.svg)
OSFI B-13 is the Office of the Superintendent of Financial Institutions' Technology and Cyber Risk Management guideline. B-13 has been in effect since January 1, 2024, and applies to federally regulated financial institutions, not to their vendors. Fintech and SaaS suppliers still meet B-13 expectations through the bank's third-party risk program under Guideline B-10, and one well-run SOC 2 or ISO 27001 program answers most of what a bank's third-party risk team asks.
Key facts
OSFI B-13 key facts for technology suppliers
- Issuer and document: OSFI, Guideline B-13, Technology and Cyber Risk Management, published July 31, 2022
- Effective date: January 1, 2024
- Applies to: federally regulated financial institutions (FRFIs):
- Banks
- Foreign bank branches
- Foreign insurance branches
- Life insurance and fraternal companies
- Property and casualty companies
- Trust and loan companies
- Structure: 17 principles across three sections, with one expected outcome per section:
- Governance and risk management
- Technology operations and resilience
- Cyber security
- How suppliers are reached: Guideline B-10 (Third-Party Risk Management, effective May 1, 2024) asks FRFIs to assess a third party's capacity to manage technology and cyber risk in line with B-13
- Incident clock: FRFIs report technology and cyber incidents to OSFI within 24 hours, or sooner if possible, and B-10 expects third parties to notify the FRFI promptly
- Legal status: B-13 is a supervisory guideline OSFI issues to FRFIs, not a statute. SOC 2 and ISO 27001 are voluntary frameworks a supplier chooses to adopt.
What is OSFI B-13?
OSFI B-13 is a principles-based guideline that sets OSFI's expectations for how FRFIs manage technology and cyber risk. The guideline text defines technology risk, which includes cyber risk, as risk arising from any of the following affecting information technology assets, people, or processes:
- Inadequacy
- Disruption
- Destruction
- Failure
- Damage from unauthorised access
- Modification
- Malicious use
OSFI announced the final guideline in July 2022 with a January 1, 2024 effective date. B-13 is proportional: OSFI states there is no one-size-fits-all approach. Every principle is addressed to the institution, and the institution turns B-13 expectations into questions for suppliers.
Does OSFI B-13 apply to fintech and SaaS vendors?
OSFI B-13 does not apply directly to fintech or SaaS vendors. B-13 applies to FRFIs and reaches suppliers indirectly, through what the FRFI sets under the FRFI's third-party risk program:
- Due diligence
- Security questionnaires
- Contract terms
| Party | Does OSFI B-13 apply directly? | How B-13 expectations reach the party |
| Canadian bank, federally regulated insurer, trust and loan company | Yes | OSFI supervision |
| Foreign bank branch or foreign insurance branch in Canada | Yes, for business in Canada | OSFI supervision |
| SaaS or fintech vendor with a critical or high-risk arrangement | No |
|
| The vendor's own subcontractors (cloud, sub-processors) | No | The FRFI assesses the vendor's own third-party risk program under B-10 |
| Provincially regulated credit union or insurer | No, OSFI does not supervise provincial institutions | The provincial regulator's rules. The institution's vendor questionnaire may still resemble a bank's. |
B-13 also names third-party assets inside the FRFI's own program. Section 2.2.2 says the FRFI's technology asset inventory may include third-party assets that store or process FRFI information or provide critical business services. A SaaS platform holding bank data can end up on the bank's asset inventory.
How is OSFI Guideline B-13 structured?
OSFI Guideline B-13 is organized into three sections, each tied to one expected outcome, with 17 numbered principles across them. For each section, a supplier should ask what evidence the bank will want to show the same outcome holds on the vendor's side.
| B-13 section | Expected outcome (OSFI wording, condensed) | Subsections | What suppliers typically get asked for |
| 1. Governance and risk management | Technology and cyber risks are governed through clear accountabilities, structures, strategies and frameworks |
|
|
| 2. Technology operations and resilience | A technology environment that is stable, scalable, and resilient, with sound operating and recovery processes | 2.1 architecture to 2.9 disaster recovery (Principles 4 to 13) |
|
| 3. Cyber security | A secure technology posture that maintains confidentiality, integrity, and availability |
|
|
B-13 section 2 carries the most operational detail. Under Principle 8, section 2.5.2 expects segregation of duties in change management, so that the same person cannot carry code or releases between production and non-production environments alone. Principles 12 and 13 expect a disaster recovery program tested against severe but plausible scenarios.
How does OSFI B-13 interact with Guideline B-10 for third-party technology services?
Guideline B-10 is the mechanism that carries OSFI B-13 expectations to suppliers. B-10, Third-Party Risk Management, was published in April 2023 and, per OSFI's consultation response, took effect May 1, 2024. B-10's sixth expected outcome is that technology and cyber operations carried out by third parties are transparent, reliable, and secure.
Five B-10 provisions turn B-13 into supplier obligations:
| B-10 provision | What the provision asks the FRFI to do | What the supplier sees |
| Annex 1, item 6 | Assess the third party's capacity to manage technology and cyber risks in line with B-13 | Security questionnaire and evidence request |
| Section 4.2 | Require higher-risk third parties to meet FRFI standards or recognized industry standards, notably for access management and data security | Control requirements in the contract or security schedule |
| Principle 8 (2.3.3) | Hold the right to conduct or commission an independent audit, and use independent reports provided by third parties |
|
| Principle 11 (2.4.2) | Require documented incident processes at both the FRFI and the third party:
|
Incident notification clause with a defined window |
| Principle 5 (2.2.4) | Manage risk from subcontracting, including the supplier's own third-party program |
|
B-10 is proportional: scrutiny scales with the risk and criticality of the arrangement. OSFI expects arrangements entered into before May 1, 2024 to be reviewed and updated at the earliest opportunity. B-10 section 2.2.2.2 also expects due diligence as part of each contract renewal, so a renewal can be the first time a long-standing vendor sees a B-13-based questionnaire.
Key insight
B-10 decides how much scrutiny a supplier gets, and B-13 decides what the questions are about
A bank's third-party risk team uses B-10 to classify the arrangement by risk and criticality, then uses the three B-13 sections as the checklist for what a critical technology supplier must show. A supplier that knows both documents can predict most of the questionnaire before the questionnaire arrives.
What does OSFI's incident reporting advisory mean for suppliers?
OSFI's Technology and Cyber Security Incident Reporting Advisory requires FRFIs to report a technology or cyber security incident to OSFI's Technology Risk Division and their Lead Supervisor within 24 hours, or sooner if possible, followed by regular updates. One of the advisory's reporting criteria is an impact to a third party affecting the FRFI.
A supplier's incident can start the bank's 24-hour clock. B-10 section 2.4.2.2 expects the FRFI's agreements to support compliance with the advisory and expects third parties to promptly notify the FRFI of technology and cyber security incidents, including incidents at a subcontractor.
Watch out
A supplier's incident response plan must include the bank's notification clause
A SOC 2 incident response plan that only covers internal triage misses the contractual obligation to notify each FRFI customer within the window the customer's contract sets. Add three things to the plan:
- Every customer notification window
- The person who sends each notice
- A tabletop exercise that tests the notification step
The SOC 2 CC7.4 incident response guide and the ISO 27001 A.5.24 incident planning guide cover the plan itself.
How do OSFI B-13 expectations map to SOC 2 and ISO 27001 controls?
Most OSFI B-13 expectations that a bank passes to a supplier map to an existing SOC 2 Trust Services Criterion and an ISO 27001:2022 Annex A control. Each row of the table below gives:
- The B-13 reference
- The matching SOC 2 criteria
- The matching ISO 27001 controls
- The evidence a supplier can hand over
The mappings are practitioner judgment based on control subject matter. OSFI, the AICPA and ISO do not publish an official B-13 crosswalk.
| OSFI B-13 expectation | SOC 2 criteria | ISO 27001:2022 control | Supplier evidence |
| Accountability and structure (1.1, Principle 1) | CC1.3, CC1.5 | Clause 5.3, A.5.2 |
|
| Risk management framework and appetite (1.3, Principle 3) | CC3.1, CC3.2 | Clauses 6.1.2 and 6.1.3 | Risk register, risk treatment plan |
| Technology asset inventory (2.2, Principle 5) | CC6.1 | A.5.9 | Asset inventory with owners and data classification |
| Secure SDLC and application testing (2.4, 3.2.9) | CC8.1 | A.8.25, A.8.28, A.8.29 | Secure coding standard and scan results:
|
| Change and release management, segregation of duties (2.5, Principle 8) | CC8.1 | A.8.32, A.8.31 |
|
| Patching and vulnerability remediation (2.6, 3.1.3, 3.2.6) | CC7.1 | A.8.8 |
|
| Service and capacity monitoring (2.8, Principle 11) | A1.1 | A.8.6 | Uptime and capacity reports, SLA reporting |
| Disaster recovery and scenario testing (2.9, Principles 12 and 13) | A1.2, A1.3, CC9.1 | A.5.29, A.5.30, A.8.13, A.8.14 |
|
| Penetration testing and threat intelligence (3.1.2, 3.1.5) | CC4.1, CC7.1 | A.5.7, A.8.8 | Annual penetration test report with remediation evidence |
| Cryptography and key management (3.2.2) | CC6.1, CC6.7 | A.8.24 | Encryption at rest and in transit, key management records |
| Identity, MFA, and privileged access (3.2.7, Principle 15) | CC6.1, CC6.2, CC6.3 | A.5.15, A.5.18, A.8.2, A.8.5 |
|
| Security configuration baselines (3.2.8) | CC7.1, CC5.2 | A.8.9 |
|
| Centralized logging and detection (3.3, Principle 16) | CC7.2, CC7.3 | A.8.15, A.8.16 |
|
| Incident response, recovery, and learning (2.7, 3.4, Principle 17) | CC7.3, CC7.4, CC7.5 | A.5.24 to A.5.28 |
|
| Supplier's own third parties (B-10 2.2.4) | CC9.2 | A.5.19 to A.5.22 |
|
The per-control guides go deeper on the rows that draw the most follow-up questions:
- SOC 2 CC8.1 change management with ISO 27001 A.8.32
- SOC 2 CC7.1 vulnerability management
- SOC 2 CC6.2 user access provisioning with ISO 27001 A.8.2 privileged access
- ISO 27001 A.8.13 backup
- ISO 27001 A.8.15 logging
- SOC 2 CC9.2 vendor risk management
The full crosswalk between the two frameworks is in the ISO 27001 to SOC 2 control mapping.
Which OSFI B-13 expectations do SOC 2 and ISO 27001 not fully cover?
A SOC 2 report or ISO 27001 certificate leaves a few OSFI B-13 expectations partly answered, and bank reviewers may ask about them separately.
| B-13 expectation | Why SOC 2 or ISO 27001 falls short | How a supplier closes the gap |
| Intelligence-led testing and red teaming (3.1.2) | SOC 2 and ISO 27001 do not require red teaming | State penetration test scope and method, and offer the executive summary |
| Minimum security log retention for forensics (3.3.1) | Neither framework sets a retention period | Document the retention period for each log source |
| Disaster recovery against severe but plausible scenarios (2.9) | A backup restore test is not a full scenario test | Run and record a failover or regional outage exercise |
| Data location and portability (B-10 2.2.2.3, 2.3.2.2, and 4.4) | Not a SOC 2 or ISO 27001 requirement | Publish hosting regions and an exit and data return process |
What does a bank's B-13-driven vendor questionnaire ask suppliers?
A bank's B-13-driven vendor questionnaire typically asks for an independent report first, then follows the three B-13 sections with targeted questions. The questions below trace to B-13 and B-10 text. Wording varies by institution.
| Questionnaire area | Typical question | What answers the question |
| Independent assurance | Provide your current SOC 2 Type II report or ISO 27001 certificate and Statement of Applicability | The report or certificate, plus bridge letter if the period has ended |
| Change management | Can one person develop and deploy code to production? | Branch protection and approval records |
| Vulnerability management | What are your remediation timelines by severity? | Vulnerability policy and recent scan metrics |
| Resilience | What are your RTO and RPO, and when did you last test recovery? | BCDR plan and dated test record |
| Access | Is MFA enforced for all administrative and remote access? | MFA configuration evidence |
| Incident notification | How quickly will you notify us of an incident affecting our data or service? | Contract clause and IR plan excerpt |
| Subcontractors | Which sub-processors handle our data, and where? | Sub-processor list with locations |
| Customer-side controls | Which of these does the product support?
|
Product documentation, CUEC section of the SOC 2 report |
Suppliers tend to prepare least for the customer-side controls row. Enterprise third-party risk teams evaluate two things: whether the vendor is secure, and whether the product lets the buyer secure the buyer's own use of the product. For a bank, SSO and exportable security logs support the bank's own B-13 duties for access management (3.2.7) and centralized logging (3.3.1). The security questionnaire automation guide covers answering questionnaires at volume.
OSFI-Ready Managed Compliance
One SOC 2 / ISO 27001 program that answers B-10 due diligence and B-13 control questions, built on an effective security program.
What should an OSFI B-13 supplier readiness checklist include?
An OSFI B-13 supplier readiness checklist turns the control mapping into work a team can start on this week. Each step produces an artifact a bank reviewer will ask to see.
| Step | Artifact to produce | Maps to |
| 1. Confirm which customers are FRFIs and which contracts renew next | Customer list tagged by regulator and renewal date | B-10 legacy arrangement review |
| 2. Get an independent report in place | SOC 2 Type II report or ISO 27001 certificate | B-10 Principle 8 |
| 3. Name a security owner and keep a risk register and asset inventory |
|
B-13 1.1, 1.3, 2.2 |
| 4. Enforce change approval and segregation of duties | Branch protection, deployment approvals | B-13 2.5 |
| 5. Set and meet vulnerability remediation timelines | Policy, scan and patch metrics | B-13 2.6, 3.2.6 |
| 6. Enforce MFA and review access quarterly | MFA config, access review records | B-13 3.2.7 |
| 7. Centralize logs and document retention periods | SIEM coverage list, retention table | B-13 3.3.1 |
| 8. Test disaster recovery against a real scenario | Dated DR test report with RTO and RPO results | B-13 2.9 |
| 9. Add every customer notification window to the IR plan and test the notification step | IR plan, tabletop record | Advisory, B-10 2.4.2 |
| 10. Prepare a standard bank response pack |
|
B-10 Annex 1, 2.2.4 |
Should a bank supplier choose SOC 2 or ISO 27001 to answer OSFI B-13?
Either SOC 2 or ISO 27001 can serve as the independent report a Canadian bank asks for under B-10. OSFI names neither. A SOC 2 Type II report tests control operation over a period, and ISO 27001 certifies the management system and the Annex A controls in scope. The deciding factor is usually which report the first financial institution customers ask for by name. The ISO 27001 vs SOC 2 guide sets out the decision, and the SOC 2 guide for Toronto fintech covers the wider Canadian financial services picture, including PIPEDA and FINTRAC. Suppliers to banks may later face a federal statute as well. Bill C-8 received Royal Assent on June 15, 2026 and enacts the Critical Cyber Systems Protection Act, which lists banking systems as a vital system. The Critical Cyber Systems Protection Act was not yet in force as of October 31, 2026 and waits on an order in council. The Bill C-8 vendor requirements guide covers what designated operators may pass to their suppliers.
Payment companies that work with banks also answer to the Bank of Canada under the Retail Payment Activities Act, and the RPAA compliance guide for payment service providers covers those duties.
Can one security program answer a bank's OSFI B-13 questions?
One security program can answer a bank's OSFI B-13 questions. B-13 sets the bank's expectations, B-10 passes the expectations to suppliers, and the incident reporting advisory adds a 24-hour clock. A supplier with one SOC 2 or ISO 27001 program built around the three B-13 sections answers the questionnaire once and reuses the evidence at every renewal.
Selling to a Canadian bank, insurer, or trust company?
OSFI-ready managed compliance: one SOC 2 / ISO 27001 program that answers B-10 due diligence and B-13 control questions. Truvo, a Canadian professional-services firm, operates the program and keeps the program effective between audits.
Need senior security leadership as well? See vCISO services.
What do suppliers most often ask about OSFI B-13?
Does OSFI B-13 apply to SaaS companies?
OSFI B-13 does not apply directly to SaaS companies. B-13 applies to federally regulated financial institutions, such as banks and federally regulated insurers. SaaS vendors meet B-13 expectations indirectly, because OSFI Guideline B-10 asks those institutions to assess a third party's capacity to manage technology and cyber risk in line with B-13.
When did OSFI Guideline B-13 take effect?
OSFI Guideline B-13, Technology and Cyber Risk Management, took effect on January 1, 2024. OSFI published the final guideline on July 31, 2022 and set the later effective date to give federally regulated financial institutions time to self-assess. The related third-party guideline, B-10, took effect on May 1, 2024.
Is a SOC 2 report enough to satisfy a bank's OSFI B-13 review?
A SOC 2 Type II report answers most of a bank's OSFI B-13 questions, but rarely all of them. Banks often ask separately about:
- Penetration testing scope
- Log retention periods
- Disaster recovery scenario tests
- Incident notification windows
- Sub-processors
- Data location
A supplier should prepare answers on each topic alongside the report.
What is the difference between OSFI B-10 and B-13?
OSFI B-13 sets expectations for how a federally regulated financial institution manages the institution's own technology and cyber risk. OSFI B-10 sets expectations for how the institution manages risk from third parties. B-10 carries B-13 to suppliers: Annex 1 of B-10 asks the institution to assess a third party's capacity to manage technology and cyber risk in line with B-13.
How fast must a vendor report a cyber incident to a Canadian bank?
OSFI requires federally regulated financial institutions to report technology and cyber incidents to OSFI within 24 hours, or sooner if possible. OSFI B-10 expects third parties to notify the institution promptly, and the vendor's exact deadline is set in the vendor's contract with each institution. Vendors should record each customer's notification window in their incident response plan.
Does OSFI B-13 require vendors to do penetration testing?
OSFI B-13 section 3.1.2 expects federally regulated financial institutions to run intelligence-led threat assessment and testing, including penetration testing and red teaming. The expectation is on the institution, but a bank may extend the expectation to critical suppliers through due diligence and ask for a recent penetration test report with evidence that the vulnerabilities found were fixed.
Ready to Start Your Compliance Journey?
Get a clear, actionable roadmap with our readiness assessment.
Contact Us
Sample SOC 2 Control List
Input your email to download the list.
About the Author
Former security architect for Bank of Canada and Payments Canada. 20+ years building compliance programs for critical infrastructure.