Regulation on Technology and Information Systems for the Pension Savings System and the Public Pension System

DE No. 116/1997
DECRETO No. 116/1997
REGLAMENTO DE TECNOLOGÍA Y SISTEMAS DE INFORMACIÓN PARA EL SISTEMA DE AHORRO PARA PENSIONES Y EL SISTEMA DE PENSIONES PÚBLICO Aprobación: 10/11/1997 Vigencia: 25/11/1997

DECRETO No. 116.-
THE PRESIDENT OF THE REPUBLIC

CONSIDERING:

I. That the Law of the Pension Savings System created, for workers in the private, public, and municipal sectors, the Pension Savings System, which comprises the set of Institutions that will administer the resources destined to pay the benefits that must be recognized to affiliates, to cover the risks of Common Disability, Old Age, and Death, and designated the Public Pension System, the regimes of Disability, Old Age, and Death administered by the Salvadoran Institute of Social Security (ISSS) and by the National Institute of Pensions of Public Employees (INPEP).

II. That to facilitate compliance with the provisions regarding information and systems contemplated in the Law of the Pension Savings System, it is necessary to establish the norms that allow integrating the pension information of the affiliated population in an effective and efficient manner.

III. That in accordance with the powers granted to the Superintendence of Pensions in its Organic Law and in the Law of the Pension Savings System, and in attention to the foregoing considerations, it is necessary to issue a Regulation containing all the normative provisions that must be observed in matters of information and systems.

THEREFORE, in exercise of its constitutional powers, DECREE the following:

REGULATION ON TECHNOLOGY AND INFORMATION SYSTEMS FOR THE PENSION SAVINGS SYSTEM AND THE PUBLIC PENSION SYSTEM

TITLE I
SINGLE CHAPTER
GENERAL PROVISIONS

Art. 1.- The object of this Regulation is to facilitate and ensure the application of the legal provisions that the Organic Law of the Superintendence of Pensions grants to this Institution to integrate the pension information of the affiliated population in an effective and efficient manner.

Designations

Art. 2.- In the text of this Regulation, the following designations will be used:
Law: The Law of the Pension Savings System.
Superintendence: Superintendence of Pensions
AFP: Pension Fund Administrating Institution
ISSS: Salvadoran Institute of Social Security
INPEP: National Institute of Pensions of Public Employees Supervised Institutions: Supervised institutions shall be understood as those institutions that the Law and the Organic Law of the Superintendence of Pensions empower the Superintendence to supervise, which are: ISSS, INPEP, and AFP, as well as the entities to which the aforementioned delegate the functions of collection, information processing, and other operations related to the System.

Definitions

Art. 3.- Work History: Historical record of each affiliate, of the places where they have worked, and of the contributions and payments made based on the base contribution income, of a worker.

Technical definitions used in this Regulation.

Art. 4.- Technical terminology to be used in this Regulation:
a) Open Architecture System: A system composed of normalized interfaces independent of providers that must:

Guarantee portability, at a basic level, of the applications
Allow interoperability of systems
Facilitate the integration of operational systems.
b) User: Official of the Supervised Institutions designated as responsible for a specific area of the systems subject to supervision by the Superintendence, who must have an email address that serves as a link with the same. c) Email Address: An identification within the electronic mail services in the Supervised Institutions, which allows directing messages on the network between the Superintendence of Pensions and the same. d) Communication Structure: Physical and logical means that allow establishing electronic communication between the Superintendence and the Supervised Institutions. e) Servers: Computers or Computers responsible for administering the resources of a network that need to be shared among the different computers of the same, such as: files, printing services, and communications. f) Clients: Computers that use the resources available to them through their connections with the servers. g) Distributed Information Processing: Information processing scheme in a shared manner between clients and servers, making use of the advantages provided by the open system platform.

h) Application: Program designed for the function that a computer performs within a specific organization, and which contributes directly to performing it. i) Switched Communication: Communication established using telephone dialing, using procedures that require a form of control synchronization. j) Dedicated Communication: Communication by which one accesses network services using the physical connection structure of the network to which the computer wishing to use the resources connects, maintaining this connection uninterruptedly. k) Encryption: Encoding of data using cryptographic transformations and associated keys.

TITLE II
TECHNICAL SPECIFICATIONS

CHAPTER I
ON SYSTEM INTEROPERABILITY

Art. 5.- For the effective development of the verification and supervision functions of the Superintendence of Pensions, it will be necessary that the applications implemented in the supervised entities offer the capacity to exchange information and operate cooperatively with the systems of the Superintendence.

Art. 6.- By operating cooperatively, it shall be understood that the computer system of the supervised entities allows distributed information processing between clients and servers.

The applications must be developed on platforms that comply with international standards established to guarantee interoperability between systems.

CHAPTER II
ON CONNECTIVITY

Communication Structure

Art. 7.- The communication structure must be of the dedicated type. In case of interruption, the Supervised Institutions must have a contingency plan to maintain communication with the Superintendence, through the switched telephone network.

CHAPTER III
ON ELECTRONIC DATA EXCHANGE AND INQUIRY

Information Required from Supervised Institutions

Art. 8.- The information required electronically by the Superintendence of Pensions may be in formats representing data, images, or other types that technology allows and that the Superintendence requires. Therefore, the Supervised Institutions must have the necessary equipment and programs for converting the documents designated by the Superintendence into the formats required through the specific instructions of each system.

Real-time Information

Art. 9.- The Supervised Institutions must allow real-time access to the information indicated by the Superintendence, which will be communicated through the different instructions.

For this purpose, they must provide the Superintendence with the necessary user identifiers and passwords to access their servers to obtain the specified information. Likewise, the Superintendence will provide the necessary accesses to the different supervised institutions.

Data Integrity

Art. 10.- The Superintendence will indicate, in the respective instructions for each application, the data that must be available and the period for real-time access.

The files containing digitized images corresponding to documents from the previous 5 years must be accessed online, to validate the information that has been delivered to the Superintendence.

Batch Transmissions

Art. 11.- The information that the Superintendence determines is not necessary to obtain in real time, but is needed at discrete time intervals, will be transmitted in batches of electronic information, in the manner described in the respective instruction.

Electronic Mail

Art. 12.- The Supervised Institutions must have electronic mail services through the communication structure described in Art. 6 of this Regulation, through which they can send and receive information, comments, or requests to or from the Superintendence and other Supervised Institutions. Notwithstanding the foregoing, the Superintendence may require information in physical media, which by its nature, requires a physical proof to have validity.

The different users of the systems must have an individual email address, allowing direct communication between the Superintendence and them.

Art. 13.- In all cases, the following officials of the Supervised Institutions must have an email address:

For the AFP: The President of the Board of Directors, the General Manager, and others determined by the Superintendence.

For the case of the ISSS, the General Director and the person responsible for the Disability, Old Age, and Death Program, and
For the INPEP, the President of the Institution and the General Manager, and in both cases, the officials holding positions similar to those required in the AFP.

For other supervised institutions, the Superintendence will determine by Instruction the structure of the addresses it deems necessary.

Additionally, users are responsible for periodically verifying their email, as ignoring a request made through this medium does not exempt them from complying with what is required by the Superintendence, nor from the sanctions incurred for failing to comply with them.

CHAPTER IV
ON SECURITY CONDITIONS

Art. 14.- The Supervised Institutions will be responsible for assigning identifiers and passwords to their users as well as verifying their validity and periodic renewal; in addition, they must implement the relevant encryption systems and maintain a connection log. The contents of the log must include for each connection: user identifier, time and date of access, files, records, and fields that were accessed, as well as the operations to which they were subjected.

This log may be requested in part or in total by the Superintendence at any time it deems appropriate and without prior notice. Likewise, backups of this log must be made according to what is defined in the respective instruction. Data Integrity

Art. 15.- The Supervised Institutions are obligated to ensure the integrity of data stored in any type of magnetic, electronic, optical, or other medium, that transits or resides within the same. Data integrity shall be understood as its resistance to alteration caused by errors in the systems, security failures, media degradation, lack of reliability of transport and storage media, or by direct manipulation outside normal controls.

Art. 16.- The Supervised Institutions must backup all data referred to in the previous article, according to what is established in this Regulation. Likewise, the Superintendence may request such backups at any time it deems convenient.

Art. 17.- The Supervised Institutions must have a contingency and security plan concerning the conservation of data and systems, which must be approved by the Superintendence.

In the case of the AFP and the companies providing services to them, this authorization must be obtained before they enter into operation.

Art. 18.- The contingency plan must contain a scheme for its periodic review. When the need to update the plan is determined in this review, it must be authorized by the Superintendence prior to its implementation. Backups

Art. 19.- The Supervised Institutions must maintain, in addition to the respective physical backups, backups on magnetic media of all their financial and accounting management and of the Pension Fund that they administer; furthermore, the ISSS, INPEP, and AFP must maintain backups of the Work History of the affiliates. In the case of the AFP, the backup of the Individual Account of each affiliate must be added to the aforementioned backups.

Art. 20.- The Supervised Institutions must also maintain backups on magnetic media of any document that has been digitized. The files corresponding to documents from the previous 5 years must be accessible online, to validate information that has been delivered to the Superintendence.

Art. 21.- The backups must be updated monthly, and a copy must be sent to the vault of an institution previously authorized for this purpose by the Superintendence. In addition to the foregoing, a copy of the Work History backup must be sent semi-annually to the Superintendence, according to what is specified in the Respective Instruction.

Unauthorized Access

Art. 22.- Any proven attempt of unauthorized access to the information of the Superintendence or another institution of the System, to avail oneself directly or indirectly of reserved information, in order to obtain some benefit, will be sanctioned according to what is established in Art. 179 of the Law.

TITLE III
ON THE APPROVAL AND AUDIT OF SYSTEMS

Approval of Systems

Art. 23.- All information systems to be used in the AFP, ISSS, and INPEP must be submitted to the approval of the Superintendence prior to their implementation; in the case of institutions providing services to the AFP, ISSS, and INPEP, the foregoing applies only to systems related to the System.

Likewise, any application, developed by the AFP to be distributed to their affiliates or their employers, must be approved by the Superintendence before making it available to the public.

Art. 24.- For these systems to be approved, the Supervised Institutions must supply the design of the applications, which must contain as a minimum, the process analysis using data flow diagrams, logical and physical models of the applications, and the detailed description of the processes. In addition, they must perform a demonstration of the operation of the applications that the Superintendence considers pertinent.

Art. 25.- In the case of the AFP, the Superintendence will verify compliance of the systems with the technical specifications established in the respective instructions, as a requirement for them to begin operations.

Art. 26.- Structural changes to the applications will also be subject to approval by the Superintendence, for which they must send the technical documentation supporting this change and perform, at the request of the Superintendence, a demonstration of the operation of the same.

Art. 27.- Approval by the Superintendence does not exempt the supervised institutions from responsibility in case of system malfunction and the sanctions incurred for this reason.

Audit of Systems

Art. 28.- The systems will be audited by the Superintendence at the time it deems appropriate, to verify that their operation complies with the technical specifications required and approved by said Institution.

Art. 29.- The audit of the systems will be carried out according to the procedure detailed in the instruction on system audits that the Superintendence will issue.

TITLE IV
FINAL PROVISIONS

General Provision

Art. 30.- The Superintendence of Pensions, considering the speed at which the information systems environment evolves, will issue instructions containing the necessary specifications to equip the System with the appropriate technology to perform its functions efficiently.

Costs

Art. 31.- The costs for acquiring equipment and developing applications, incurred to comply with interoperability, connectivity, electronic data exchange and inquiry, and other requirements specified in this Regulation, must be assumed exclusively by the AFP, ISSS, and INPEP.

Responsibility for the Information Systems of Supervised Institutions

Art. 32.- It is the responsibility of the Supervised Institutions that their information systems comply with all technical specifications required by the Law and its regulations, as well as by the instructions issued by the Superintendence, subject to the sanctions applicable as a consequence of non-compliance with them.

Final Provision

Art. 33.- Any aspect not contemplated in this Regulation will be resolved by the Superintendence in accordance with the Law.

Validity

Art. 34.- This Regulation will enter into force eight days after its publication in the Official Diary.

GIVEN IN THE PRESIDENTIAL HOUSE: San Salvador, on the tenth day of the month of November of nineteen hundred and ninety-seven.

Armando Calderón Sol,
President of the Republic.
Manuel Enrique Hinds,
Minister of Finance.
Eduardo Tomasino Hurtado,
Minister of Labor and Social Security.
Published in Official Diary No. 214
Volume 337, of November 17, 1997.
This compilation is an exact copy of what is established in the Official Diary.

Regulation on Technology and Information Systems for the Pension Savings System and the Public Pension System

Similar documents from other regulators