Reasonable Cyber Safeguards?

When you sponsor a 401k plan for employees, the Department of Labor (DOL) expects you to ensure that reasonable safeguards are in place to protect the plan from cybersecurity incidents. In fact, mitigating cyber threats is an enforcement priority. 

Bottom line: If faced with an inquiry or investigation, are you prepared to demonstrate the actions you have taken to reduce risks of fraud and financial loss on behalf of plan participants? 

Safeguards Against Cyber Threats

As a retirement plan sponsor, you cannot 100% guarantee that a cybersecurity breach won’t impact the plan and participants: cybercrime is blossoming, and new methods and opportunities keep growing too. What you can do–and what you are in fact obligated to do—is mitigate the threats through diligent risk management and the implementation of best practices. As Elizabeth Goldberg reports at Plan Sponsor, the Department of Labor, has “officially identified” cybersecurity “as one of the agency’s enforcement priorities”:

The department describes this initiative as addressing “the growing risks cyberattacks pose to employee benefit plans and participants.” The department states that it is especially focused on promoting “cybersecurity practices for plans and service providers to protect sensitive information and reduce the risk of fraud and financial loss.”

…The department tends to focus on risk management processes, with investigations assessing whether plan fiduciaries had adopted reasonable safeguards, including written data protection policies and incident detection procedures. Often, the department evaluates whether these processes align with its cybersecurity best practice guidelines. The department is especially focused on how plans and service providers protect their systems and data from cyber threats. Also, when breaches occur, the department is likely to evaluate whether any participant has suffered financial loss or other harm and, if so, require that the participant be made whole.

Specifically, the DOL expects retirement plan sponsors to follow Cybersecurity Program Best Practices. Note, for example, that responsibilities include educating plan participants and beneficiaries about how to protect their online retirement accounts using Online Security Tips. Plan sponsors are also expected to use Tips for Hiring a Service Provider with all outside vendors to the retirement plan. For further advice about monitoring the cybersecurity protocols of third party providers, consider free resources provided by the Spark Institute. Employment law professionals at Littler also encourage plan sponsors to take these additional practical actions to reduce cybersecurity risks: 

• Review and, if necessary, enhance vetting programs for service providers to their plans;
• Review contracts with plan service providers to ensure sufficient data security protocols have been memorialized;
• Provide plan committee members with training on cybersecurity topics to ensure they can adequately negotiate and monitor service provider security measures;
• Audit plan service providers to ensure they are living up to their promised cybersecurity commitments; and
• Identify minimum cybersecurity protocols and insurance coverage provisions that will be accepted by plan service providers before entertaining bids or negotiations from vendors.

Because plan sponsors from small businesses tend to face the biggest hurdles implementing cybersecurity protocols, Colonial Surety Company offers an efficient, affordable and clear solution. For a few dollars a day, plan sponsors can obtain protection for the company, the plan, and themselves, with a Cyber Liability+Fiduciary Liability Insurance package. In addition to providing defense costs and penalty limits up to $1,000,000 for the sponsor, this package addresses numerous DOL recommendations by explicitly covering the plan and the business with: 

• Expert-led response services following a data breach.
• Protection from lawsuits and regulatory actions related to the breach
• Legal services.
• Computer forensic services.
• Public relations and crisis management expenses.
• Notification services.
• Call Center services.
• Credit and Identity monitoring 

Business owners: Mitigate threats to the retirement plan–and reduce your personal liabilities before another day goes by. Colonial Surety Company is here to help:

Cyber Liability Insurance+Fiduciary Liability Insurance Here

Double Punch?

Attorneys advise retirement plan sponsors that a cybersecurity incident can lead to even worse problems: as ERISA fiduciaries, plan sponsors can face allegations that failure to adequately address cybersecurity constitutes a breach of fiduciary duties. Indeed, according to Littler, lawsuits questioning fiduciary practices in the aftermath of a cyber breach are a growing risk: 

After a hack impacting an ERISA plan’s assets or data, plan participants increasingly respond with litigation. Their targets can include the employer that sponsors the plan, plan administrators, and other fiduciaries. These suits can involve serious allegations, including breaches of the fiduciary duties ERISA imposes, for alleged failures to maintain adequate cybersecurity measures. The plaintiffs’ bar representing participants in such lawsuits is specialized and opportunistic…..Plan sponsors can therefore find themselves targeted by lawsuits questioning their fiduciary practices. As these lawsuits continue, and as the theories pursued in litigation continue to evolve, fiduciaries should understand that their data security practices (and their supervision of the data security practices used by the service providers they hire) could become the subject of litigation.

A harsh reality for retirement plan sponsors is that even if nothing has been done wrong, investigations and penalties are out of pocket—and they add up quickly. For example, in the face of allegations of a fiduciary breach, ERISA legal defense alone can end up costing upwards of $600 per hour. Colonial Surety Company, a leading national provider of ERISA Fidelity Bonds, offers the only integrated solution for the protection of retirement plan sponsors. Our affordable All-in-One Packages include: 

• ERISA Fidelity Bond: Provides 100% compliance with DOL bond requirements
• Fiduciary Liability Insurance: Arms you with up to $1,000,000 in coverage for defense and penalties in the event of allegations related to errors and oversights.
• Cyber Liability Insurance: Provides $50,000 of coverage included at no extra cost to address the DOL’s strict standards for response and notification services following cybersecurity incidents. (Colonial Surety Company’s Cyber Liability Insurance explicitly covers both the retirement plan and this business.) 

Don’t wait for a DOL audit, a participant complaint, or a creative plaintiff attorney to allege you’ve made mistakes and accuse you of a fiduciary breach. Secure your business, your plan, and your personal assets today. Colonial Surety Company makes it easy, speedy and affordable: 

Quote and Obtain Fiduciary+Cyber Liability Insurance Package

Why Colonial Surety Company?

• A-Rated Excellence: Rated “A” (Excellent) by A.M. Best.
• Legacy of Trust: Protecting business owners since 1930.
• National Reach: Fully licensed and Treasury-listed across all 50 U.S. states and territories.