Penetration Testing Aligned to OSFI Guideline B-13

OSFI Guideline B-13, Technology and Cyber Risk Management, sets out the Office of the Superintendent of Financial Institutions' expectations for how federally regulated financial institutions (FRFIs) in Canada manage technology and cyber risk. It was published on 31 July 2022 and came into effect on 1 January 2024. The guideline is organised around three domains: governance and risk management, technology operations and resilience, and cyber security. It applies to FRFIs including banks, foreign bank branches, life and property-and-casualty insurers, and trust and loan companies. B-13 is principles- and outcome-based rather than prescriptive, so it describes the resilience outcomes OSFI expects rather than mandating specific tools or test schedules.

B-13 is outcome-based and does not prescribe a fixed penetration testing cadence or a single mandated methodology. It does, however, set out cyber security outcomes — maintaining the confidentiality, integrity and availability of technology assets, and the ability to identify, defend, detect, respond to and recover from cyber threats — that independent security testing directly supports. In practice, FRFIs use regular penetration testing and threat-led adversary simulation as evidence that controls are designed and operating effectively against current and emerging threats. We frame our engagements to support those B-13 outcomes; we do not represent testing as a guarantee of regulatory compliance, which remains OSFI's determination.

Penetration testing most directly supports the cyber security domain, where it provides empirical evidence that detective and protective controls work against realistic attacker techniques. It also supports the technology operations domain by validating the security of technology architecture, configuration, and change. Findings feed the governance and risk management domain by giving the board and senior management an independent, risk-rated view of residual technology and cyber risk. We map each finding to the relevant domain in the report so risk and compliance teams can place it in their B-13 self-assessment without re-interpretation.

Threat-led penetration testing (sometimes called intelligence-led or threat-led red teaming) uses current threat intelligence about the actors and techniques most likely to target a financial institution to drive realistic, objective-based attack simulation against production environments. It tests not just whether a vulnerability exists but whether the institution can detect and respond to a real adversary. This maps closely to the detect-and-respond outcomes in the B-13 cyber security domain. For FRFIs with mature security functions, threat-led testing produces the most defensible evidence of cyber resilience; for those earlier in their maturity, scoped network, web, and Active Directory penetration testing is usually the right starting point.

Yes. Engagement data, evidence files, scoping documents, and exploitation artefacts remain inside Canadian jurisdiction under PIPEDA and applicable provincial privacy law, and are not routed through offshore delivery centres. For FRFIs subject to OSFI's third-party risk and data residency expectations, a Canada-based principal-led provider removes a procurement and outsourcing-review step that offshore vendors typically trigger.

OSFI does not set a fixed frequency in B-13. Common practice among Canadian FRFIs is at least annual penetration testing of internet-facing and internal environments, additional testing after significant changes to technology architecture, and periodic threat-led adversary simulation for the most critical systems. The right cadence is risk-based and should be documented in the institution's technology and cyber risk management framework so it can be evidenced during an OSFI review. We help clients set a defensible, risk-aligned testing schedule rather than testing for its own sake.