Sign in

OSFI cyber self-assessment

OSFI Technology and Cyber Risk Management Self-Assessment Tool — OSFI (Office of the Superintendent of Financial Institutions, Canada)

Also known as: CSAG, Cyber Security Self-Assessment, Cyber Security Self-Assessment Guidance, OSFI Self-Assessment Guidance, Technology and Cyber Risk Management Self-Assessment Tool

Official site Official change log Subscribe to OSFI cyber self-assessment (RSS)

Current version
Technology and cyber risk management self-assessment tool (November 2025)
Published 3 November 2025. source
Status
In force
Next deadline
None announced
Who must comply
Federally regulated financial institutions in Canada (banks, foreign bank and insurance branches, life, property and casualty insurers, trust and loan companies) that choose to use it. source
How it is assessed
Institutions rate themselves; they may use this tool or similar frameworks to evaluate their technology and cyber preparedness. source
Written by
Published by the Office of the Superintendent of Financial Institutions (OSFI) as a voluntary, self-serve tool aligned with Guideline B-13. source
Enforced by
The tool is voluntary; OSFI's expectations themselves sit in Guideline B-13. source
Last change
None recorded yet

A voluntary questionnaire OSFI publishes so that a federally regulated financial institution can measure its own technology and cyber risk practices against the supervisor's expectations. It is maintained alongside Guideline B-13.

Recent changes

No changes recorded yet — we are watching, and nothing has been published.

Key dates

No upcoming dates
  1. OSFI publishes the updated technology and cyber risk management self-assessment tool

Version history

  1. Technology and cyber risk management self-assessment tool (November 2025) RevisionCurrent

    OSFI updated its existing voluntary cyber security self-assessment tool and aligned it with Guideline B-13, adding references to other OSFI guidelines. source

    More
    • Each process or control is rated on a maturity scale from 0 (non-existent) to 5.
  2. —
    Cyber Security Self-Assessment tool Major version

    The earlier OSFI cyber security self-assessment tool, referred to in the July 2022 B-13 release letter as existing guidance that complements B-13. source

Who it applies to

A voluntary questionnaire for FRFIs to gauge the maturity of their technology and cyber risk practices against OSFI's expectations.

Purpose
Assess the maturity of each process or control, gauge preparedness for technology and cyber risks, identify control gaps and strengthen risk management practices. source
Relation to B-13
The tool is aligned with Guideline B-13, which remains the primary guideline for technology and cyber risk management. source
Sectors
Banks, foreign bank branches, foreign insurance branches, life insurance and fraternal companies, property and casualty companies, and trust and loan companies. source

How compliance is assessed

Institutions rate themselves; they may use this tool or similar frameworks to evaluate their technology and cyber preparedness.

Maturity scale
A rating scale from 0 to 5 for each process or control, where 0 means the process or control does not exist. source
Alternatives
Institutions may leverage this self-assessment or similar frameworks to evaluate their current level of technology and cyber preparedness. source

Enforcement and penalties

The tool is voluntary; OSFI's expectations themselves sit in Guideline B-13.

Voluntary
OSFI describes the tool as voluntary and self-serve. source
Primary guideline
Guideline B-13 remains the primary guideline for technology and cyber risk management. source

Documents

  1. Template Technology and cyber risk management self-assessment tool (page and XLSX)
  2. Standard Guideline B-13 - Technology and Cyber Risk Management

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to OSFI cyber self-assessment (RSS)