OSFI B-13 Lessons for Every Canadian Company

Why non-financial companies should care about B-13

Even if OSFI doesn’t regulate you, your stakeholders increasingly expect the same outcomes B-13 pushes:
clear accountability, resilient operations, and repeatable security controls that can be evidenced.

The B-13 “borrow list”: controls that translate to any Canadian company

Start with the controls that create clarity and proof fast. This table is board-friendly.

Domain 1: Governance & risk management

1) Name an executive owner for tech + cyber risk

Borrow it like this: assign one accountable executive sponsor, document the RACI, and record decisions in minutes.

2) Publish a measurable technology + cyber strategy

Borrow it like this: write a one-page annual strategy (top risks, top initiatives, KPIs) and update quarterly.

3) Run a real risk management framework (with time-bound acceptance)

Borrow it like this: define a simple risk taxonomy, set risk appetite statements, and enforce expiry dates on risk acceptance.

4) Make management review a governance engine

Borrow it like this: hold a quarterly tech and cyber risk review with leadership. Bring top risks, incidents, control health, vendor risk, and actions.

Domain 2: Technology operations & resilience

5) Treat tech operations as a control system (not tribal knowledge)

Borrow it like this: standardize change management, patch SLAs by severity, and configuration baselines (M365/cloud/endpoints/servers).

6) Prove backup and recovery don’t just claim it

Borrow it like this: define RTO/RPO for critical services, test restores on a schedule, and record improvements.

7) Map critical operations to technology dependencies

Borrow it like this: list your top business-critical processes and document what systems and vendors each depends on.

8) Build an operational exception workflow

Borrow it like this: no exceptions in email. Every exception needs a reason, compensating controls, owner, expiry date, and approval.

Domain 3: Cyber security

9) Identity becomes your primary control plane

Borrow it like this: enforce MFA for everyone, apply stronger admin controls, monitor break-glass accounts, and review privileged access quarterly.

10) Logging and monitoring with proof of review

Borrow it like this: decide what you monitor, set a review cadence, and track alert-to-ticket-to-resolution.

11) Incident response you’ve practiced

Borrow it like this: keep the playbook short, define escalation, and run at least one tabletop exercise each year.

12) Vendor risk governance that leadership can read

Borrow it like this: tier vendors, review critical vendors at least annually, and track exceptions and renewal-driven reviews.
B-13 is commonly read alongside related OSFI guidance like B-10 and E-21 because these risks intersect.

A realistic B-13-inspired starter pack (90 days)

If you want high impact with minimal overhead, start here.

Bottom line

OSFI B-13 is a financial regulator guideline, but its structure is universally useful: governance, resilience, and cyber security backed by evidence.