with technical details to guide them in addressing the report findings and recommendations. Management agrees with the recommendations contained in the Confidential Attachment 1, which also includes management's response.

4. Forward this report and Confidential Attachment 1 to City Council for information through the City's Audit Committee. 5. Recommend that City Council authorize the public release of Confidential Attachment 1 at the discretion of the Auditor General, after discussions with the appropriate Exhibition Place and City officials.