Regulatory Guidance

OSFI Guideline B-13: what it actually requires

Guideline B-13 — Technology and Cyber Risk Management has been in effect since January 1, 2024, and it applies to every federally regulated financial institution in Canada. Here’s what it actually asks for, in plain language, and where testing and compliance work fit in.

Applies to all FRFIs

Principles-based, not a checklist — which makes it harder, not easier

OSFI (the Office of the Superintendent of Financial Institutions) issued the final version of B-13 in July 2022, with the guideline coming into effect January 1, 2024. It applies to banks, insurance companies, trust and loan companies, and cooperative credit associations — anything OSFI federally regulates.

B-13 doesn’t hand you a list of controls to tick off. It describes outcomes OSFI expects your institution to achieve, proportionate to your size and risk profile, and leaves you to decide how you get there. That flexibility is useful — but it also means “we’re compliant” is a harder claim to defend than under a prescriptive standard, because there’s no single checklist to point to. You need evidence, not just policy documents.

Board-level technology and cyber risk governance discussion

The Three Domains

What B-13 actually covers

Seventeen principles, organized under three outcomes.

Governance & risk management

Clear accountability for technology and cyber risk, a documented risk management framework, and reporting that actually reaches senior management and the board — not just IT.

Board accountabilityRisk framework

Technology operations & resilience

Secure design and configuration, change and patch management, asset management, and the ability to actually recover from a disruption — proven, not assumed.

Change managementRecovery capability

Cyber security

Identifying and protecting critical technology assets, detecting threats, and responding to and recovering from incidents. This is the domain where a formal, evidenced testing program — vulnerability assessments, penetration testing, and for larger or more complex institutions, threat-led red team exercises — does most of the work.

Regular vulnerability assessments across network devices, systems, and applications
Penetration testing to confirm which vulnerabilities are actually exploitable, not just theoretically present
Assessment of how multiple smaller weaknesses combine into a single high-risk exposure
Threat-led red team testing for institutions with more complex risk profiles — the model behind OSFI’s own Intelligence-Led Cyber Resilience Testing approach

Where testing evidence lives

The part most institutions get wrong

There is no fixed OSFI-mandated testing frequency — and that’s exactly the trap

B-13 is risk-based, not prescriptive: it doesn’t state “test annually” anywhere in the text. What it does require is that your institution define its own frequency and be able to defend that decision with a documented, risk-based rationale. In practice, most FRFIs land on an annual baseline for critical systems, with additional testing triggered by major releases, new infrastructure, or a merger — but the number matters less than being able to show OSFI why you chose it. A finding that’s identified but never re-tested to confirm the fix worked is not a closed finding in OSFI’s eyes, and it won’t hold up in a supervisory review either.

Read Alongside

B-13 doesn’t stand alone

OSFI expects it to be read together with related guidance, not in isolation.

Guideline B-10 — Third-Party Risk Management

Vendor and outsourcing risk was originally drafted inside B-13 and moved into a revised B-10, effective May 1, 2024. If a technology asset or the cyber risk around it comes from a third-party vendor, B-10 is the guideline that governs it.

Guideline E-21 — Operational Risk Management

E-21 covers operational risk more broadly and gives useful context for how technology risk — proprietary or vendor-supplied — fits into your institution’s wider operational risk picture.

The Faustianloop difference

One practitioner for testing, compliance, and the evidence trail between them

Most institutions end up assembling B-13 evidence from three separate vendors — a pentest firm, a compliance consultant, and whoever drafts the board report — and reconciling the gaps themselves. We run the penetration testing, build the compliance program, and sit with you through the actual review, so your evidence tells one consistent story instead of three vendors’ worth of paperwork that doesn’t quite line up.

Not sure your testing program would hold up to a B-13 review?

Let’s walk through what OSFI would actually expect to see, and where your current evidence has gaps.

Talk to Us About B-13 Readiness