OSFI Guideline B-13 basics

OSFI published Guideline B-13, Technology and Cyber Risk Management, on July 31, 2022. It applies to all federally regulated financial institutions (FRFIs), including foreign bank branches and foreign insurance company branches, to the extent consistent with their legal obligations for business in Canada. That covers federally chartered banks, federally regulated trust and loan companies, and federally regulated insurers.

It does not directly apply to provincially regulated credit unions, provincially regulated insurers, mortgage brokers, investment dealers or wealth managers. In practice, though, B-13's language is spreading. Larger FRFIs push its expectations onto their suppliers, and other regulators and insurers use similar concepts.

OSFI is explicit that there is no one-size-fits-all approach: the guideline should be applied in a risk-based way that reflects the institution's size, the nature and complexity of its operations, and its risk profile.

B-13 is organized into three domains, each with a stated outcome, summarized in the table below.

B-13 also points FRFIs to related guidance, including OSFI's Corporate Governance Guideline, Guideline E-21 on operational risk, Guideline B-10 on third parties, the Cyber Security Self-Assessment Tool, the Technology and Cyber Security Incident Reporting Advisory, and alerts from the Canadian Centre for Cyber Security.

OSFI's Technology and Cyber Security Incident Reporting Advisory applies to all FRFIs. A reportable incident can have any one or more of a long list of characteristics, including: impact to operations, infrastructure, data or systems, including the confidentiality, integrity or availability of customer information; disruption to business systems; activation of disaster recovery plans; impact to a third party affecting the FRFI; an incident reported to the board or senior management; an incident reported to the Office of the Privacy Commissioner, the Canadian Centre for Cyber Security, other regulators or law enforcement, or one that has involved internal or external counsel; an incident for which a cyber insurance claim has been initiated; or an incident rated high or critical internally. When in doubt, OSFI encourages reporting as a precaution.

FRFIs must report to OSFI's Technology Risk Division and their Lead Supervisor within 24 hours, or sooner if possible, in writing, using OSFI's incident reporting form. OSFI then expects regular updates, for example daily, until all details are provided, and situation updates on remediation until the incident is resolved. Failure to report can lead to increased supervisory oversight.

B-13 expects FRFIs to manage technology and cyber risk wherever it sits, including at third parties. Asset inventories may need to include third-party assets that store or process FRFI information. Acquired systems and software are to be assessed for risk. The cyber security domain expects FRFIs to respond to, contain, recover from and learn from incidents, including incidents originating at third-party providers. And the incident advisory lists a breach at a material third party as a reportable scenario where FRFI data may be affected.

If you supply IT, cloud, software or managed services to a bank, trust company or federally regulated insurer, expect to see B-13 reflected in your contracts and due diligence:

• Incident notice clauses tight enough that the institution can meet its own 24-hour reporting window. Your notification time to the client will need to be shorter.
• Requests for evidence of your controls: identity and access management, MFA, patching cadence, logging, vulnerability management, backup and recovery testing.
• Participation in the institution's incident response, including access to logs and forensic findings.
• Disaster recovery and resilience commitments aligned with the institution's recovery objectives.
• Questions about where data is stored and processed, and about your own sub-contractors.
• Rights to assess or audit your controls.

1. 01

   Confirm applicability

   Decide whether you are a FRFI, a supplier to one, or simply using B-13 as a benchmark.

2. 02

   Map to the three domains

   Score your current state against each B-13 section and the related OSFI tools, with evidence for each answer.

3. 03

   Fix incident reporting first

   Make sure detection, severity rating and escalation can support a written report within 24 hours, including incidents at your suppliers.

4. 04

   Inventory third parties

   List material technology suppliers, the data they hold and their incident-notice commitments to you.

5. 05

   Test

   Run a tabletop exercise that includes the OSFI notification step and a third-party breach scenario.