Participant data and financial accounts comprise some of the most sensitive and potentially vulnerable information under a company’s care. These highly valuable assets can be an attractive target for cybercriminals and therefore present a considerable security risk. Breaches to this information can be devastating to plan participants and to the reputation of the organization.
For plan sponsors, ensuring protections around participant data and investment assets is a key fiduciary responsibility. In fact, as law firm Hodgson Russ noted recently, “The causation standard under Section 409(a) of ERISA is an issue that could lead to more litigation as cyberattacks on employee benefit plans increase.” The provision states that plan fiduciaries who breach their fiduciary responsibilities are personally liable for any losses that result from the breach. The law firm continues: “Outside of the ERISA context, however, courts have looked at similar questions … [and] found that proximate cause was sufficiently alleged when a complaint contended that the defendant’s failure to establish industry-standard information security safeguards was the proximate cause of the stolen personal information.”
Sponsors should consider their potential exposure under Section 409(a), in the event of a failure to adhere to a prudent process for mitigating risk (upholding the higher prudent man standard). In 2020, the U.S. Department of Labor (DOL) issued guidance aimed at plan sponsors, plan fiduciaries, recordkeepers and plan participants, offering best practices for maintaining cybersecurity. The guidance is structured along three main areas of focus: service provider selection, establishment of a cybersecurity program and participant protection.
Hiring a Provider
Per the DOL, plan sponsors should perform a series of due diligence checks prior to engaging a provider. The department’s advice includes inquiring about the provider’s information security standards, practices and policies, and audit results, as well as comparing them to the industry standards adopted by other financial institutions. The DOL also recommends examining the provider’s track record in the industry — including a public records search of information security incidents and litigation related to its services — and asking about the level of security it has met and implemented, how it has responded to past security breaches and whether it carries insurance that would cover losses due to a cybersecurity incident.
Implementing a Cybersecurity Program
For establishing and maintaining an effective program, the DOL points to best practices prepared by the Employee Benefits Security Administration (EBSA). The agency’s advice includes having strong access control procedures as well as an effective business resiliency program addressing business continuity, disaster recovery and incident response. It also recommends conducting periodical cybersecurity awareness training and an annual third-party assessment of security controls.
Participant Cyber-safety
Because participants and beneficiaries can fall directly within cybercriminals’ attack vector, DOL’s guidance also offers tips aimed at helping retirement account holders reduce the risk of fraud and loss. For example, the DOL advises that participants routinely monitor their online account, create strong passwords and use multi-factor authentication. Other recommended precautions include signing up for account activity notifications and exercising caution with regard to use of free, publicly available Wi-Fi networks.
Defending Against Cyberthreats
Cybersecurity breaches have become increasingly prevalent in the modern world and have added another layer of complexity for plan sponsors. Given the current regulatory and legal climate, it's more important than ever to stay abreast of changes in a dynamic risk landscape — and partner with an advisor and service providers who can help mitigate the risks and keep plan participants’ data and assets safe from cyberthreats.
To view the full DOL guidance, visit the department’s website https://www.dol.gov/agencies/ebsa/key-topics/retirement-benefits/cybersecurity
Sources:
https://www.jdsupra.com/legalnews/causation-under-erisa-in-a-4086713/
https://www.dol.gov/agencies/ebsa/key-topics/retirement-benefits/cybersecurity
How Stonebridge Can Help
It can be a bit overwhelming to administer a company retirement plan, given all the documentation nuances let alone the deadlines! At Stonebridge Financial Group, we work exclusively with retirement plans and can help you with everything from designing to running your plan. Delegating fiduciary responsibilities can be a great solution for plan sponsors who lack time and the knowledge of ever-changing requirements to manage a retirement plan -- it's is all we've done since our inception back in 2004! Our robust service offering starts with ERISA 3(21) and 3(38) services and is the tip of the iceberg. We are consultants that help you with every aspect of your plan:
- Implementing cybersecurity best practices
- Ensuring participant retirement readiness
- 1:1 and group participant education and retirement readiness meetings
- Consulting on financial wellness
- Committee fiduciary training
- Process creation and documentation
- Plan design
- Contribution match modeling
- Annual plan compliance review
- And so much more
We become your outsourced retirement plan officer who dives into the morass of retirement plan details and resolves issues so you don't have to!
Please click here to schedule a short call, give us a call at (855) 530-0500 x601 or email info@stonebridgefinancialgroup.com. We look forward to helping your committee successfully fulfill their fiduciary duties with ease and excellence!