Copyright © King's Printer,

Victoria, British Columbia, Canada

Licence

Disclaimer

Volume 65, No. 16

181/2022

The British Columbia Gazette,

Part II

August 30, 2022

B.C. Reg. 181/2022 , deposited August 29, 2022, under the OIL AND GAS ACTIVITIES ACT [sections 111 and 112]. Regulation of the Board of the Oil and Gas Commission, dated

August 29, 2022.

The Board of the Oil and Gas Commission orders that, effective June 1, 2023,

(

a) the Security Management Regulation set out in the attached Appendix 1 is made,

(

b) the Emergency Management Regulation, B.C. Reg. 217/2017, is amended as set

out in the attached Appendix 2,

(

c) the Liquefied Natural Gas Facility Regulation, B.C. Reg. 146/2014, is amended

as set out in the attached Appendix 3, and

(

d) the Oil and Gas Processing Facility Regulation, B.C. Reg. 48/2021, is amended

as set out in the attached Appendix 4.

— F. MIHLAR, Chair, Board of Directors .

Appendix 1

SECURITY MANAGEMENT REGULATION

Contents

Part 1 –

Definitions and

Interpretation

Definitions

Application and

interpretation of CSA Z246.1

Part 2 – Programs, Procedures and Plans

Security management program

Information security management procedure

Cybersecurity measures

Training plan

Part 3 – General

Submission of contact information to commission

Reports and records

Information in writing

Reports and records must be maintained in British Columbia

Exemptions

Part 1 –

Definitions and

Interpretation

Definitions

1 In this regulation:

"Act" means the Oil and Gas Activities Act ;

"contact information" means

(

a) a telephone number at which a person can be contacted, and

(

b) an email address, if any, at which a person can be contacted;

"CSA Z246.1" means the standard published by the Canadian Standards Association as CSA Z7246.1,

Security management for petroleum and natural gas industry systems, as amended from

time to time;

"cybersecurity" has the same meaning as in CSA Z246.1;

"program" means a security management program within the meaning of

section 3.

Application and

interpretation of CSA Z246.1

(1) For the purposes of this regulation, a permit holder must comply with CSA Z246.1.

(2) A reference in a clause of CSA Z246.1 to "operator" or to "owner" is to be

read as a reference to "permit holder" as defined in the Act.

(3) A reference to "should" in a clause of CSA Z246.1 is to be read as a reference

to "must".

Part 2 – Programs, Procedures and Plans

Security management program

(1) A permit holder must prepare and maintain a program in accordance with CSA Z246.1.

(2) A permit holder must review, and, if necessary, update the program

(

a) at least once every 3 years,

(

b) after a significant change occurs in the types of threats, risks and vulnerabilities

associated with the permit holder’s oil and gas activity that is the subject of the

program, and

(

c) at any time the permit holder becomes aware of a deficiency in the program

that risks

(

i) the safety of the permit holder’s employees or of the public, or

(ii) the safe carrying out of the permit holder’s oil and gas activity.

(3) A permit holder must, on request by the commission, do both of the following:

(

a) have the program reviewed by a third party acceptable to the commission to

verify that the program meets the objectives of CSA Z246.1;

(

b) submit to the commission the results of the review referred to in paragraph (a).

(4) A plan, record or document prepared and maintained for the purposes of a program

is prescribed for the purposes of

section 38 (1) (

a) of the Act.

Information security management procedure

4 A program must include an information security management procedure prepared and

maintained in accordance with CSA Z246.1.

Cybersecurity measures

(1) A program must include cybersecurity measures prepared and maintained in accordance

with CSA Z246.1.

(2) A permit holder must implement the cybersecurity measures in accordance with

clause 7 of CSA Z246.1.

(3) The cybersecurity measures implemented under subsection (1) must meet the

objectives of either of the following:

(

a) the Framework for Improving Critical Infrastructure Cybersecurity, as published

by the National Institute of Standards and Technology and as amended from time to

time;

(

b) a national or international standard comparable to the framework referred

to in paragraph (a), if approved by the commission.

(4) A record or document required to be maintained under clause 7 of CSA Z246.1

is prescribed for the purposes of

section 38 (1) (

a) of the Act.

Training plan

6 A program must include a training plan prepared and maintained in accordance with

clause 8.3 of CSA Z246.1.

Part 3 – General

Submission of contact information to commission

(1) Within 14 days after preparing a program under

section 3, a permit holder must

submit to the commission the name and contact information of the person responsible

for the implementation of the program.

(2) Within 7 days of a change to the name or contact information submitted under

subsection (1), a permit holder must submit updated information.

Reports and records

(1) A permit holder must prepare and maintain a written record of participants in

training described in

section 6.

(2) On completing the provision of training described in

section 6, a permit holder

must prepare a report that

(

a) states whether the objectives of the training were met,

(

b) makes recommendations for improvement, including improvement to the training

plan, and

(

c) includes a strategy to implement the recommendations for improvement referred

to in paragraph (b).

(3) A permit holder must prepare a report of the results of an evaluation of a

response to a security incident and maintain the report until the permit for the oil

and gas activity that is the subject of the program is cancelled by the commission

or declared by the commission to be spent.

(4) A report under subsection (3) must include

(

a) a description of the security incident, including the cause or suspected cause,

(

b) a description of the permit holder’s response to the incident, including measures

taken to reduce the risk of similar incidents occurring, and

(

c) an assessment of the permit holder’s response.

(5) A report or record required under this regulation or CSA Z246.1 is prescribed

for the purposes of

section 38 (1) (

a) of the Act.

Information in writing

9 Information required under this regulation must be kept in writing and may be submitted

to the commission in electronic or paper form.

Reports and records must be maintained in British Columbia

10 A permit holder must make the reports and records prepared and maintained under this

regulation available to the commission at the permit holder’s principal place of business

in British Columbia.

Exemptions

(1) An official may exempt a permit holder from complying with one or more provisions

of this regulation or with one or more requirements of CSA Z246.1 if the official

is satisfied that, in the circumstances,

(

a) compliance with the provision or requirement is not reasonably practicable,

(

b) the exemption is in the public interest.

(2) In granting an exemption under subsection (1), an official may impose any

conditions on the exemption the official considers necessary.

Appendix 2

Section 10 (1) of the Emergency Management Regulation, B.C. Reg. 217/2017, is

repealed and the following substituted:

(1) Immediately after a permit holder becomes aware of an incident, the permit

holder must classify the incident according to the event or consequence in the Incident

Classification Matrix in

Schedule D that most closely describes the most severe event

or consequence of the incident.

Appendix 3

Section 8 of the Liquefied Natural Gas Facility Regulation, B.C. Reg. 146/2014,

is amended

(

a) in subsection (1) by repealing paragraph (e), and

(

b) by repealing subsection (3) and substituting the following:

(3) An LNG facility permit holder must submit to the commission the emergency

response plan referred to in subsection (1) (

b) as soon as practicable after it is

prepared.

Section 1 of

Schedule 1 is amended in the definition of "boundary" by striking out " in the security management plan referred to in

section 8 (1) (

e) of this regulation " and substituting " in a security management program prepared and maintained by the LNG facility permit

holder under the Security Management Regulation ".

Appendix 4

1 Sections 6 (2) (b) (

i) and 16 (2) (

b) of the Oil and Gas Processing Facility

Regulation, B.C. Reg. 48/2021, are repealed.

Section 1 of the

Schedule is amended in the definition of "boundary" by striking out " in the security management program referred to in

section 6 (2) (b) (i) [development of management system] of this regulation " and substituting " in a security management program prepared and maintained under the Security Management

Regulation ".

Copyright © 2022: King's Printer, Victoria, British Columbia, Canada