OSFI Guideline B-13 — Technology and Cyber Risk Management
The Office of the Superintendent of Financial Institutions (OSFI) Guideline B-13 — Technology and Cyber Risk Management (issued July 2022, effective January 2024) — sets the supervisory expectations for technology and cyber risk management at federally regulated financial institutions (FRFIs) in.
Canada. For ITAD specifically, B-13 paragraphs 4.4 and 4.5 (Asset Management) and Annex 2 (operational practices) define the disposition expectation. Maxicom engagements with Canadian BFSI clients are structured to satisfy B-13 in admissible form for OSFI inspection.
B-13 Domain 4 — Technology Operations and Resilience
B-13 Domain 4 covers Technology Operations and Resilience. Asset Management (Section 4.4) requires FRFIs to identify, classify, and manage technology assets through their lifecycle, including disposition. Disposition Section 4.5 requires sanitisation and disposal aligned to the asset classification. Operationally, this maps to: per-asset inventory at retirement, sanitisation method matched to the data classification, per-asset Certificate of Destruction, retention 7+ years.
Big Five bank engagement profile
Canada's Big Five — RBC, TD, Scotiabank, BMO, CIBC — all operate to B-13. Refresh cycles produce predictable retiring volumes: branch-network laptop fleets at 3-year cycles, back-office server estates at 5-year cycles, ATM IT on rolling refresh, capital-markets trading-floor IT on faster cycles. Engagement profile: programme-level master service agreements, NDA-bound, witness destruction for top-classified.
Smaller FRFI engagement profile
Beyond the Big Five, B-13 covers approximately 350 FRFIs (smaller chartered banks, federally regulated credit unions, trust and loan companies, federally regulated insurance companies). Engagement model is similar to Big Five but at smaller scale; programme contracts available at 100-asset minimum.
OSFI Cyber Security Self-Assessment
Beyond B-13, OSFI conducts the Cyber Security Self-Assessment (CSSA) annually. ITAD documentation is in scope. Maxicom certificate retention vault is structured for CSSA evidence retrieval.
OSFI inspection of ITAD documentation
OSFI inspections of FRFI technology operations typically include sampling of ITAD documentation for completeness. The four-criterion check (per-asset granularity, standard citation, verification evidence, chain-of-custody continuity) applies. Maxicom certificates pass all four; we have served OSFI inspections at multiple FRFI engagements without findings.
Authoritative references
Primary sources for the standards and frameworks referenced on this page. Maxicom maps every engagement to these recognised authorities.
Frequently asked questions
Are Maxicom certificates B-13-acceptable?
Yes. Per-asset detail, NIST SP 800-88 / IEEE 2883 method citation, verification evidence, chain-of-custody reference. Designed for OSFI inspection.
Does OSFI directly regulate Maxicom?
No — OSFI regulates the FRFI; Maxicom is the disposition vendor under contract. OSFI has audit-of-vendor rights through the FRFI contract.
What about Quebec FRFIs — do Quebec Law 25 + B-13 both apply?
Yes. Maxicom certificates are written to satisfy both simultaneously. French-language certificates available for Quebec engagements.
How is settlement handled for FRFI engagements?
In CAD against PO. Programme engagements run on milestone-based settlement.
Related practices, regulators & markets
IT Asset Disposal (ITAD)
ITAD
→Data Destruction
Data destruction
→Dell Server Buyback
Dell server buyback
→HPE Server Buyback
HPE server buyback
→Banking & Finance
Banking
→Government & Public Sector
Government
→NIST SP 800-88 Rev. 1
NIST 800-88
→IEEE 2883-2022
IEEE 2883
→IT disposal in Toronto
Toronto
→Send the asset list. We will send the number.
A photograph of the rack works. A spreadsheet works better. CAD settlement, against PO.