B-13: technology risk governance
OSFI Guideline B-13, Technology and Cyber Risk Management, "establishes OSFI's expectations related to technology and cyber risk management. It is applicable to all federally regulated financial institutions (FRFIs), including foreign bank branches and foreign insurance company branches" (OSFI, B-13). The final version was published on July 13, 2022 and has been effective since January 1, 2024, giving FRFIs time to self-assess (OSFI letter). Here, Groupe Conseil GRD focuses on the first domain, governance.
A risk-based approach
OSFI states: "There is no one-size-fits-all approach for managing technology and cyber risks given the unique risks and vulnerabilities that vary with a FRFIs' size, the nature, scope, and complexity of its operations, and risk profile. This Guideline should be read, and implemented, from a risk-based perspective" (OSFI, B-13).
Three domains, three outcomes
B-13 has three domains, each with a desired outcome (OSFI, B-13):
- Governance and risk management: "Technology and cyber risks are governed through clear accountabilities and structures, and comprehensive strategies and frameworks."
- Technology operations and resilience: "A technology environment that is stable, scalable and resilient. The environment is kept current and supported by robust and sustainable technology operating and recovery processes."
- Cyber security: "A secure technology posture that maintains the confidentiality, integrity and availability of the FRFI's technology assets."
Principle 1: accountability and structure
"Senior Management is accountable for directing the FRFI's technology and cyber security operations and should assign clear responsibility for technology and cyber risk governance to senior officers." Examples include the Head of Information Technology, CTO, CIO, Head of Cyber Security or CISO, and "these roles should have appropriate stature and visibility throughout the institution." FRFIs should also establish an organizational structure "with clear roles and responsibilities, adequate people and financial resources, and appropriate subject-matter expertise and training", include among Senior Management "persons with sufficient understanding of technology and cyber risks", and "promote a culture of risk awareness" (OSFI, B-13).
Principle 2: a measurable strategy
"FRFIs should define, document, approve and implement a strategic technology and cyber plan(s). The plan(s) should align to business strategy and set goals and objectives that are measurable and evolve with changes in the FRFI's technology and cyber environment." The plan(s) should, among other things, "include risk indicators that are defined, measured, monitored and reported on" and "articulate how technology and cyber security operations will support the overall business strategy" (OSFI, B-13).
Principle 3: a risk management framework
"FRFIs should establish a technology and cyber risk management framework (RMF)", in alignment with the enterprise risk management framework, and "regularly review and refresh" it. B-13 lists elements to consider, including (OSFI, B-13):
- accountability for technology and cyber risk management, including for relevant Oversight Functions;
- technology and cyber risk appetite and measurement (e.g., limits, thresholds and tolerance levels);
- a technology and cyber risk taxonomy;
- control domains for technology and cyber security;
- policies, standards and processes that are "approved, regularly reviewed and consistently implemented enterprise-wide";
- processes for managing exceptions;
- management of unique risks posed by emerging threats and technologies;
- reporting to Senior Management on risk appetite measures, exposures and trends.
How to prepare
OSFI lists a technology and cyber risk management self-assessment tool with the guideline (OSFI, B-13). Our "OSFI B-13 self-assessment" guide provides a grid drawn from the B-13 text. We recommend starting with three checks: who in Senior Management formally owns this risk; whether technology and cyber risk appetite is documented; and whether indicators are regularly reported to Senior Management.
Request a quote: info@grdinc.ca