Vendors Have the Data. You Have the Duty.

As a retirement plan sponsor, when you lean into your fiduciary obligations, chances are good that you are focused mostly on the investment lineup and fees. Cybersecurity rarely makes the cut, but regulators see it differently. In January 2026, the Department of Labor’s Employee Benefits Security Administration (EBSA) named cybersecurity its number one enforcement priority for employee benefit plans.

When you think about it, that focus makes sense. Your plan now runs on recordkeeper websites, participant apps, and, more and more, AI-driven tools. How many hold your employees’ Social Security numbers, account balances, and bank details? What are you doing to protect them? 

More personalization requires more vendor oversight

Participants engage with plans that feel tailored to them, and technology has made that ever more possible. Custom dashboards, retirement projections, and nudges from personalized texts or email are all pretty standard these days. Have you considered how every one of those features probably depends on another system, and often another vendor, handling participant data? Each new connection is one more place something can go wrong.

More data moving through more systems means more ways for it to be exposed. And when a provider handles that data, it’s still the plan sponsor’s responsibility to make sure the provider is protecting it. 

You can hire a recordkeeper or third-party administrator (TPA) to run the plan, but you can’t hand off your responsibility for choosing and monitoring them. When you bring on a new provider, or review a current one, ask how they protect data, how they encrypt it, and how quickly they’ll tell you about a breach. The Department of Labor (DOL) provides tips for hiring a service provider with strong cybersecurity practices that cover exactly these questions.

Teach participants what scams look like

Firewalls and multi-factor authentication (MFA) matter, but many thefts start with a person, not a computer. Scammers use phishing emails, calls that sound like they come from your recordkeeper, and even AI-generated voicemails to get participants to hand over login details or approve a withdrawal.

Invesco’s guide, The new cyber reality: Tips to help participants protect their retirement assets, sums up how these scams work: “Participants may receive messages that prompt urgent action… These are designed to trigger fear and bypass reason.”

Here’s a simple and practical action for plan sponsors and vendors: show employees what these scams actually look like. A short note in an enrollment packet, a reminder in a benefits newsletter, or a few examples at an annual meeting can go a long way. As the same Invesco guide puts it, “Sponsors can help combat this by providing real-world examples of these scams. The more familiar participants are with the tactics, the more likely they are to pause, question and protect themselves.”

Use a prudent process before adopting AI tools

More recordkeepers and advisors now offer AI-powered features, from chat assistants to automated account recommendations. These tools can help participants, but they also raise new questions about where data goes and who can see it.

ERISA doesn’t require you to be a technology expert. It does require a sound, documented process. In Fiduciary Considerations in the Evolving World of AI, attorney Bonnie Treichel, Founder and Chief Solutions Officer at Endeavor Retirement, advises plan fiduciaries to ask providers how they use AI and how participant data is used, protected, stored, and accessed. Before you approve any new tool, ask the provider:

• Where is participant data stored, and who has access to it?
• Is participant data used to train the provider’s AI models?
• What privacy and security protections are written into the contract?
• What happens to the data if you end the relationship?

Write down the questions you asked, the answers you got, and why you made your decision. If the choice is ever challenged, that record is what shows your efforts to  act prudently as a fiduciary. 

Good To Do:  A cybersecurity checklist for plan sponsors

In addition to adhering to all the U.S. Department of Labor cybersecurity protocols, retirement plans sponsors are wise to take proactive steps, like these: 

1. Review your providers’ security every year. Ask your recordkeeper, TPA, and software vendors for their SOC 2 Type II reports and a summary of recent independent security testing. The DOL’s guidance recommends this kind of ongoing monitoring.
2. Confirm strong login protections. Make sure the participant website requires MFA, strong passwords, and alerts for new logins or changes to account details. This is your first defense against fraudulent withdrawals.
3. Have a breach response plan. Decide ahead of time who gets called, how quickly participants are notified, when legal counsel steps in, and what must be reported. Know what your recordkeeper’s contract requires of them, too.
4. Keep educating participants. Share real examples of phishing emails, fake calls, and urgent withdrawal requests so employees know what to watch for.
5. Check your coverage. Your ERISA fidelity bond, fiduciary liability insurance, and cyber liability insurance each protect against different things. Review all three together to spot gaps before a claim does it for you.

Make cybersecurity part of your regular plan oversight

You don’t need to become a cybersecurity expert. You do need to treat plan data the way you treat plan investments: ask good questions, monitor your providers, and keep a record of what you did.

Even well-run plans can be hit by a clever scam or a vendor’s mistake. When that happens, the plan can lose money, and the people who oversee it can face claims that they didn’t do enough. That’s where the right protection comes in.

Protect your plan, your business, and yourself

Colonial Surety Company offers an efficient package built for retirement plan sponsors that brings three types of protection together in one affordable bundle:

• ERISA fidelity bond: Meets ERISA’s bonding requirement and protects the plan against losses from fraud or dishonesty by people who handle plan funds.
• Fiduciary liability insurance: Protects you personally if you’re accused of mismanaging the plan, including claims tied to poor vendor oversight.
• Cyber liability insurance: Provides vital protection for the plan and company against regulatory actions following a data breach and directly addresses the DOL’s response plan recommendations.

Quote and Obtain Your Protection Bundle Right Here: 

Complete Coverage for Retirement Plan Sponsors

Why Choose Colonial Surety Company?

• Trusted & Reliable: U.S. Treasury Listed, Rated “A” (Excellent) by A.M. Best Company, and in business since 1930.
• Direct & Digital: Skip the middleman. Quote, purchase, and download your full protection package entirely online in minutes.
• The Carrier, Not a Broker: No agent markups, no waiting for a callback, and no unnecessary fees.
• National Reach, Local Support: Licensed nationwide with a knowledgeable, US-based customer service team ready to assist you.