OSFI Guideline B-13: Technology and Cyber Risk ManagementSupported in OneClickComply

Meet OSFI B-13 technology and cyber risk expectations with confidence

OSFI B-13 is the guideline from Canada's Office of the Superintendent of Financial Institutions that sets expectations for how federally regulated financial institutions manage technology and cyber risk. Published in July 2022 and effective from 1 January 2024, it groups 17 principles into three domains: governance and risk management, technology operations and resilience, and cyber security. It is risk based, so institutions apply it in proportion to their size, complexity and risk profile.

See the OSFI B-13 requirements

OSFI B-13 Aligned

Automated Evidence

OneClickFix Enabled

Continuous Monitoring

In-House Audit Team

Who needs OSFI B-13

Is OSFI B-13 right for your organisation?

Every federally regulated financial institution (FRFI) supervised by OSFI is expected to meet B-13, including banks, life and property and casualty insurers, trust and loan companies, and foreign bank and insurance branches. Technology and cloud providers that serve these institutions are also often asked to show B-13 aligned controls during due diligence, because OSFI expects FRFIs to manage third-party technology risk under Guideline B-10.

It is a legal or regulatory requirement for organisations in scope.

Issued by: Office of the Superintendent of Financial Institutions (OSFI), Canada
Published: July 2022
In force since: 1 January 2024
Applies to: Federally regulated financial institutions, including foreign branches
Structure: 3 domains, 17 principles
Read with: OSFI Guideline E-21 (Operational Risk Management) and Guideline B-10 (Third-Party Risk Management)
Assessment route: OSFI supervisory review; no certification scheme
Type: Guidance (mandatory)
Region: Canada, Canada
In OneClickComply: Supported today

How we help

OneClickComply makes it simple

OneClickComply supports OSFI B-13 today, so your existing controls, policies and evidence can be lined up against its principles and sub-sections. Automated evidence collection, continuous monitoring and AutoComplete policies cover areas such as asset inventory, patching, change management, access control, logging and incident response, while our in-house audit team can guide your self-assessment.

Requirements covered

17 principles across three domains (governance and risk management, technology operations and resilience, and cyber security), set out in 16 sections and 56 numbered expectations, with cyber security organised as Identify, Defend, Detect and Respond, recover and learn.

Already working towards another framework?

ISO 2700130% of OSFI B-13 overlaps
SOC 297% of OSFI B-13 overlaps
NIST CSF91% of OSFI B-13 overlaps
GDPR16% of OSFI B-13 overlaps

Evidence you collect once counts towards every framework it applies to.

Manual OSFI B-13 vs. OneClickComply

Manual OSFI B-13

Mapping 17 principles and dozens of expectations to controls in sprawling spreadsheets
Chasing IT teams for screenshots to prove patching, access reviews and change approvals
Configuration drift and missed vulnerabilities only discovered at the next review
Writing and maintaining policies for SDLC, disaster recovery and incident response from scratch
Repeating similar evidence work for B-13, ISO 27001 and SOC 2 requests

With OneClickComply

B-13 expectations mapped to one control set with clear ownership and status
Evidence collected automatically from your connected tools and logged as it changes
Continuous monitoring flags drift early, and OneClickFix resolves supported misconfigurations
Audit-ready policies generated from your real environment, ready for review and approval
Evidence collected once counts towards B-13, ISO 27001, SOC 2 and other mapped frameworks

Capabilities

Everything you need for OSFI B-13

OSFI B-13 principles mapped to your existing controls, so evidence is collected once and reused

Automated evidence from cloud, identity and device tools for asset inventory, patching and access control

Continuous monitoring that alerts you when security configuration baselines drift

AutoComplete policies for change management, incident response, disaster recovery and cryptography

Risk register and vendor risk management to support technology and third-party risk oversight

Ask an Auditor and virtual CISO support for B-13 self-assessments and board reporting

How it works

Three steps to OSFI B-13 compliance

Connect & scan

Connect your cloud, identity and SaaS tools. OneClickComply checks them against OSFI B-13 and shows you exactly where you stand.

Fix & generate

OneClickFix remediates technical gaps in one click, and AutoComplete generates OSFI B-13-aligned policies from your real environment.

Monitor & evidence

Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.

Requirements

OSFI Guideline B-13: Technology and Cyber Risk Management requirements

The guideline's three domains, its 16 sections (with the principle numbers each contains) the 56 numbered expectations within them and the Appendix A definitions, as set out in OSFI Guideline B-13.

Reference	Requirement
1	Governance and risk management
1.1	Accountability and organizational structure (Principle 1)
1.1.1	Senior Management accountability is established
1.1.2	Appropriate structure, resources and training are provided
1.2	Technology and cyber strategy (Principle 2)
1.2.1	Strategy is proactive, comprehensive and measurable
1.3	Technology and cyber risk management framework (Principle 3)
1.3.1	RMF is well-aligned and continuously improved
1.3.2	RMF captures key elements
2	Technology operations and resilience
2.1	Technology architecture (Principle 4)
2.1.1	Architecture framework ensures technology supports business needs
2.1.2	Architecture is comprehensive
2.2	Technology asset management (Principle 5)
2.2.1	Technology asset management standards are established
2.2.2	Inventory is maintained and assets are categorized
2.2.3	Inventory records and manages technology asset configurations
2.2.4	Standards for safe disposal of technology assets are established
2.2.5	Technology currency is continuously assessed and managed
2.3	Technology project management (Principle 6)
2.3.1	Technology projects are governed by an enterprise-wide framework
2.4	System Development Life Cycle (Principle 7)
2.4.1	SDLC framework guides system and software development
2.4.2	Security requirements are embedded throughout the SDLC
2.4.3	Integration of development, security and technology operations
2.4.4	Acquired systems and software are assessed for risk
2.4.5	Coding principles provide for secure and stable code
2.5	Change and release management (Principle 8)
2.5.1	Changes to technology assets are conducted in a controlled manner
2.5.2	Segregation of duties controls against unauthorized changes
2.5.3	Changes to technology assets are traceable
2.6	Patch management (Principle 9)
2.6.1	Patches are applied in a timely and controlled manner
2.7	Incident and problem management (Principle 10)
2.7.1	Incidents are managed to minimize impact on affected systems and business processes
2.7.2	Incident management process is clear, responsive and risk-based
2.7.3	Processes are established to investigate, resolve and learn from problems
2.8	Technology service measurement and monitoring (Principle 11)
2.8.1	Technology service performance is measured, monitored and regularly reviewed for improvement
2.8.2	Technology infrastructure performance and capacity are sufficient
2.9	Disaster recovery (Principles 12 and 13)
2.9.1	Disaster recovery program is established
2.9.2	Key dependencies are managed
2.9.3	Disaster recovery scenarios are tested
3	Cyber security
3.0	Confidentiality, integrity and availability of technology assets is maintained
3.1	Identify (Principle 14)
3.1.1	Security risks are identified
3.1.2	Intelligence-led threat assessment and testing is conducted
3.1.3	Vulnerabilities are identified, assessed and ranked
3.1.4	Data are identified, classified and protected
3.1.5	Continuous situational awareness and information sharing are maintained
3.1.6	Threat modelling and hunting are conducted
3.1.7	Cyber awareness is promoted and tested
3.1.8	Cyber risk profile is monitored and reported on
3.2	Defend (Principle 15)
3.2.1	Secure-by-design practices are adopted
3.2.2	Strong and secure cryptographic technologies are employed
3.2.3	Enhanced controls and functionality are applied to protect critical and external-facing technology assets
3.2.4	Cyber security controls are layered
3.2.5	Data protection and loss prevention security controls are implemented
3.2.6	Security vulnerabilities are remediated
3.2.7	Identity and access management controls are implemented
3.2.8	Security configuration baselines are enforced and deviations are managed
3.2.9	Application scanning and testing capabilities are employed
3.2.10	Physical access controls and processes are applied
3.3	Detect (Principle 16)
3.3.1	Continuous, centralized security logging to support investigations
3.3.2	Malicious and unauthorized activity is detected
3.3.3	Cyber security alerts are triaged
3.4	Respond, recover and learn (Principle 17)
3.4.1	Incident response capabilities are integrated and aligned
3.4.2	Cyber incident taxonomy is defined
3.4.3	Cyber security incident management process and tools are maintained
3.4.4	Timely response, containment and recovery capabilities are established
3.4.5	Forensic investigations and root cause analysis are conducted, as necessary
A.1	Definitions

Always check the official OSFI B-13 text for the exact wording.

OSFI B-13 FAQs

What is OSFI B-13?

OSFI B-13 is the Technology and Cyber Risk Management guideline issued by Canada's Office of the Superintendent of Financial Institutions. It sets out 17 principles across three domains: governance and risk management, technology operations and resilience, and cyber security. Its aim is to help federally regulated financial institutions build resilience to technology and cyber risks, and it is applied in a risk-based way according to each institution's size, complexity and risk profile.

Who must comply with OSFI B-13?

All federally regulated financial institutions supervised by OSFI are expected to meet B-13. That covers banks, life insurance and fraternal companies, property and casualty insurers, trust and loan companies, and foreign bank and foreign insurance branches operating in Canada. Provincially regulated institutions, such as most credit unions, fall outside OSFI's remit, although their suppliers may still be asked about B-13 aligned controls.

When did OSFI B-13 come into effect?

OSFI B-13 came into effect on 1 January 2024. OSFI published the final guideline in July 2022, following a consultation on a draft in late 2021, and set the later effective date to give institutions time to self-assess against the new expectations and close any gaps before supervisors began applying it.

What happens if an institution does not meet B-13?

B-13 is a supervisory guideline rather than a statute, so it does not set fixed fines. OSFI assesses adherence through its supervisory work, and weaknesses in technology or cyber risk management can lead to supervisory findings, required remediation and closer oversight under OSFI's intervention approach. Institutions should treat the expectations as mandatory in practice.

What are the main requirements of OSFI B-13?

The main requirements are clear senior management accountability, a technology and cyber strategy, and a risk management framework, followed by sound technology operations: architecture, asset management, project management, secure SDLC, change and release management, patching, incident and problem management, service monitoring and disaster recovery. The cyber security domain then expects institutions to identify, defend, detect, respond, recover and learn from cyber threats.

How does OSFI B-13 relate to ISO 27001 and SOC 2?

OSFI B-13 overlaps heavily with ISO 27001 and SOC 2, covering risk management, asset inventory, access control, cryptography, logging, change management and incident response. It is not a certification, though, and an ISO 27001 certificate or SOC 2 report does not by itself show B-13 compliance. Many institutions use those frameworks as evidence and map their controls to the B-13 expectations.

How does B-13 relate to OSFI's other guidelines?

B-13 is designed to be read with other OSFI guidance, especially Guideline E-21 on operational risk management and Guideline B-10 on third-party risk management. Where a third party provides a technology asset or service, B-10 sets the expectations for managing that relationship, while B-13 covers the technology and cyber risk controls themselves. OSFI's incident reporting advisory also applies.

Does OneClickComply support OSFI B-13?

Yes. OneClickComply supports OSFI B-13 today, so its principles can be linked to your existing controls, policies and evidence. Teams use automated evidence collection, continuous monitoring and AutoComplete policies to prepare for a B-13 self-assessment, with support from our in-house audit team. OneClickComply helps you prepare but does not certify compliance.

Related standards

All standards

Get OSFI B-13 ready, not stressed

Automate controls, gather evidence continuously and stay audit-ready, all on one platform.