OSFI Guideline B-13
Technology and Cyber Risk Management for Canadian federally regulated financial institutions
Standard Introduction
OSFI Guideline B-13 is an active — effective 1 january 2024 standard published by Office of the Superintendent of Financial Institutions (OSFI). It is commonly used across Finance & Banking, Technology, Services and applies in Canada.
Use this page to review the official documentation, current status, and the certification or assessment bodies most commonly associated with OSFI Guideline B-13.
Applies to Canadian FRFIs
B-13 applies to federally regulated banks, trust and loan companies, insurers and covered foreign branches, subject to the branch-specific expectations and legal obligations that apply to their Canadian business.
Three Outcome Domains
The guideline organizes expectations around governance and risk management, technology operations and resilience, and cyber security rather than prescribing one technical control set.
Connect the 24-Hour Reporting Workflow
A separate OSFI advisory requires reportable technology and cyber incidents to be notified within 24 hours or sooner. B-13 incident management should feed that decision and reporting process.
list_alt B-13 Readiness Focus
- Board and senior-management accountability for technology and cyber risk
- Current inventories and classification of technology assets
- Secure system development, acquisition, change and patch management
- Technology service, capacity, availability and recovery monitoring
- Cyber threat and risk assessment across external and insider threats
- Identity, access, data, network and infrastructure protection
- Incident response, root-cause analysis, exercises and lessons learned
- Third-party dependencies coordinated with Guideline B-10
Who Needs to Comply?
OSFI-supervised federally regulated financial institutions, including banks, foreign bank branches, trust and loan companies, life insurers, fraternal benefit societies, property and casualty insurers and foreign insurance branches. Foreign branches apply B-13 consistently with applicable Canadian legal obligations and OSFI Guideline E-4.
Key Requirements
Govern Technology and Cyber Risk
Set clear accountabilities, strategies, frameworks, risk appetite, policies, independent challenge and reporting so technology and cyber risk decisions are visible to senior management and the board.
Control the Technology Lifecycle
Maintain technology-asset inventories and manage architecture, development, acquisition, change, configuration, patching, technical debt, end-of-life systems and data through their lifecycle.
Build Operational Resilience
Define service and capacity standards, monitor availability, maintain backups and recovery capabilities, test disaster recovery and manage incidents and problems through resolution and learning.
Identify and Protect Against Cyber Threats
Use threat-informed assessments, layered controls, identity and access management, data protection, secure configuration, vulnerability management, monitoring and testing to maintain confidentiality, integrity and availability.
Manage Dependencies and Reporting
Include material third parties in risk, resilience and incident processes; connect internal escalation to the OSFI incident-reporting criteria, 24-hour initial notification and continuing updates.
Implementation Roadmap
Set the B-13 governance baseline
Confirm which Canadian entities and branches are in scope, assign first-line ownership and independent oversight, approve technology and cyber risk appetite, and map B-13 to B-10, E-21, E-4 and the incident-reporting advisory.
Map assets, services and dependencies
Build a current view of technology assets, critical services, data, architecture, end-of-life exposure, third parties and concentration dependencies. Link each important service to accountable owners, resilience tolerances and recovery evidence.
Close control and resilience gaps
Prioritize deficiencies in secure development, change, patching, access, data protection, vulnerability management, monitoring, backup, recovery, incident response and third-party control. Use OSFI's self-assessment tool or an equivalent traceable method.
Exercise, report and sustain
Test severe but plausible scenarios, rehearse the 24-hour OSFI notification process, review service and cyber metrics, close findings and keep the risk assessment current after technology, supplier, threat or business changes.
Compliance Checklist
checklist Governance and risk management
checklist Technology operations and resilience
checklist Cyber security
checklist Third parties and incidents
B-13 and Common Cyber Frameworks
External frameworks can support B-13 evidence, but OSFI's scope and supervisory outcomes remain the controlling reference for an FRFI.
| Framework | Primary purpose | How it supports B-13 |
|---|---|---|
| OSFI B-13 | Canadian prudential expectations for technology and cyber risk | Controlling supervisory baseline for in-scope FRFIs |
| ISO/IEC 27001:2022 | Certifiable information security management system | Supports governance, risk treatment, control operation and assurance evidence |
| NIST CSF 2.0 | Outcome-based cyber risk framework | Supports Govern, Identify, Protect, Detect, Respond and Recover mappings |
| OSFI B-10 | Third-party risk management | Adds due diligence, contracting, cloud, concentration, subcontractor and exit expectations |
| OSFI E-21 | Operational risk management and resilience | Connects technology recovery to critical operations, continuity and severe-scenario testing |
Common Misconceptions
B-13 is only an information-security guideline.
It also covers governance, architecture, development, change, operations, capacity, availability, recovery, incidents and technology lifecycle risk.
Outsourcing a service transfers the FRFI's accountability.
The institution remains accountable and must coordinate B-13 with B-10 controls over providers, cloud services, subcontractors and incident notification.
An ISO 27001 certificate closes the B-13 assessment.
Certification can provide useful evidence, but scope, technology-resilience outcomes, OSFI reporting and Canadian supervisory expectations still require a direct mapping.
The 24-hour clock starts after the root cause is known.
For a reportable incident, the advisory requires initial notification within 24 hours or sooner if possible; incomplete facts can be identified and updated later.
Penalties & Enforcement
B-13 is supervisory guidance and does not set a standalone schedule of administrative fines. OSFI assesses implementation through risk-based supervision and can increase supervisory attention or use powers available under the governing federal financial-institution statutes. Under the separate incident-reporting advisory, failure to report can lead to enhanced monitoring, watch-listing or staging.
Frequently Asked Questions
Who must follow OSFI Guideline B-13?
expand_more
B-13 applies to OSFI-supervised federally regulated financial institutions, including federally regulated banks, trust and loan companies, insurers and covered foreign branches. Branches apply the expectations consistently with their Canadian legal obligations and OSFI's branch guidance.
Is B-13 a certifiable standard?
expand_more
No. B-13 is OSFI supervisory guidance, not a certification scheme. An ISO 27001 certificate or other assurance report can support evidence, but it does not demonstrate complete B-13 implementation.
When did B-13 become effective?
expand_more
OSFI issued the final guideline in July 2022 and made it effective on 1 January 2024. Consequential amendments concerning foreign branches were published in February 2024.
Does every cyber event have to be reported within 24 hours?
expand_more
No. The separate OSFI incident-reporting advisory defines the reporting criteria. When an incident is reportable, the institution must notify OSFI within 24 hours or sooner if possible and continue providing updates as information develops.
How does B-13 relate to OSFI Guideline B-10?
expand_more
B-13 governs the institution's technology and cyber risk outcomes. B-10 adds third-party risk expectations, including technology, cyber, cloud, subcontractor, concentration, portability, resilience and incident-reporting dependencies.
Can an institution use OSFI's self-assessment tool as its gap analysis?
expand_more
Yes. OSFI's voluntary tool is aligned with B-13 and can structure maturity scoring and remediation. Institutions may use another framework, but should preserve traceability from each B-13 expectation to owners, controls, evidence, gaps and action plans.
Official Documentation
Official PDF for OSFI Guideline B-13
Official publication or summary for OSFI Guideline B-13
Official online resource
Office of the Superintendent of Financial Institutions (OSFI) guidance and reference material
Implementation toolkit
Templates, guidance, or companion resources for OSFI Guideline B-13