OSFI B-13 1: Governance, Risk Management, and Three Lines of Defense
Establish governance + risk management + three lines of defense per OSFI Guideline B-13 Technology and Cyber Risk Management (issued July 2022, effective 1 January 2024). B-13 applies to Federally Regulated Financial Institutions (FRFIs) including banks + insurance companies + trust and loan companies + pension plan administrators + Crown corporations. Governance must (a) establish technology and cyber risk management framework approved by Board + senior management + (b) maintain risk appetite and tolerance per Domain 1 + (c) implement three lines of defense with documented responsibilities (Line 1: business + IT operations; Line 2: independent technology and cyber risk management; Line 3: internal audit) + (d) integrate with broader Enterprise Risk Management + (e) name accountable executive (typically CISO + CTO + COO + or equivalent) with documented reporting line + decision authority. Maintain board-level oversight + reporting on technology and cyber risk metrics + emerging threats + control effectiveness + investment + with at least annual review.
What else in your programme already covers this
This control maps to 255 controls across 118 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria
NIST-CSF-GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
NIST-CSF-GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated
NIST-CSF-GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
2.2.2 Vendor default accounts are managed as follows: • If the vendor default account(s) will be used, the default password is changed per Requirement 8.3.6. • If the vendor default account(s) will not be used,