Vendor & MSP Scorecard

Synthetic data

Inspired by OSFI Guideline B-10 Third-Party Risk Management (effective May 1, 2024) — illustrative

Concentration flag = institution-specific concentration risk. Exit plans: B-10 distinguishes stressed and non-stressed exit; "Tested" means both scenarios exercised.


MSP	99.5%	98.7%Below	18,500	High	Flagged	Draft
Cloud	99.95%	99.92%Below	4,200	High	Flagged	Draft
Telecom	99.9%	99.4%Below	6,300	Medium	Flagged	None
Software	99%	97.9%Below	9,600	Medium	—	Tested
SaaS	99%	99.1%Met	0	Low	—	Draft

Bluefin Managed Services

6-month SLA trend

Top incidents

INC-4471 Batch scheduler outage (P1)
INC-4398 Patch window overrun (P2)
INC-4352 Monitoring gap on payments queue (P3)

FTE vs MSP mix (illustrative, 40-person team)

In-house FTE 50%MSP 50%

Annual cost

$4,660,000

Third-party risk index

55/100

Knowledge retention

45/100

Assumes CAD 135k loaded per FTE and CAD 98k per MSP seat. A higher MSP share lowers cost but raises concentration and exit risk.