09/15/2026
Meeting the OSFI E-21 deadline was step one. Demonstrating resilience is the work that follows.
The focus now is on evidence: can you demonstrate that critical operations will remain within tolerance during a cyber incident, technology outage, or third-party disruption?
What that evidence looks like:
➤ Scenario testing underway, progressing toward full coverage of critical operations by September 1, 2027
➤ Critical third-party dependencies mapped, assessed, and supported by contingency plans
➤ Clear board reporting on resilience, test results, gaps, and remediation
E-21 also works alongside B-10 third-party risk management. And with OSFI’s E-23 model-risk-management guideline taking effect May 1, 2027, the regulatory agenda is only expanding.
ISA Cybersecurity helps Canadian financial institutions build, test, and demonstrate cyber resilience.
Let’s talk: https://hubs.li/Q04w_qT50