John E. Chapman
Chief Executive Officer
Ensuring the security of retirement plan data and assets is crucial. While there are no binding rules on cybersecurity for 401(k) and defined benefit plans, the Department of Labor (DOL) has issued best practices and recommendations for fiduciaries and record keepers. These guidelines emphasize that plan fiduciaries have an obligation to properly mitigate cybersecurity risks, although these practices are not mandatory. Even without clear and uniform legal regulations, all plan fiduciaries must take steps to protect participants from cyber theft and data breaches.
The DOL has issued a document setting out best practices and practical steps employers can take to enhance the security of their plans, and to prepare themselves in the event of a Department of Labor audit.
Here’s a link to that document US Department of Labor announces new cybersecurity guidance for plan sponsors, plan fiduciaries, record-keepers, plan participants | U.S. Department of Labor (dol.gov)
Why is the DOL taking the issue of cybersecurity so seriously? Here are a few sobering statistics:
- Global cybercrime damage costs are expected to grow by 15% per year over the next two years, reaching $10.5 trillion USD annually by 2025 (Forbes).
- For 2023, the United States continues to have the highest cost of a data breach at $5.09M (IBM).
- When remote work is a factor in causing a data breach, the average cost per breach is $173,074 higher, underscoring the cybersecurity challenges in the evolving work landscape (IBM).
- Participant records contain personal and financial data, SSN, home addresses and more
With so much at risk, it is imperative that Plan Sponsors arm themselves with best practices to combat these trends.
Here are some questions often asked by the Department of Labor when plans are audited:
- Do you have a privacy and security policy in place, and does the policy apply to data held by benefit plans?
- Is the policy clear with respect to storing PII on laptops and portable storage devices?
- Does your service provider have policies on storing PII including where it is stored, how long it is stored, and how it is eliminated?
- Phishing is a major problem because it can get right through the tightest security protocols. What measures does the recordkeeper have against phishing?
- Does the recordkeeper utilize their own technology or do they outsource recordkeeping technology to a third party?
- Does the provider carry cybersecurity insurance?
The Department of Labor has also issued online security tips for plan participants.
Because participants are often where the breach occurs, plan sponsors should remind participants of the importance of registering their accounts, routinely monitoring their account, and the use of strong, unique passwords with multi-factor identification. Participants should be wary of free WIFI and be on guard for phishing attacks. Plan sponsors should also be sure to document what Cybersecurity Participant Education has been conducted.
A Cybersecurity Compliance Plan can protect plans and fiduciaries from cybersecurity breaches and noncompliance and can protect participants from unauthorized access of personal information.
Your team at Clearwater Capital Partners feels so strongly about this topic that we are hosting a webinar with expert presenters.
During our upcoming webinar, our guest speakers will outline actionable Key Steps (cybersecurity policy, participant education, vendor reviews, and insurance coverage) and provide suggested action items you can take. Join us on July 25th, with special guest speakers, Lisa Van Fleet and Jason Wroblewski to learn more about this challenging and timely topic.
SAVE THE DATE:
WEBINAR
July, 25th, 12:00pm – 1:00pm CST
Cybersecurity and ERISA: Compliance & Protections
Join Clearwater Capital Partners for a Virtual Plan Sponsor Event and Discussion around Cybersecurity and ERISA: Compliance & Protections.
Leading this discussion includes guest speaker Lisa Van Fleet, Partner at BCLP Law, and Jason Wroblewski, Regional Vice President at Ascensus.
Please reach out to your plan advisor with questions, and more information.
