Meeting OSFI B-13 with a lean IT team

The short answer: which rules apply to your mutual

It depends on who licenses you. B-13 binds federally regulated insurers. Mutuals incorporated in Ontario answer to FSRA, whose IT risk guidance FSRA itself describes as aligned with B-13. Privacy law applies to everyone.

Outside Ontario, FSRA points to similar guidance from other regulators, such as the BC Financial Services Authority's Information Security Guideline and the AMF's guideline on information and communications technology risk in Québec. This guide is general information, not legal or regulatory advice.

FSRA's seven practices for Ontario-incorporated insurers

For insurers incorporated in Ontario, FSRA's IT Risk Management Guidance is an interpretation of the Insurance Act, not just advice: insurers must achieve the desired outcomes of each practice, and FSRA says insurers that cannot demonstrate compliance may face supervisory or enforcement action. Accountability for IT risk rests with the Board.

1. Governance. A Board-approved IT strategy and risk approach, enough resources, and a clear, Board-approved definition of a material IT incident.
2. Risk management. A Board-approved IT risk appetite with tolerances and limits; policies to identify, mitigate, monitor and respond; regular reporting to the Board; enterprise-wide awareness training.
3. Data management. Data classified with clear owners; access controlled through multi-factor authentication, segregation of duties and least privilege; data controls tested; PIPEDA compliance.
4. Outsourcing. The Board keeps accountability. Assess providers before contracting, rate their criticality, include audit and information rights, require incident notice, test their compliance, and plan an exit.
5. Incident preparedness. A documented incident process with defined roles, periodic table-top exercises that include third parties, independent review, escalation to the Board, and root-cause analysis.
6. Continuity and resilience. An inventory of IT assets with criticality, replacement before end of support, service level agreements, change management, and a tested disaster recovery plan aligned with the business continuity plan.
7. Notification of material IT risk incidents. Clear thresholds, an assigned owner, and notice to FSRA no later than 72 hours after determining an IT risk incident has occurred.

FSRA's Operational Risk and Resilience guidance (effective June 8, 2026) adds four principles (governance, operational risk identification and assessment, operational risk management, and resilience) and uses them, with the IT guidance, to assess how insurers manage IT and cyber risk.

How a lean mutual can meet it

Both regulators allow for size. FSRA describes outcomes rather than methods, to be achieved in a way that suits the size and nature of the business, and says smaller insurers can keep oversight independent through separation of duties and independent review. Here is the order we would work in. This is our practice, not a regulatory requirement.

• Name the accountable executive, then give the Board one page. A short framework, a few appetite statements, and a definition of a material incident the Board approves.
• Build the asset inventory and the end-of-life list first. Patching, recovery, vendor oversight and Board reporting all depend on knowing what you run and what is no longer supported.
• Bring the MSP and core-system vendor inside the framework. Audit rights, incident notice and an exit plan in the contracts, and a seat at your exercises.
• Run a table-top exercise that ends with the regulator notice drafted. 24 hours for OSFI or 72 for FSRA is short when nobody has done it before.
• Report to the Board on a small, steady set of measures. Open high risks, end-of-life systems, patch currency, recovery test results, incidents and provider issues.

This is the work ABISOL does as a fractional CISO or fractional CIO for mutuals: ABISOL builds the framework with your team, reports to your Board and oversees your providers, while accountability stays where the regulators expect it. See how ABISOL works with mutual insurers.