Answer the OSFI Cyber Self-Assessment with evidence, not guesswork

The OSFI Cyber Security Self-Assessment is a voluntary template issued by Canada's Office of the Superintendent of Financial Institutions in October 2013. It helps federally regulated financial institutions rate how well they have implemented cyber security practices across six areas, from organisation and resources to governance, and identify where improvements are needed. OSFI updated it in 2021 and replaced it in November 2025 with a tool aligned to Guideline B-13.

No. OSFI describes the self-assessment as voluntary, and institutions that already had their own assessment process were not required to change it. However, OSFI expects senior management of federally regulated financial institutions to keep cyber risk practices appropriate and effective, and supervisors may ask how an institution assesses its cyber preparedness, so many FRFIs complete it or an equivalent framework.

The 2013 template groups its criteria into six areas: organisation and resources; cyber risk and control assessment; situational awareness; threat and vulnerability risk management; cyber security incident management; and cyber security governance. The threat and vulnerability area covers topics such as data loss prevention, software security, network infrastructure, configuration management, network access, third parties and customers, while governance covers second line, internal audit, senior management oversight and external benchmarking.

In the 2013 template, each criterion is rated from 1 to 4, where 1 means not implemented and 4 means fully implemented across the enterprise, with a not applicable option. The 2021 update and the 2025 replacement tool moved to a six-level maturity scale from 0 (non-existent) to 5. OSFI asks institutions to rate their current state, not their target state.

Guideline B-13, Technology and Cyber Risk Management, sets OSFI's expectations for how FRFIs manage technology and cyber risk and took effect in January 2024. The self-assessment is a tool for measuring maturity against those kinds of expectations. In November 2025 OSFI replaced the older cyber security self-assessment with a technology and cyber risk management self-assessment tool aligned to B-13, which remains the primary guideline.

The OSFI self-assessment is a supervisory maturity checklist for Canadian financial institutions, not a certifiable standard. ISO 27001 is an international certification for an information security management system, and SOC 2 is an independent attestation report. Many controls overlap, such as access management, vulnerability management, logging and incident response, so evidence gathered for ISO 27001 or SOC 2 can support many OSFI ratings.

It depends on the size of the institution and how well documented its controls already are. Rating the criteria can be quick, but gathering evidence to support each rating and agreeing action plans across IT, security, risk and internal audit usually takes much longer. Having controls and evidence already mapped from frameworks such as ISO 27001 or B-13 shortens the work considerably.

Yes. OneClickComply supports the OSFI Cyber Security Self-Assessment today. Its areas link to controls you already manage, with automated evidence collection, continuous monitoring and auditor guidance, so evidence you hold for ISO 27001, SOC 2 or B-13 also counts here. OneClickComply does not issue OSFI approvals, and the self-assessment itself carries no certification.