vCISO work for OSFI regulated institutions

A federally regulated financial institution can use a vCISO, and cannot outsource the accountability. OSFI expects a senior individual inside the institution who is answerable for technology and cyber risk. The workable arrangement is an internal accountable officer with fractional expertise underneath, not a retainer holding the seat.

Last reviewed 2026-09-01Written by Jacob Masse, TrazTech Inc.

OSFI does not prohibit a virtual or fractional CISO, and it does not recognise one either. Guideline B-13 on technology and cyber risk management expects clear accountability for technology and cyber risk at senior management level with appropriate board oversight, and Guideline B-10 on third-party risk is explicit that outsourcing an activity does not transfer accountability for it. Read together, that means a smaller federally regulated institution can buy the expertise fractionally and must still name someone internally who answers for it. Retainers for this work run $8,000 to $30,000 CAD a month, materially above the general market on vCISO pricing, because the person has to have been examined before.

Most people who land here are not OSFI regulated. If you are a software startup, a payments company without a federal charter, or any business that sells to a bank or an insurer rather than being one, none of the guidelines below apply to you directly. Read vCISO work for a Canadian fintech, which covers answering a regulated institution's supplier review. If a bank has sent you a questionnaire and nobody at your company owns security, start with the questionnaire with no owner.

The guidelines that set the expectations

Two things follow from that set. The first is that this is a governance job before it is a technical one: most of the work is framework, evidence, committee papers and challenge, and an examiner reads documents rather than firewalls. The second is that E-21 has changed the shape of the role. Framing security as controls is no longer sufficient. It has to be framed as tolerances for disruption to critical operations, which is a different conversation and one a lot of otherwise strong candidates cannot hold.

What a vCISO can own, and what stays internal

The pattern that survives an examination is a named internal accountable executive, frequently the chief risk officer or a head of operational risk at a smaller institution, with a fractional security leader supplying the technical depth, the framework drafting and the committee material. What fails examination is the institution pointing at an external retainer when asked who is accountable. The reporting line question is covered on who a CISO should report to, and under this guidance the answer skews towards risk rather than towards engineering.

Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.

Your vCISO is itself a third-party arrangement

This is the part institutions forget. Engaging a security leader is outsourcing, and B-10 applies to it. If the arrangement is assessed as critical, and security leadership at a small institution frequently is, expect the full treatment.

• Documented due diligence on the provider before engagement, retained for examination
• A recorded criticality assessment of the arrangement
• Audit and access rights, extending to OSFI where the arrangement is critical
• Subcontracting disclosed and controlled, so you know who actually does the work
• Data location and cross-border processing addressed, including any US or offshore staff
• An exit plan that works if the provider fails, including who holds the artifacts
• Ongoing performance monitoring, not just an annual renewal
• Concentration considered: the same provider advising you and running your controls is a single point of failure

The exit plan clause is the one worth arguing over. A security program where the register, the evidence and the framework live in the provider's own systems is an operational resilience problem in its own right, and the kind of thing E-21 asks you to have thought about.

What to look for in a provider here

The general evaluation on how to choose a vCISO applies, with four additions that narrow the Canadian field to a small number of people.

1. They have been through an OSFI examination or supervisory review. Ask which institution type, which year, and what the findings were about. Having read the guidelines is not the same as having been asked to evidence them.
2. They speak E-21, not just B-13. If the conversation is entirely about controls and never about critical operations and tolerances for disruption, they are working from the previous decade of guidance.
3. They have worked inside a three lines model. Security at a financial institution is challenged by an independent risk function and audited by internal audit. A leader who has only worked where nobody challenged them will find that first quarter difficult.
4. They can write for a risk committee. Committee papers at a regulated institution have a house style, a length limit and an expectation of a clear recommendation. This is a real skill and it is not evenly distributed.

What it costs

Those bands sit two to three times above the general Canadian market because the pool of people who have been examined is small and the exposure they accept is larger. Compare that against a permanent hire, where the OSFI premium also applies and pushes the loaded first-year cost well past the general figures on CISO salary in Canada. At a mid-size institution the two options converge, and the deciding factor is usually how quickly you can find anybody at all.

Common questions