Print-friendly version

Requesting Variances from Information Security Standards

Introduction

1. In order to protect University information assets, the Chief Information Officer (CIO) has issued binding Information Security Standards. Academic and administrative units that wish to deviate from these Information Security Standards are required to request a variance from the CIO.
2. This standard establishes the procedure for Administrative Heads of Unit to request such a variance.
3. The CIO has issued this standard under the authority of Policy SC14, Acceptable Use and Security of UBC Electronic Information and Systems. Questions about this standard may be referred to information.security@ubc.ca.

Variance Request Procedure

1. Initial Request - the Administrative Head of Unit must submit the following information to information.security@ubc.ca:
   1. contact information;
   2. description of the requested variance and expected duration;
   3. explanation of why the variance is warranted;
   4. analysis of risk associated with granting the variance, and what controls will be in place to manage this risk; and
   5. analysis of cost and resource implications of granting the variance.
2. When considering the request for a variance, the CIO may seek the input of the Information Security Governance Committee (which is the Advisory Committee defined in Policy SC14) if they consider this appropriate.
3. The CIO may authorize a variance from the Information Security Standards in any of the following circumstances:
   1. the Administrative Head of Unit is temporarily unable to meet the compliance standard;
   2. compliance is not achievable for technical or financial reasons;
   3. an alternate method of compliance is available that offers equivalent or better security; or
   4. the variance is otherwise reasonable and is consistent with the Information Security Standards.
4. If the CIO approves a deviation, they will set out the terms of the variance, including any applicable mitigation requirements or other conditions.
5. If the CIO denies the requested deviation, they will provide an explanation and, if possible, a suggestion of alternatives.

Resolution of Disagreements

1. If a disagreement arises and cannot be resolved in a timely manner between the CIO and the Administrative Head of Unit with respect to the requested deviation, then either party may refer the disagreement to the Responsible Executive specified under Policy SC14, who will decide the matter. This Responsible Executive may consult with the Information Security Governance Committee and/or the other Responsible Executive if they determine it would be appropriate to do so.
2. The Responsible Executive’s decision is final.

Related Documents and Resources

1. Policy SC14, Acceptable Use and Security of UBC Electronic Information and Systems

Standard Last Revised: 2021-01