CAAT Pension Plan

CAAT Pension Plan manages $25.4 billion in assets for over 100,000 members across hundreds of Canadian employers - education institutions, major corporations, household brands. Founded in 1967, it's an independent, jointly governed defined benefit plan that has spent decades challenging the status quo in retirement security. The 2018 launch of DBplus, an innovative pension product, doubled membership and expanded the plan's attack surface in the process.

That scale means protecting sensitive financial and personal data for a six-figure membership base. CAAT holds ISO/IEC 27001 certification for information security management - a formal framework, not a checkbox - signaling that the org takes its threat model seriously enough to get audited against it. For a pension plan, the risk calculus is straightforward: member PII, financial records, employer data, and the integrity of benefit calculations are all high-value targets.

The security posture here isn't about defending a SaaS product or a cloud-native stack - it's about safeguarding a financial institution's core data assets across an expanding member base. The team operates within a regulated environment where data integrity and confidentiality aren't aspirational; they're operational requirements backed by certification. CAAT advocates for better pension coverage across Canada, which means continued growth and, with it, continued pressure on the security program to keep pace.