Pensions and Employee Benefits Law Blog 

In response to industry feedback after its initial release of the Information Security Guideline, BC Financial Services Authority (BC FSA) has issued:

1. A revised version of the Information Security Guideline and
2. The new Outsourcing Guideline.

BC FSA advised in its Advisory 21-015 that accompanied the revised Information Security Guideline that the revisions reflect the response from the pension sector. The revised Information Security Guideline distinguishes between B.C. credit unions, insurance and trust companies on the one hand and pension plan administrators on the other. The prior version of the Information Security Guidelines applied equally to all of those entities, despite the differences in their scope, purpose and operational structures.

The revised Information Security Guideline still provides useful guidance to help each of the entities to which it applies, in relation to information security issues including:

• Maintaining a risk management program;
• Identifying the information security risks in respect of systems, people, assets, data and capabilities;
• Protecting data and systems in light of the sensitivity and value of the data and information;
• Establishing monitoring processes to detect information security incidents;
• Developing response and recovery processes; and
• Communicating with the BC FSA about “major” information security incidents.

The Outsourcing Guideline is a new document that sets out BC FSA’s expectations for pension plan administrators (and insurance companies, trust companies and credit unions) that outsource one or more of their activities or functions. The Outsourcing Guideline sets out the BC FSA’s expectations for pension plan administrators in respect of:

• Conducting and documenting a materiality assessment for outsourcing arrangements;
• Ensuring that policies for oversight of outsourced arrangements are documented;
• Establishing contracts for outsourced, material functions;
• Documenting how performance by the service provider will be measured;
• Considering the qualifications of service providers;
• Considering and managing the risks associated with material outsourcing arrangements; and
• Ensuring that applicable records related rules are followed by the service provider.

The BC FSA welcomes feedback on the revised Information Security Guideline and on the Outsourcing Guideline by July 17, 2021.