DOL Issues Cybersecurity Guidance for Retirement Plans

Updated September 2021

On April 14, the Department of Labor (DOL) outlined a range of practices for combatting the growing threat of cybercrime to ERISA-covered retirement plans. This first-ever cybersecurity guidance issued by the DOL’s Employee Benefits Security Administration (EBSA) casts a wide net, addressing key issues affecting plan sponsors, fiduciaries, recordkeepers, as well as plan participants and beneficiaries.

The DOL estimates that defined contribution and defined benefit retirement plans hold a combined $9.3 trillion in assets. These plans also store vast amounts of vital personal information online—information that could put participants and their assets at risk if a plan’s online systems were breached. In issuing this guidance, the DOL acknowledges the imminent risk posed by acts of cybercrime as well as the obligation of responsible plan fiduciaries, as set forth by ERISA, to help mitigate these risks.

Shortly after the release of the guidance, the DOL began reaching out to plan sponsors inquiring about their cybersecurity practices.  The inquiries are lengthy and cover all documents (policies, procedures, guidelines, reports, etc.) and communication relating to any cybersecurity or information security programs that apply to the data of the Plan regardless of the location of the data. 

 

Three Types of Guidance Issued

The DOL’s guidance is presented in three separate documents, each targeting a different audience. These best practices and tips are offered as recommendations for safeguarding the assets and personal information of plan participants while helping to reduce the risk of fraud and loss.

Tips for Hiring a Service Provider

This document aims to help plan sponsors and fiduciaries meet their responsibilities under ERISA to prudently select and monitor service providers that follow strong cybersecurity practices. Specific recommendations include scrutinizing the service provider’s information security standards, practices, policies, and audit results; evaluating its track record in the industry, including whether the provider has experienced any past security breaches and how it responded; inquiring about any potential insurance policies the service provider may hold that cover cybersecurity breaches; and reviewing contracts to ensure that they include provisions for compliance with cybersecurity and information security standards.

Cybersecurity Program Best Practices

This document offers 12 best practices that address the needs of recordkeepers and other service providers responsible for managing plan-related IT systems and data, as well as the needs of plan fiduciaries who are responsible for hiring such vendors. The recommended practices include having a formal, well-documented cybersecurity program; conducting annual risk assessments; holding periodic cybersecurity awareness training sessions; and implementing and maintaining strong technical controls in keeping with industry best practices.

Online Security Tips

While this tip sheet targets plan participants and beneficiaries, the information is also important for plan sponsors to know and potentially integrate into employee education programs focused on online safety. These tips include encouraging users to regularly monitor their accounts online; creating strong passwords; using multi-factor authentication; being aware of (and knowing the signs of) phishing attacks; and keeping antivirus applications and all system software up to date.

 

Building on Past DOL Guidance

Although the DOL noted that this guidance was an important “first step” in safeguarding retirement benefits and personal information, it also builds on earlier EBSA guidance that addressed electronic recordkeeping systems and controls for protecting the personal information of plan participants. In this way, the current guidance may serve as a call to action to plan sponsors, fiduciaries and participants to review and update any established cybersecurity practices and protocols or to create a cybersecurity program using these recommendations.

 

BDO Insight: Keep Strengthening Your Controls

While there is no way to eliminate the risk of cybercrime entirely, plan sponsors who understand and take steps to incorporate the DOL’s guidance into their cybersecurity protocols will be on a more solid path to safeguarding their plan assets and participants’ vital information.

The DOL guidance should be viewed as guidance or recommendations rather than a set of minimum requirements or as regulations. These recommendations underscore the importance of constantly evaluating, testing, and improving your cybersecurity protocols amid a rapidly evolving threat landscape.

Your BDO representative can help you assess your current cyber risk profile.