OSFI B-13 Readiness Matrix

📚 New here? Start with OSFI Guideline B-13: The Complete Guide for the plain-language overview, then use this matrix to audit your controls.

Who B-13 applies to

OSFI Guideline B-13 applies to all federally regulated financial institutions (FRFIs) regulated by the Office of the Superintendent of Financial Institutions:

• Banks (Schedule I, II, and III)
• Federally regulated trust and loan companies
• Federally regulated insurance companies (life, P&C, mortgage)
• Federally regulated pension plans
• Cooperative credit associations

The guideline does not apply directly to provincially regulated credit unions, provincial trust companies, or provincially regulated insurers. However, B-13 frequently flows into vendor and partner contracts. MSPs, SaaS providers, and consulting firms serving FRFI clients are routinely asked to demonstrate B-13 alignment as part of third-party risk management (TPRM).

The five B-13 pillars

B-13’s substantive content distills into five pillars:

1. Governance and risk management, board-approved framework, risk appetite, named accountability.
2. Technology operations and resilience, asset inventory, change management, incident management, business continuity.
3. Cybersecurity, identify, protect, detect, respond, recover (aligned to NIST CSF).
4. Third-party risk, due diligence, contractual obligations, ongoing monitoring of vendors with material access.
5. Resilience testing, scenario analysis, tabletop exercises, threat-led penetration testing for material services.

The OSFI B-13 Controls Matrix

The 14 control areas below cover the substantive expectations across all five B-13 pillars. Each row maps the control to the relevant B-13 section, the corresponding CIS Controls v8.1 safeguard, the NIST CSF function, and the implementation pattern we deploy across our FRFI-adjacent SMB clients.

The most-missed B-13 controls

Across the Canadian financial-services SMB engagements we’ve supported, these six B-13 controls are most often weakly evidenced:

1. Risk appetite statement that isn’t operational. Boards approve appetite at a generic level; few institutions can demonstrate how an appetite breach is detected and escalated.
2. Asset inventory missing SaaS. CMDB tracks servers and laptops but not the 60-150 SaaS apps in active use.
3. SOC monitors infrastructure but not application logs. A SIEM that ingests firewall logs but not the core banking app or Salesforce misses the highest-value evidence.
4. PAM deployed but break-glass procedures undocumented. Privileged Access Management exists; the documented break-glass and quarterly review do not.
5. Third-party risk reviews are point-in-time. SOC 2 collected at onboarding; no ongoing monitoring, no annual reattestation.
6. Tabletop exercises check the box without testing material services. Generic phishing tabletop instead of ransomware-on-core-banking scenario with timed escalation.

B-13 for MSPs and SaaS providers serving FRFIs

If you are an MSP or SaaS provider with FRFI clients, your B-13 alignment matters for two reasons. First, your FRFI customers will ask you to attest to specific B-13 controls under their TPRM. Second, your contract terms, especially around notification timelines, audit rights, and exit obligations, must satisfy B-13 third-party requirements (s.5.1-5.3). The practical implications:

• Maintain SOC 2 Type II or ISO 27001 certification. Many FRFIs treat one of these as a baseline gate.
• Be prepared to notify FRFI clients within 24 hours of a security incident that affects their environment.
• Provide annual evidence of controls, pen test summary, vulnerability management metrics, change management evidence.
• Support contractual audit rights. Even if rarely exercised, the right itself is a B-13 expectation.
• Have a documented exit / portability plan. Be able to return or destroy FRFI data within agreed timelines.

How B-13 maps to NIST and CIS

B-13 does not prescribe a specific framework. The most common mappings in Canadian practice are:

• NIST Cybersecurity Framework, the five-function (Identify, Protect, Detect, Respond, Recover) structure aligns cleanly with B-13’s substantive expectations.
• CIS Controls v8.1, the 18 controls give specific, testable safeguards. IG1 is the minimum baseline; IG2/IG3 fit most FRFIs.
• ISO 27001, formal certification is common at the bank tier; less universal for credit unions and smaller FRFIs.
• NIST SP 800-53, sometimes used as the authoritative control catalog for federally regulated insurers.

About this matrix

This matrix is maintained by Mike Pearlstein, CISSP, Founder and CEO of Fusion Computing Limited. Mike has supported Canadian financial-services SMBs and FRFI vendors on B-13 alignment since the guideline was first announced. Fusion Computing is a Microsoft Solutions Partner (Security, Modern Work, Infrastructure) and a CompTIA Managed Services Trustmark holder. We deploy this matrix as part of FRFI-vendor onboarding and re-audit annually.

If you’d like a PDF version of this matrix or want to discuss your B-13 alignment, book a 30-minute consult.

Common Questions

When did OSFI B-13 come into force?

OSFI Guideline B-13 (Technology and Cyber Risk Management) took effect January 1, 2024. It applies to all federally regulated financial institutions in Canada, banks, federally regulated insurers, trust and loan companies, and federally regulated pension plans.

Does B-13 apply to provincially regulated credit unions?

Not directly. OSFI regulates federally chartered FRFIs; provincial credit unions and provincial insurers fall under their provincial regulator (e.g. FSRA in Ontario, AMF in Quebec). However many provincial regulators issue similar guidelines, and provincial credit unions that serve FRFI clients are still subject to B-13 expectations through vendor risk management.

Does B-13 prescribe specific technical controls?

No. B-13 is principles-based. It requires FRFIs to manage technology and cyber risk through a sound risk-management framework but does not specify exact technical controls. In practice OSFI expects alignment to a recognized framework, NIST Cybersecurity Framework, CIS Controls v8.1, ISO 27001, and evidence that controls are operational, monitored, and tested.

How does B-13 relate to NIST and CIS Controls?

B-13 expectations map cleanly onto the NIST Cybersecurity Framework’s five functions (Identify, Protect, Detect, Respond, Recover) and onto CIS Controls v8.1 safeguards. OSFI does not mandate either framework; most Canadian FRFIs use NIST CSF as the governance map and CIS Controls IG1 or IG2 as the technical safeguard catalog.

Does B-13 require third-party risk management?

Yes. Section 5 of B-13 requires FRFIs to manage technology and cyber risk arising from third parties, including MSPs, SaaS providers, and contractors with material access to FRFI systems or data. Expectations include due diligence at onboarding, contractual controls (notification timelines, audit rights, exit obligations), and ongoing monitoring. MSPs serving FRFI clients are routinely asked to attest to B-13-aligned controls.

What is threat-led penetration testing under B-13?

Threat-led penetration testing (TLPT) is a controlled, intelligence-led red-team exercise against material services. B-13 expects FRFIs to conduct TLPT periodically, typically every 24-36 months, for material technology services. The exercise simulates a real-world attack based on current threat intelligence, with the goal of validating detection and response in production conditions.

Part of the Canadian IT Compliance Hub – PIPEDA, PHIPA, OSFI B-13, Bill C-8, CyberSecure Canada and cyber-insurance guidance for Canadian SMBs, in one place.

Updated August 5, 2026