Cyber Risk: Two Questions for Plan Sponsors

Retirement plans hold two things criminals want: money, and the personal data that can be used to steal it. For the business owner who sponsors a 401(k), protecting both is part of the fiduciary duty owed to every participant. That makes two questions worth a clear, written answer: What are we doing to prevent cyber breaches? And what will we do if one happens anyway?

If your honest answer to either question is “our recordkeeper handles that,” it’s time for a closer look. The Department of Labor confirmed in 2024 that its cybersecurity guidance applies to ERISA plans of every type and size, and overseeing how that guidance is followed falls to the sponsor. Here’s how to start working through both questions.

What Are We Doing to Prevent a Breach?

The idea that cybersecurity is part of a sponsor’s fiduciary role isn’t new. In 2021, when the Government Accountability Office studied 401(k) cyber risk, 21 of the 22 industry stakeholders it interviewed held the view “that cybersecurity is a fiduciary duty.” The DOL issued its first cybersecurity guidance that same year. What it means in practice, as we explained in Cybersecurity: A Fiduciary Duty for Plan Sponsors, is that you can hand off the work, but not the accountability.

Prevention starts with knowing where your participant data lives. A typical 401(k) shares information with a recordkeeper, a payroll provider, a custodian and often an advisor. These third parties likely outsource work to other vendors. In Who Has Access? we suggested mapping which security controls belong to you and which belong to each vendor, so nothing falls into the gaps. Then add a newer question to your vendor reviews: Is the provider using AI tools, and what plan data can those tools reach? (Cybersecurity: Are You Managing The New Risks?)

It is also wise to pull out your recordkeeper agreement. The DOL’s tips for hiring a service provider tell sponsors to “beware contract provisions that limit the service provider’s responsibility for IT security breaches.” The same guidance suggests contracts spell out how quickly you’ll be notified of an incident. Make sure you and your recordkeeper have a clear, shared understanding of responsibilities, risks and mitigation plans. 

And don’t stop with your vendors. Groom Law Group principal Jeanne Klinefelter Wilson has pointed out that “no matter how vigilant your plan’s recordkeeper is,” sponsors, fiduciaries and participants all have steps to take. One of the simplest: encourage every participant to register and monitor their own online account, because an account nobody has claimed is easier for a criminal to take over.

Don’t Let Fatigue Become a Vulnerability

There’s a quieter risk too: people tuning out. As we reported in Survey Says: Cybersecurity Fatigue?, five years of surveys by the National Cybersecurity Alliance found that awareness of cyber threats has grown while the motivation to act on it has shrunk. Regular use of multi-factor authentication fell from 94% of respondents in 2022 to 53% in 2025. Over the same stretch, the share of people using passwords built from easy-to-guess personal details, like a pet’s name or a birthday, rose from 25% to 37%.

That matters for a 401(k) plan’s cyber defense. The DOL is blunt about it: “Employees are often an organization’s weakest link for cybersecurity.” Its guidance also names identity theft as a leading cause of fraudulent distributions. A few ways to push back against cybersecurity fatigue:

• Keep training short, specific and tied to real tasks, such as spotting a fake request to change a participant’s bank details or mailing address.
• Require multi-factor authentication for anyone who touches payroll or plan data, and ask whether your vendors require it too.
• Send participants the DOL’s online security tips and repeat the reminder once or twice a year, rather than burying it in onboarding paperwork.

What Will We Do If a Breach Happens Anyway?

The worst time to write a breach response plan is the day a vendor calls with bad news. So what goes into one? The DOL’s Cybersecurity Program Best Practices describe an incident response plan as the instructions an organization follows to detect, respond to and recover from a security incident, and they call for testing the plan every year against realistic scenarios. For a plan sponsor, a basic response plan should settle four things:

• Who is in charge? Name the person at your business who makes decisions during an incident, and confirm who at your recordkeeper, TPA and payroll provider will contact you.
• Who gets notified, and how fast. The DOL’s list includes informing law enforcement, notifying your insurer and telling affected participants without unreasonable delay, along with whatever notice your contracts and state laws require.
• How the problem gets found and fixed. Investigate what happened, give affected participants what they need to protect themselves, and correct the cause so it doesn’t happen again.
• What gets written down. Record the event, each step of your response and a short after-action review of what you would change.

Two earlier posts go deeper. Cyber Breach: Now What? explains why roles among participants, advisors, recordkeepers and the sponsor need to be settled before an incident, not in the middle of one. Cybersecurity Breach: Ask “Why?” shows how asking a vendor what caused a breach helps you decide whether it keeps your business, and adds to your fiduciary record.

A written response plan is also one of the first things a regulator may ask to see–and often on a tight timeline.  DOL investigators have been requesting plans’ written cybersecurity programs, proof of testing and evidence of vendor oversight.  Cybersecurity: Inquiry Letter? walks through the kinds of questions on those letters, so you can gather the paperwork before anyone asks.

Good To Know

For ERISA plan sponsors, a data breach can become a fiduciary breach. If an incident reveals a missing response plan or weak vendor oversight, participants can claim the sponsor fell short of ERISA’s prudence standard. Defending that claim is costly, and the costs can land on you personally.

Your ERISA bond is not cyber coverage. The bond protects the plan from theft or fraud by people who handle plan money. It doesn’t pay to defend you against a fiduciary claim, and it isn’t designed to respond to a cyber incident.

Ask what your vendors’ insurance covers. The DOL suggests finding out whether service providers carry insurance for cyber and identity theft losses, and understanding its terms and limits before you count on it.

Colonial Surety Company: Protection on All Three Fronts

A response plan on paper is step one. Having experts and defense ready the moment you need them is step two. Colonial Surety Company’s ERISA package includes cyber liability insurance with breach response services built in, so small and midsize plan sponsors aren’t left to assemble a response team on their own. The package includes:

• ERISA Fidelity Bond: the DOL-required bond that protects plan assets from fraud and dishonesty.
• Fiduciary Liability Insurance: protects you personally, with up to $1,000,000 for defense and penalties if you’re accused of a fiduciary breach.
• Cyber Liability Insurance: $50,000 of coverage for your business and plan, included at no extra cost, with:
  • Expert-led response services following a data breach
  • Legal services
  • Computer forensic services
  • Notification services
  • Public relations and crisis management expenses
  • Credit and identity monitoring and other personal fraud or loss-prevention solutions
  • Protection from lawsuits and regulatory actions related to the breach

Quote and Obtain your Affordable Protection Package in minutes, now: 

ERISA Protection Package for Retirement Plan Sponsors

Why Choose Colonial Surety Company?

• Trusted & Reliable: U.S. Treasury Listed, Rated “A” (Excellent) by A.M. Best Company, and in business since 1930.
• Direct & Digital: Skip the middleman. Quote, purchase, and download your full protection package entirely online in minutes.
• The Carrier, Not a Broker: No agent markups, no waiting for a callback, and no unnecessary fees.
• National Reach, Local Support: Licensed nationwide with a knowledgeable, US-based customer service team ready to assist you.