Does OSFI require penetration testing?
By Nick Jang, founder of MINERVA Studio ·
The short answer
Yes, in substance. OSFI's Guideline B-13 expects federally regulated institutions to test their cyber defences regularly, naming penetration testing and red teaming as examples and asking for an intelligence-led approach, with triggers and minimum frequencies the institution sets itself. Separately, OSFI's I-CRT framework puts the largest banks and insurance groups through a full intelligence-led red-team exercise, recommended once every three-year supervisory cycle.
What B-13 actually says
B-13, OSFI's guideline on technology and cyber risk, has applied since 1 January 2024. Its cyber security section asks institutions to regularly run tests and exercises that find vulnerabilities and control gaps, and gives penetration testing and red teaming as examples, done with an intelligence-led approach. In other words, test against the attacks that are actually aimed at institutions like yours, not only a generic scan.
Two details matter in practice. The institution should define the scope and possible impact of each test before it runs, which is how you avoid a red team taking down a payment system by accident. And it should set its own triggers and minimum frequencies for intelligence-led threat assessments. B-13 doesn't give a number. Your framework does, and a supervisor will ask you to show it and show you kept to it.
The other testing B-13 expects
| Kind of test | What B-13 expects |
|---|---|
| Penetration testing and red teaming | Regular, intelligence-led, with scope and impact defined in advance |
| Vulnerability scans and assessments | A documented process that states how often they're run |
| Incident response exercises | Periodic testing using plausible scenarios |
| Disaster recovery | Scenario testing of recovery capabilities |
A penetration test is one input, not the programme. What OSFI looks for is the loop around it: findings logged, owners named, fixes tracked to closure, and the next test checking that the fix worked.
I-CRT: the red-team framework for the largest institutions
In April 2023 OSFI published its Intelligence-led Cyber Resilience Testing framework, I-CRT. It's modelled on schemes such as the Bank of England's CBEST and the EU's TIBER-EU, and it was piloted with banks and insurers before release.
Its current scope is Canada's systemically important banks and internationally active insurance groups. OSFI recommends an assessment at least once in each three-year supervisory cycle, and it can also be triggered by events such as a major cyber incident. Other institutions can ask OSFI for one, and OSFI decides case by case.
- Initiation, about 6 to 8 weeks: scoping, the institution's control group, procurement of providers.
- Threat intelligence, about 6 to 10 weeks: an outside provider builds the threat picture and the attack scenarios.
- Execution, about 8 to 12 weeks: a separate red-team provider runs the scenarios against live systems.
- Closure, about 4 to 6 weeks: reports, a remediation plan, and a supervisory letter from OSFI that the institution answers with action plans.
OSFI describes I-CRT as a supervisory tool and a how-to guide, not a policy instrument that sets expectations. The expectations themselves sit in B-13.
Suppliers, cloud and AI
Testing doesn't stop at your own network. Under Guideline B-10, ask critical suppliers for their own test results and the right to see them, and make sure your contract lets you or OSFI get the information you need. For cloud services, check what the provider's terms allow before anyone points a scanner at them.
If you run AI systems, add them to scope. A penetration test checks the way in; AI red teaming checks whether the model itself can be talked into leaking data or ignoring its instructions. Banks increasingly need both.
Where MINERVA fits
MINERVA doesn't run penetration tests. It keeps the record around them for models and AI systems: the findings raised, who owns them, when they were closed, and the decisions that depended on them. See OSFI B-13.
Related questions
How often does OSFI require penetration testing?
B-13 doesn't set a number. The institution sets triggers and minimum frequencies in its own framework, scaled to its risk, and should be able to show it follows them.
Is I-CRT mandatory?
OSFI calls I-CRT a supervisory tool rather than a policy instrument. It currently covers systemically important banks and internationally active insurance groups, with an assessment recommended once every three-year supervisory cycle.
Can smaller banks and insurers do an I-CRT?
They can ask OSFI for one. OSFI evaluates such requests case by case.
Is a vulnerability scan the same as a penetration test?
No. A scan looks for known weaknesses automatically. A penetration test has a person try to exploit weaknesses the way an attacker would. B-13 expects both, at frequencies the institution documents.
Who should run the tests?
B-13 doesn't require outside testers for every test, but I-CRT uses separate external providers for threat intelligence and the red team, to keep the work independent.
Sources
- OSFI — Guideline B-13, Technology and Cyber Risk Management
- OSFI — Intelligence-led Cyber Resilience Testing (I-CRT) Framework
- OSFI — OSFI releases new framework to strengthen financial institutions' resilience to cyber-attacks (21 April 2023)
- OSFI — Third-Party Risk Management Guideline (B-10)
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.