FRFIs should implement the expectations in this Guideline commensurate with its size; the nature, scope and complexity of its operations; and risk profile. OSFI’s expectations are technology-neutral, anticipating the need for FRFIs to compete effectively and take full advantage of digital innovation while maintaining a sound technology posture.

Structure

A.2.1 This Guideline is organized into five domains. Each sets out key components of sound technology and cyber risk management.

• Governance and Risk Management – Sets OSFI’s expectations for the formal accountability, leadership, organizational structure and framework used to support risk management and oversight of technology and cyber security.
• Technology Operations – Sets OSFI’s expectations for management and oversight of risks related to the design, implementation and management of technology assets and services.
• Cyber Security – Sets OSFI’s expectations for management and oversight of cyber risk.
• Third-Party Provider Technology and Cyber Risk – Expanding on OSFI’s existing guidance for outsourcing and third-party risk, sets expectations for FRFIs that engage with third-party providers to obtain technology and cyber services and/or other services that give rise to cyber and/or technology risk.
• Technology Resilience – Sets OSFI’s expectations for capabilities to deliver technology services through operational disruption.

See:  Cyber Risk is the New Threat to Financial Stability

Desired outcomes

1. Technology and cyber risks are governed through clear accountabilities and structures, and comprehensive strategies and frameworks.
2. A technology environment that is stable, scalable and resilient. The environment is kept current and supported by robust and sustainable technology operating processes.
3. A secure technology posture that maintains the confidentiality, integrity and availability of the FRFI’s technology assets.
4. Reliable and secure technology and cyber operations from third-party providers.
5. Technology services are delivered, as expected, through disruption.

Continue to the full article --> here