What is OSFI’s cyber security self-assessment?
By Nick Jang, founder of MINERVA Studio ·
The short answer
OSFI’s technology and cyber risk management self-assessment tool is a voluntary Excel workbook that lets a bank or insurer rate itself against OSFI’s Guideline B-13. OSFI updated it on 3 November 2025, replacing its older cyber security self-assessment. It lists 57 expectations in three domains (governance and risk management, technology operations and resilience, and cyber security), and you rate each one on a maturity scale from 0 to 5, then record the gaps and an action plan with dates. OSFI calls it self-serve: it’s for your own use, not a return you file.
What’s in the workbook
The file has four working sheets:
- User guide: what the tool is for and how to complete it.
- Assessment information: the institution, the coordinator, who completed the assessment, who reviewed and approved it, and the date.
- Maturity assessment matrix: the 57 expectations, each with its B-13 principle, a description, additional considerations, and three columns for you to fill in: maturity level, gaps identified, and action plans with timelines.
- Maturity model: what each level from 0 to 5 means.
The "additional considerations" column is worth reading. It ties each expectation to OSFI’s other guidance: B-10 for third parties, E-21 for operational resilience, the Corporate Governance Guideline, the Integrity and Security Guideline and the incident reporting advisory.
The three domains
| Domain | B-13 principles | What it covers | Expectations |
|---|---|---|---|
| 1. Governance and risk management | 1 to 3 | Senior management accountability, structure and training, technology and cyber strategy, the risk management framework. | 5 |
| 2. Technology operations and resilience | 4 to 13 | Architecture, asset inventory, projects, the system development life cycle, change and release, patching, incident and problem management, service monitoring, disaster recovery and its testing. | 25 |
| 3. Cyber security | 14 to 17 | Identify, defend, detect, and respond, recover and learn: threat assessment and testing, vulnerabilities, data protection, access management, logging, alert triage, incident response, forensics. | 27 |
Domain 3 has the most detail. Its "defend" part alone has ten expectations, from secure-by-design and cryptography to identity and access management and physical access.
The maturity scale
| Level | Name | In short |
|---|---|---|
| 0 | Non-existent | The control hasn’t been identified or put in place. |
| 1 | Initial | Controls are informal and reactive, applied in response to events rather than through defined processes. |
| 2 | Repeatable | Controls are documented and repeatable, but not applied consistently across the institution; oversight is just starting. |
| 3 | Defined | A well-defined framework with clear governance, applied consistently; metrics are starting to be tracked and reported. |
| 4 | Quantitatively managed | Measurable targets tied to risk appetite, control effectiveness measured, and cyber risk part of enterprise risk management. |
| 5 | Optimized | Fully embedded, forward-looking and continuously improved, with third parties held to the same requirements. |
Be honest with the scale. A level 2 means controls are written down; level 3 means they are applied consistently, with governance over them. Most teams find that writing down the evidence behind each rating is what keeps the numbers straight.
How to run it
OSFI’s user guide sets out four steps:
- Prepare: read the 57 expectations and gather the people and documents behind each one.
- Assess: rate each expectation against the maturity model.
- Identify gaps: compare where you are with where you want to be.
- Plan: write action plans with timelines.
Then track the plans and repeat the assessment as things improve. A target isn’t level 5 everywhere: decide the level each expectation needs, given your size and risk, and put your effort where the gap is widest on what matters most.
Whoever approves the assessment should be senior enough to fund the action plans. The workbook has a line for that name.
What it doesn’t cover
The tool is about technology and cyber risk under B-13. It doesn’t ask about the models or AI systems running on that technology. Those fall under OSFI’s E-23, from 1 May 2027, and AI bought from vendors falls under B-10 as well. MINERVA keeps that side: the model inventory, its approvals and the evidence behind them. See how MINERVA maps to E-23, B-10 and B-13.
Related questions
Is OSFI’s cyber self-assessment mandatory?
No. OSFI describes the technology and cyber risk management self-assessment tool as voluntary and self-serve. Guideline B-13 is the expectation; the tool helps you measure yourself against it.
When was OSFI’s cyber self-assessment updated?
OSFI published the updated tool on 3 November 2025, aligned with Guideline B-13. It replaces the earlier cyber security self-assessment guidance.
How many controls are in OSFI’s self-assessment?
The maturity assessment matrix lists 57 expectations from Guideline B-13: 5 on governance and risk management, 25 on technology operations and resilience, and 27 on cyber security.
What maturity levels does the OSFI self-assessment use?
Six levels from 0 to 5: non-existent, initial, repeatable, defined, quantitatively managed and optimized.
Do you have to send the self-assessment to OSFI?
OSFI presents it as a self-serve tool for the institution’s own use. Supervisors may still ask how you assess yourself against B-13, so keep the completed workbook and its evidence.
Sources
- OSFI — Technology and cyber risk management self-assessment tool (3 November 2025)
- OSFI — Guideline B-13, Technology and Cyber Risk Management
- OSFI — Technology and Cyber Security Incident Reporting
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.