Cybersecurity: Practical Steps for Plan Sponsors

New cybersecurity threats to the money and data in retirement plans are emerging every day. Who’s got access to accounts and information even as you read this? In the face of new exposures, accountants, attorneys, and the government are all advising retirement plan sponsors to step up their due diligence. Taking practical steps to protect retirement accounts does not require an advanced degree in technology. It does require a commitment of time and effort to do the practical things that are calling for attention. Start with these suggestions, today. 

A Fiduciary Responsibility—and A Moral Responsibility

As TIAA somberly reminds us, retirement plan sponsors have at least two compelling reasons for rolling up their sleeves around cybersecurity: “Because retirement savings is often employees’ primary source of wealth, employers have not only a fiduciary responsibility but a moral one to protect the plan—and everyone needs to do their part.” 

Given the scale and scope of cyber risk, it can feel positively Sisyphean to get ahold of meaningful protective actions (and thus easy to procrastinate), but as CPA Jessica Ashley, a Partner in the Audit Services Group at KLR emphasizes: 

• The threat landscape will continue to evolve, but organizations that take a proactive approach to cybersecurity will be better positioned to reduce risk and fulfill their fiduciary responsibilities.

• Cybersecurity is an essential part of retirement plan governance. By evaluating service providers, strengthening internal controls, addressing third-party risk, and maintaining an effective incident response strategy, plan sponsors can better protect participant data while fulfilling their fiduciary responsibilities.

Action Steps

Towards pragmatically rolling up your sleeves around cybersecurity as a plan sponsor, TIAA recommends these actions: 

• Vet cybersecurity vendors before you hire. Ask service providers about their risk assessments, audit results, penetration testing outcomes, and breach history. Verify their data-handling protocols are up to snuff.
• Review cybersecurity contracts. Make sure each vendor’s timeline for issuing breach notifications is spelled out and that they carry adequate cyber insurance. Require remediation plans and third-party audits.
• Monitor cyber efforts regularly. Meet with vendors at least once a year for detailed cybersecurity updates and discussions. Include your technology team at the table.
• Patch your own cyber gaps. Ensure strong system access controls are in place. Train your team and participants regularly on cybersecurity awareness and what to do when they spot threats. Make a breach action plan. And be sure to write down and formally document your cybersecurity program.

Reminding us that as ERISA plan sponsors we are fiduciaries, attorneys at Foley & Lardner underscore the importance of documenting all of the cybersecurity decisions and actions we take: 

This includes records of service provider evaluations, ongoing vendor reviews, training activities, cybersecurity policy reviews updates, incident response actions, and insurance reviews. Documentation of decisions should include both a record of the final decision and the information reviewed in coming to such decision. In the event of a DOL audit or participant complaint, these records will demonstrate that the fiduciary acted prudently and in accordance with ERISA obligations. Without a good record, your other prudent actions may be for nothing if you have no way to prove they happened.

Additionally, Foley &Lardner attorneys point out that “Human error remains a leading cause of data breaches,” and advise: 

Fiduciaries should ensure that all individuals with access to plan data receive regular  cybersecurity training, at least annually. Training should cover how to recognize phishing emails and social engineering attempts, proper handling of sensitive information (including appropriate and inappropriate use of AI), and procedures for reporting suspected incidents. Also consider including a statement on cybersecurity in your Summary Plan Description that directs participants to the DOL’s online security tips.

Important To Do: Implement the DOL Guidance on Cybersecurity

The Department of Labor expects retirement plan sponsors to implement all three prongs of the guidance issued in 2021, and further clarified in 2024. Here are the links: 

• Cybersecurity Program Best Practices
• Tips for Hiring a Service Provider with Strong Security Practices
• Online Security Tips

As you brush up on the DOL’s cybersecurity guidance, keep in mind that this year the Employee Benefits Security Administration put cybersecurity at the top of its list of enforcement priorities, underscoring “As part of its investigations, EBSA reviews how plans and service providers protect their systems and data from cyber threats.”

For ERISA plan sponsors, a data breach can become a fiduciary breach. If an incident reveals a missing response plan or weak vendor oversight, participants can claim the sponsor fell short of ERISA’s prudence standard. Defending that claim is costly—and those are out of pocket expenses for plan sponsors. 

Your ERISA bond is not cyber coverage. The bond protects the plan from theft or fraud by people who handle plan money. It doesn’t pay to defend you against a fiduciary claim, and it isn’t designed to respond to a cyber incident.

Ask what your vendors’ insurance covers. The DOL suggests finding out whether service providers carry insurance for cyber and identity theft losses, and understanding its terms and limits before you count on it.

Colonial Surety Company: Protection on All Three Fronts

A cybersecurity response plan on paper is step one. Having experts and defense ready the moment you need them is step two. Colonial Surety Company’s ERISA package includes cyber liability insurance with breach response services built in, so small and midsize plan sponsors aren’t left to assemble a response team on their own. The complete package includes:

• ERISA Fidelity Bond: the DOL-required bond that protects plan assets from fraud and dishonesty.
• Fiduciary Liability Insurance: protects you personally, with up to $1,000,000 for defense and penalties if you’re accused of a fiduciary breach.
• Cyber Liability Insurance: $50,000 of coverage for your business and plan, included at no extra cost, with:
  • Expert-led response services following a data breach
  • Legal services
  • Computer forensic services
  • Notification services
  • Public relations and crisis management expenses
  • Credit and identity monitoring and other personal fraud or loss-prevention solutions
  • Protection from lawsuits and regulatory actions related to the breach

Quote and Obtain your Affordable Protection Package in minutes, now: 

ERISA Protection Package for Retirement Plan Sponsors

Why Choose Colonial Surety Company?

• Trusted & Reliable: U.S. Treasury Listed, Rated “A” (Excellent) by A.M. Best Company, and in business since 1930.
• Direct & Digital: Skip the middleman. Quote, purchase, and download your full protection package entirely online in minutes.
• The Carrier, Not a Broker: No agent markups, no waiting for a callback, and no unnecessary fees.
• National Reach, Local Support: Licensed nationwide with a knowledgeable, US-based customer service team ready to assist you.