Practices for effective IT risk management

FSRA expects all regulated entities or individuals to follow these practices:

• Have proper governance and oversight of its IT risks
• Rely on industry accepted practices to effectively manage its IT risks
• Use industry accepted strategies to effectively manage and secure confidential data
• Effectively manage the IT risks associated with any outsourced activity, function and service
• Be prepared to effectively detect, log, manage, resolve, recover, monitor and report on IT incidents in a timely manner
• Be prepared to ensure continuity during and following an incident
• Notify the regulator in the event of a material IT risk incident

Definition of material IT risk incidents

An IT incident may be considered material if:

• The plan’s operations are disrupted such that the plan can no longer be effectively administered.
• Confidential plan member data has been compromised.
• It negatively affects other entities or individual regulated by FSRA.
• It is likely to reoccur with other entities or individuals regulated by FSRA.

Notifying FSRA: timing and process

After a material IT risk incident occurs, plan administrators should notify FSRA within 72 hours.

Plan administrators may notify FSRA of a material incident by completing the IT risk incident notification form and sending it to FSRA by:

• Emailing ITriskinbox@fsrao.ca
• Uploading the form to the Incident Notification Portal
• Having direct contact with a FSRA Pension Officer

FSRA’s process for IT risk incidents

FSRA has established a by following this three-phase process for material IT risk incidents:

• In Phase 1, FSRA receives notification of a material incident along with details on how the affected entity has responded and recovered.
• In Phase 2, if FSRA determines that the protocol for IT risk incidents should be activated, FSRA will contact the entity. The entity will be required to provide regular updates on the impact of the incident.
• In Phase 3, the plan will be required to provide FSRA with its plan to prevent a similar incident from occurring in the future.

Next steps

Trustees should implement FSRA’s recommendations and follow the seven practices outlined in the guidance.

The guidance will be reviewed no later than June 2028.