[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-202972-105":59,"doc-detail-202972-en":130},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":123,"head_meta":125,"extra_data":127,"updated_unix":129},105,"en","osfis-intelligence-led-cyber-resilience-testing-i-crt-framework","OSFI’s Intelligence-led Cyber Resilience Testing (I-CRT) Framework","","The OSFI Intelligence-led Cyber Resilience Testing (I-CRT) Framework defines a controlled methodology for assessing a Federally Regulated Financial Institution’s cyber-resilience posture. It provides a “how to” approach that leverages targeted threat intelligence and simulates sophisticated threat-actor tactics to identify realistic cyber threats and potential remedial actions. The framework establishes roles, risk management expectations, a multi-phase I-CRT process, and governance for activities, deliverables, and interactions, supported by annexes including a glossary and Traffic Light Protocol.",{"@graph":69,"@context":122},[70,84,105],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":40,"@type":76,"position":81},"https://docshare.wps.com/document/research-report/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/osfis-intelligence-led-cyber-resilience-testing-i-crt-framework/202972/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/osfis-intelligence-led-cyber-resilience-testing-i-crt-framework/202972.png","ImageObject",300,407,{"name":92,"@type":93},"Felix Montgomery","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-27","2026-09-04",true,{"@type":102,"interactionType":103,"userInteractionCount":39},"InteractionCounter",{"@type":104},"ViewAction",{"@type":106,"mainEntity":107},"FAQPage",[108,114,118],{"name":109,"@type":110,"acceptedAnswer":111},"What is the purpose of the I-CRT framework?","Question",{"text":112,"@type":113},"It outlines the methodology and process for conducting an I-CRT assessment, including roles, responsibilities, phases, activities, deliverables, and stakeholder interactions.","Answer",{"name":115,"@type":110,"acceptedAnswer":116},"How does I-CRT differ from traditional penetration testing or red teaming?",{"text":117,"@type":113},"I-CRT is an intelligence-led, controlled assessment that uses targeted threat intelligence to simulate sophisticated threat-actor behaviors in a coordinated exercise setting.",{"name":119,"@type":110,"acceptedAnswer":120},"Who is responsible for risk management during an I-CRT assessment?",{"text":121,"@type":113},"The FRFI’s control group is responsible for the I-CRT risk management process, while OSFI provides independent oversight and guidance throughout the assessment.","https://schema.org",{"og:url":83,"og:type":124,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":126,"canonical":83},"index,follow",{"doc_id":128,"site_id":62},202972,1788552983,{"code":4,"msg":5,"data":131},{"doc_id":128,"user_id":132,"nickname":92,"user_avatar":133,"doc_module":4,"category_id":39,"category_name":40,"doc_title":65,"doc_description":67,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":39,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":139,"language":140,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":67,"update_tm":129,"read_time":144,"preview_page_count":4},549768064778,"https://ap-avatar.wpscdn.com/davatar_6f874abed73319feea01a86fa6f0fab8","| Advisory |\n| --- |\n| Title OSFI’s Intelligence-led Cyber Resilience Testing (I-CRT) Framework\u003Cbr>Category Sound Business and Financial Practices\u003Cbr>Date April 1, 2023\u003Cbr>Sector Banks\u003Cbr>Foreign Bank Branches\u003Cbr>Life Insurance and Fraternal Companies\u003Cbr>Property and Casualty Companies\u003Cbr>Trust and Loan Companies |\n| Table of Contents |\n| 1. Foreword |\n| 2. Introduction\u003Cbr> 2.1 Purpose\u003Cbr> 2.2 I-CRT |\n| 3. Roles and responsibilities\u003Cbr> 3.1 FRFI and FRFI Control Group (CG)\u003Cbr> 3.2 Control Group Coordinator (CGC)\u003Cbr> 3.3 Regulator\u003Cbr> 3.4 Threat Intelligence service Provider (TIP)\u003Cbr> 3.5 Red Team service Provider (RTP)\u003Cbr> 3.6 Role of other regulators |\n| 4. Risk management\u003Cbr> 4.1 I-CRT risk owner |\n\nOSFI’s Intelligence-led Cyber Resilience Testing (I-CRT) Framework  \nPage 1  \nOffice of the Superintendent of Financial Institutions  \n 4.2 Risk considerations  \n 4.3 Operational secrecy  \n 4.4 Independent service providers  \n5. I-CRT process  \n 5.1 Initiation phase  \n 5.2. Threat Intelligence phase  \n 5.3 Execution  \n 5.4 Closure phase  \n6. Legal disclaimer  \n7. Annex A – Glossary  \n8. Annex B – Traffic Light Protocol (TLP)  \n Purpose and background  \n Information handling  \n Traffic Light Protocol (TLP)  \n9. Annex C – I-CRT RACI  \n10. Annex D – List of additional artifacts  \n 10.1 Templates  \nFootnotes  \n\n| List of figures |\n| --- |\n|  Figure 1-Intelligence-led Cyber Resilience Testing (I-CRT)\u003Cbr> Figure 2-Traditional penetration testing/Red teaming vs. I-CRT |\n\nList of tables  \nOSFI’s Intelligence-led Cyber Resilience Testing (I-CRT) Framework Page 2  \nOffice of the Superintendent of Financial Institutions  \n Table 1: Traditional penetration testing vs. Red teaming vs I-CRT  \n Table 2: I-CRT assessment criteria and cadence  \n1. Foreword  \nCyber risk continues to be a top risk faced by many industries, including the financial sector. Cyber attacks can disrupt a Federally Regulated Financial Institution’s (FRFI) Critical Business Function (CBF)—even to the point of threatening its viability—or impacting consumers and other market participants in the financial sector. Effectively managing cyber risk is an essential element of a FRFI’s cyber resilience. As a supervisory tool, this framework is a“how to” guide to follow when conducting OSFI’s Intelligence-Led Cyber Resilience Testing (I-CRT) assessments. This document is not a policy instrument used to set regulatory expectations.  \nCyber attacks are increasing in sophistication and severity, amplifying the need to have measures in place that promote resilience to cyber events and technology disruptions. One effective way to build this resilience comes from adopting the mindset of a threat actor when conducting red team testing with quality intelligence to mimic areal-world setting. The I-CRT framework is a controlled, bespoke, intelligence-led test of a FRFI’s underlying technology assets and services supporting CBFs. An I-CRT assessment of a FRFI is a regulatory-led (i.e., OSFI) activity where OSFI provides guidance and oversight throughout the assessment. This approach allows for OSFI and FRFIsto collaborate in proactively identifying realistic cyber threats and better prepare with remedial actions. This in turn enhances the FRFI’s prevention, detection, and response capabilities and by design, the stability and security of the broader financial sector in Canada.  \n2. Introduction  \n2.1 Purpose  \nThe purpose of this document is to outline the methodology and process to follow when conducting an I-CRT assessment. This includes details on roles and responsibilities of stakeholders, key phases, activities, and deliverables as well as interactions associated with an I-CRT assessment.  \nOSFI’s Intelligence-led Cyber Resilience Testing (I-CRT) Framework Page 3  \nOffice of the Superintendent of Financial Institutions  \n| Text description-Figure 1-Intelligence-led Cyber Resilience Testing (I-CRT) |\n| --- |\n| Intelligence-led Cyber Resilience Testing encompasses a Regular I-CRT Assessmen","cbCaicFcMmyuI09U","https://ap.wps.com/l/cbCaicFcMmyuI09U","pdf",253617,34,"English","# Foreword\n# Introduction\n## Purpose\n## I-CRT\n# Roles and responsibilities\n## FRFI and FRFI Control Group (CG)\n## Control Group Coordinator (CGC)\n## Regulator\n## Threat Intelligence service Provider (TIP)\n## Red Team service Provider (RTP)\n## Role of other regulators\n# Risk management\n## I-CRT risk owner\n# I-CRT process\n## Initiation phase\n## Threat Intelligence phase\n## Execution\n## Closure phase\n# Legal disclaimer\n# Annex A – Glossary\n# Annex B – Traffic Light Protocol (TLP)\n# Annex C – I-CRT RACI\n# Annex D – List of additional artifacts","[{\"question\":\"What is the purpose of the I-CRT framework?\",\"answer\":\"It outlines the methodology and process for conducting an I-CRT assessment, including roles, responsibilities, phases, activities, deliverables, and stakeholder interactions.\"},{\"question\":\"How does I-CRT differ from traditional penetration testing or red teaming?\",\"answer\":\"I-CRT is an intelligence-led, controlled assessment that uses targeted threat intelligence to simulate sophisticated threat-actor behaviors in a coordinated exercise setting.\"},{\"question\":\"Who is responsible for risk management during an I-CRT assessment?\",\"answer\":\"The FRFI’s control group is responsible for the I-CRT risk management process, while OSFI provides independent oversight and guidance throughout the assessment.\"}]","OSFI’s Intelligence-led Cyber Resilience Testing (I-CRT) Framework | PDF",86]