DOL cybersecurity retirement

DOL Issues Cybersecurity Guidance for Retirement Plans

Earlier this year, the Department of Labor (DOL) outlined a range of practices for combatting the growing threat of cybercrime to ERISA-covered retirement plans. This first-ever cybersecurity guidance issued by the DOL’s Employee Benefits Security Administration (EBSA) casts a wide net, addressing key issues affecting plan sponsors, fiduciaries, recordkeepers, as well as plan participants and beneficiaries.

The DOL estimates that defined contribution and defined benefit retirement plans hold a combined $9.3 trillion in assets. These plans also store vast amounts of vital personal information online — information that could put participants and their assets at risk if a plan’s online systems were breached. In issuing this guidance, the DOL acknowledges the imminent risk posed by acts of cybercrime as well as the obligation of responsible plan fiduciaries, as set forth by ERISA, to help mitigate these risks.

Three Types of Guidance Issued

The DOL’s guidance is presented in three separate documents, each targeting a different audience. These best practices and tips are offered as recommendations for safeguarding the assets and personal information of plan participants while helping to reduce the risk of fraud and loss.

Tips for Hiring a Service Provider
This document aims to help retirement plan sponsors and fiduciaries meet their responsibilities under ERISA to prudently select and monitor service providers that follow strong cybersecurity practices. Specific recommendations include:

  • Scrutinizing the service provider’s information security standards, practices, policies, and audit results;
  • Evaluating its track record in the industry, including whether the provider has experienced any past security breaches and how it responded;
  • Inquiring about any potential cyber insurance policies the service provider may hold that cover cybersecurity breaches; and
  • Reviewing contracts to ensure that they include provisions for compliance with cybersecurity and information security standards.

Cybersecurity Program Best Practices
This document offers 12 best practices that address the needs of record keepers and other service providers responsible for managing plan-related IT systems and data, as well as the needs of plan fiduciaries who are responsible for hiring such vendors. The recommended practices include:

  • Having a formal, well-documented cybersecurity program;
  • Conducting annual risk assessments;
  • Holding periodic cybersecurity awareness training sessions; and
  • Implementing and maintaining strong technical controls in keeping with industry best practices.

Online Security Tips
While this tip sheet targets plan participants and beneficiaries, the information is also important for plan sponsors to know and potentially integrate into employee education programs focused on online safety. These tips include:

  • Encouraging users to regularly monitor their accounts online;
  • Creating strong passwords;
  • Using multi-factor authentication;
  • Being aware of (and knowing the signs of) phishing attacks; and
  • Keeping antivirus applications and all system software up-to-date.

Building on Past DOL Guidance

Although the DOL noted that this guidance was an important “first step” in safeguarding retirement benefits and personal information, it also builds on earlier EBSA guidance that addressed electronic recordkeeping systems and controls for protecting the personal information of plan participants. In this way, the current guidance may serve as a call to action to plan sponsors, fiduciaries, and participants to review and update any established cybersecurity practices and protocols or to create a cybersecurity program using these recommendations.

MFA Observations
While there is no way to eliminate the risk of cybercrime entirely, retirement plan sponsors who understand and take steps to incorporate the DOL’s guidance into their cybersecurity protocols will be on a more solid path to safeguarding their plan assets and participants’ vital information.​

The DOL guidance should be viewed as guidance or recommendations rather than a set of minimum requirements or as regulations. These recommendations underscore the importance of constantly evaluating, testing, and improving your cybersecurity protocols amid a rapidly evolving threat landscape.

For additional guidance on optimizing cybersecurity practices to protect your organization’s retirement plan assets and participants, please connect with a member of MFA’s Cybersecurity Team.

Contact Us

Related posts
retirement plan missing participants

Retirement Plans & Missing Participants: New DOL Guidance

The DOL’s “Missing Participants — Best Practices for Pension Plans” describes a range of steps…

Read More
Late 401K Deposits Due to COVID-19

Documenting Late 401(k) Plan Deposits Due To COVID-19

The DOL has provided relief for retirement plan sponsors who have been late remitting employee…

Read More