iAtoday

On March 25, 2025, the British Columbia Financial Services Authority (BCFSA) published a new Information Security Guideline for British Columbia Pension Plan Administrators (the “Guideline”). This guideline applies only to pension plans registered in British Columbia and will come into force on July 1, 2025. It replaces the guideline on information security for financial institutions published in 2021.

We are here for you and your clients

Information security is a top priority for us. We have therefore implemented measures to comply with this guideline and, in the event of a significant information security incident that requires reporting to the BCFSA, we will notify the administrators of pension plans registered in British Columbia. Please note, however, that we make every effort to protect data security and prevent such incidents. 

Information security risks

These risks include:

• Unauthorized, illegal or accidental access to, use, disclosure, modification or destruction of data;
• The deterioration of information systems and networks.

These risks may arise from intentional or unintentional actions by any person, both inside and outside the organization.

Obligation to report material incidents to the BCFSA

The plan administrator must contact the BCFSA immediately in the event of a material incident. This includes providing any new details about the incident and keeping the BCFSA informed of all steps taken until the incident is resolved. The administrator must then report to the BCFSA on their analysis of the situation and the lessons learned. 

The plan administrator must provide sufficient details about material incidents to ensure that the BCFSA understands their scope, impact and the action plan that has been implemented or is planned.

The plan administrator must:

• Notify the BCFSA by email or phone of their intention to submit an information security material incident report within 24 hours after an incident has been determined to be material.
• Submit an incident report as soon as possible, within 72 hours at the latest, via a secure SharePoint link; the incident report is not mandatory, but the information it must contain is.

For more information on reporting incidents: BCFSA Information Security Guideline.