Establish governance + risk management + three lines of defense per OSFI Guideline B-13 Technology and Cyber Risk Management (issued July 2022, effective 1 January 2024). B-13 applies to Federally Regulated Financial Institutions (FRFIs) including banks + insurance companies + trust and loan companies + pension plan administrators + Crown corporations. Governance must (a) establish technology and cyber risk management framework approved by Board + senior management + (b) maintain risk appetite and tolerance per Domain 1 + (c) implement three lines of defense with documented responsibilities (Line 1: business + IT operations; Line 2: independent technology and cyber risk management; Line 3: internal audit) + (d) integrate with broader Enterprise Risk Management + (e) name accountable executive (typically CISO + CTO + COO + or equivalent) with documented reporting line + decision authority. Maintain board-level oversight + reporting on technology and cyber risk metrics + emerging threats + control effectiveness + investment + with at least annual review.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.