Loading...
Non-Security Software Defects Are In Scope Under OSFI B-13. Here's What Federally Regulated Financial Institutions (FRFIs) in Canada Need to Know
Canada's Office of the Superintendent of Financial Institutions (OSFI) Guideline B-13: Technology and Cyber Risk Management doesn't just cover cybersecurity. The same framework that governs CVE management also covers the operational defects that cause outages, database corruption, and performance degradation.
When most Canadian financial institutions talk about Guideline B-13, the conversation gravitates toward cybersecurity: governance, threat detection, incident response, controls against ransomware, and credential theft. That's the visible half of the technology risk picture. The other half - operational software defects - gets far less airtime in B-13 discussions, even though those defects are responsible for a substantial share of real-world service disruptions in the financial sector.
This is a gap worth closing, as OSFI's expectations in this area are more explicit than many institutions realize.
What B-13 Actually Says
Guideline B-13, in force for FRFIs since January 1, 2024, sets out OSFI's expectations for how institutions identify, assess, manage, and remediate technology and cyber risks in support of operational resilience. The guideline is principles-based and organized around three domains, with the Technology Operations and Resilience domain carrying the bulk of the operational-defect-relevant expectations.
Within that framework, institutions are expected to maintain sound practices across four disciplines that bear directly on non-security software defects:
Change management: controlling what gets deployed, when, and under what conditions, including vendor-supplied updates
Technology asset management: maintaining accurate inventories of what's running where, and at what versions
Incident management: detecting, responding to, and learning from operational disruptions regardless of cause
Vulnerability management: identifying defects in the technology stack that could cause harm
It's the last item that often gets misread. In many institutions, "vulnerability management" has come to mean "CVE patching" - narrowly focused on security vulnerabilities tracked through standard cybersecurity feeds. B-13's language is broader than that, and OSFI has confirmed as much in direct correspondence: institutions are expected to have appropriate controls and processes to manage the risks arising from the technology they use, including software issues that could lead to operational impacts.
Why the Distinction Matters
A non-security software defect doesn't necessarily look like a cyber threat. There's no attacker, no exploit, no CVE identifier, no urgency from the security operations center. What there is, instead, is a defect buried in a vendor's release notes or support bulletin that can corrupt a database, crash a payment processing service, or degrade performance below tolerance for hours at a time.
Related Reading
AI-Assisted Development Is the New Baseline: What That Means for Third-Party Operational Resilience 
Kevin Roche
April 3rd, 2026
Subscribe to our Zero Defect Digest
Sign up to receive a monthly email with stories and guidance on getting proactive with vendor risk
BugZero requires your corporate email address to provide you with updates and insights about the BugZero solution, Operational Defect Database (ODD), and other IT Operational Resilience matters. As fellow IT people, we hate spam too. We prioritize the security of your personal information and will only reach out only once a month with pertinent and valuable content.
You may unsubscribe from these communications at anytime. For information on how to unsubscribe, as well as our privacy practices and commitment to protecting your privacy, check out our Privacy Policy.
