Canada OSFI B-13

Why does it matter?

B-13 tells a Canadian financial institution how OSFI will judge its technology and cyber resilience. It states that there is no one-size-fits-all approach and that the guideline is to be read and implemented from a risk-based perspective that reflects an institution's size, complexity and risk profile (section A).

Key benefits include:

• Senior accountability

Senior Management is accountable for technology and cyber security operations and assigns named senior officers, such as the CIO, CTO or CISO (principle 1).

• A defined risk appetite

The technology and cyber risk management framework sets a risk appetite with limits, thresholds and tolerance levels aligned to enterprise risk management (principle 3).

• Tested recovery

Institutions run an Enterprise Disaster Recovery Program and test it against severe but plausible scenarios (principles 12 and 13).

• Intelligence-led testing

Institutions set triggers and minimum frequencies for intelligence-led threat assessments, including penetration testing and red teaming (section 3.1.2).

• Third-party incidents count

Response and recovery capabilities cover incidents that originate at third-party providers (principle 17).

How does it work?

The Guideline has three domains, each with a desired outcome. Domain 1, Governance and risk management, covers accountability and structure (principle 1), strategy (principle 2) and the risk management framework (principle 3). Domain 2, Technology operations and resilience, covers principles 4 to 13. Domain 3, Cyber security, covers principles 14 to 17.

Domain 2 principles are technology architecture, asset management, project management, the System Development Life Cycle, change and release management, patch management, incident and problem management, service measurement and monitoring, disaster recovery and disaster recovery scenario testing. Domain 3 follows an identify, defend, detect, and respond, recover and learn sequence.

OSFI expects the Guideline to be read with its Corporate Governance Guideline, E-21 on Operational Risk Management, B-10 on Outsourcing, its Cyber Security Self-Assessment Tool and its Technology and Cyber Security Incident Reporting Advisory (section A.4).

Key Elements

• Governance and risk framework (principles 1 to 3)

Senior Management assigns responsibility to senior officers and ensures structure and resources. A documented, approved strategic technology and cyber plan has measurable goals, and the risk management framework sets out risk appetite, a risk taxonomy, control domains and reporting to Senior Management (sections 1.1 to 1.3).

• Asset and change management (principles 5, 8 and 9)

FRFIs keep an updated inventory of all technology assets that supports business processes, classify assets by criticality, record configurations and monitor technology currency (section 2.2). Changes follow a controlled change and release process, and patching is controlled and timely.

• Incident and problem management (principle 10)

Standards provide for timely identification and escalation, restoration and root cause investigation. Processes include classifying incidents by priority, periodic scenario exercises, and testing with third parties. Problem management uses post-incident reviews to improve processes (section 2.7).

• Disaster recovery (principles 12 and 13)

The Enterprise Disaster Recovery Program sets accountability, identifies key dependencies, defines recovery plans within an acceptable timeframe and includes data backup and recovery controls. Scenario testing covers backup and recovery, and critical third-party technologies and integration points (sections 2.9.1 to 2.9.3).

• Cyber identify and defend (principles 14 and 15)

Identification includes threat assessments, vulnerability assessments with defined frequency, data classification and awareness testing. Defense calls for layered controls, secure-by-design practices, strong cryptography, identity and access management, configuration baselines and application scanning (sections 3.1 and 3.2).

• Detect, respond, recover and learn (principles 16 and 17)

Continuous detection supports monitoring, alerting and forensic investigations. FRFIs define a cyber incident taxonomy, maintain playbooks, establish an incident response team available continuously, and conduct forensic and root cause analysis for high-severity incidents (sections 3.3 and 3.4).

What does it cover?

Guideline B-13 applies to all federally regulated financial institutions, including foreign bank branches and foreign insurance company branches to the extent consistent with their legal obligations in Canada. Branch expectations are set out in Guideline E-4. It covers information technology and information security, defined broadly as technology risk including cyber risk (section A.1).

What are its objectives?

The Guideline aims to support institutions in developing resilience to technology and cyber risks. Each domain has a desired outcome.

Govern technology and cyber risks through clear accountabilities, structures, strategies and frameworks.

Maintain a technology environment that is stable, scalable and resilient with sustainable operating and recovery processes.

Maintain a secure technology posture that protects the confidentiality, integrity and availability of technology assets.

Read and apply the Guideline in a risk-based way that fits the institution's size and complexity.

Align technology and cyber practices with OSFI's guidance on governance, operational risk and outsourcing.

Framework in Context

B-13 sits within OSFI's Sound Business and Financial Practices guidance. It points institutions to recognized frameworks and standards for technology operations and information security, and OSFI's incident reporting advisory, updated on August 13, 2021, asks FRFIs to report technology and cyber incidents to OSFI's Technology Risk Division and Lead Supervisor within 24 hours, or sooner if possible. It is a Canadian supervisory guideline rather than an international standard.

Common Framework Mappings

Organizations commonly map OSFI B-13 to international and industry frameworks to harmonize controls, demonstrate regulatory alignment, and simplify risk and operational resilience management.

Mapped frameworks include:

Digital Operational Resilience Act (DORA)

ISO/IEC 27001

ISO/IEC 27002

ISO/IEC 27017

ISO/IEC 27018

NIST Cybersecurity Framework

NIST SP 800-53

SOC 2