The ERISA consultants at the Retirement Learning Center Resource regularly receive calls from financial advisors on a broad array of technical topics related to IRAs, qualified retirement plans and other types of retirement savings plans. We bring Case of the Week to you to highlight the most relevant topics affecting your business.
A recent call with an advisor in Massachusetts is representative of a common question on what the Department of Labor (DOL) has to say about cybersecurity and retirement plans. The advisor asked:
“Can you bring me up to speed on what cybersecurity standards apply to qualified retirement plans?”
Highlights of the Discussion
Cybersecurity has been a growing topic of importance in the retirement services industry for years. The Bartnett v. Abbott Labs court case in 2020 (although later dismissed), along with other cases, have heightened the concern forfiduciary liability related to such breeches. From a historical perspective, there is an understanding under DOL Regulation Section 2520.104b-1(c) and other pronouncements related to the electronic delivery of plan information that a plan sponsor must ensure the electronic system it uses keeps participants’ personal information relating to their accounts and benefits confidential.
Most recently, on April 14, 2021, the DOL issued three cybersecurity directives for retirement plans: one for plan sponsors, one for plan recordkeepers and one for plan participants:
- Tips for Hiring a Service Provider: This piece helps plan sponsors and fiduciaries prudently select a service provider with strong cybersecurity practices and monitor their activities, as ERISA requires.
- Cybersecurity Program Best Practices: This piece assists plan fiduciaries and record-keepers in their responsibilities to manage cybersecurity risks by following the following steps.
1. Have a formal, well documented cybersecurity program.
2. Conduct prudent annual risk assessments.
3. Have a reliable annual third-party audit of security controls.
4. Clearly define and assign information security roles and responsibilities.
5. Have strong access control procedures.
6. Ensure that any assets or data stored in a cloud or managed by a third-party service provider are subject to appropriate security reviews and independent security assessments.
7. Conduct periodic cybersecurity awareness training.
8. Implement and manage a secure system development life cycle (SDLC) program.
9. Have an effective business resiliency program addressing business continuity, disaster recovery, and incident response.
10. Encrypt sensitive data, stored and in transit.
11. Implement strong technical controls in accordance with best security practices.
12. Appropriately respond to any past cybersecurity incidents.
- Online Security Tips: This piece offers plan participants and beneficiaries who check their accounts online basic rules to reduce the risk of fraud or loss.
This trifecta of guidance comes on the heels of two recommendations to the DOL from a February 2021 Government Accountability Office (GAO) report to: (1) formally state whether it is a fiduciary’s responsibility to mitigate cybersecurity risks in DC plans; and (2) establish minimum expectations for addressing cybersecurity risks in them. But despite the release of these three directives, presently there is no comprehensive federal regulatory regime covering cybersecurity for retirement plans.
In a 2016 report, Cybersecurity Considerations for Benefit Plans, the ERISA Advisory Council suggested that the DOL raise awareness about cybersecurity risks and provide information for developing a cybersecurity strategy specifically focused on benefit plans. The report also put forth considerations for the industry for navigating cybersecurity risks. The considerations relate to the following three key areas. (Please refer to the report for more details.)
1. Establish a Strategy
- Identify the data (e.g., how it is accessed, shared, stored, controlled, transmitted, secured and maintained).
- Consider following existing security frameworks available through organizations such as the Nation Institute of Standards and Technology (NIST), Health Information Trust Alliance (HITRUST), the SAFETY Act, and industry-based initiatives.
- Establish process considerations (e.g., protocols and policies covering testing, updating, reporting, training, data retention, third party risks, etc.).
- Customize a strategy taking into account resources, integration, cost, cyber insurance, etc.
- Strike the right balance based on size, complexity and overall risk exposure.
- Consider applicable state and federal laws.
2. Contracts with Service Providers
- Define security obligations.
- Identify reporting and monitoring responsibilities.
- Conduct periodic risk assessments.
- Establish due diligence standards for vetting and tiering providers based on the sensitivity of data being shared.
- Consider whether the service provider has a cyber security program, how data is encrypted, liability for breaches, etc.
3. Insurance
- Understand overall insurance programs covering plans and service providers.
- Evaluate whether cyber insurance has a role in a cyber risk management strategy.
- Consider the need for first party coverage.
The report concludes with an appendix entitled, “Employee Benefit Plans: Considerations for Managing Cybersecurity Risks (A Resource for Plan Sponsors and Service Providers).”
State laws are another consideration. Each state has different laws governing cybersecurity concerns that may come into play. Unfortunately, many retirement plans cover multiple states or retirees who have moved out of state.
Conclusion
As fiduciaries of their retirement plans, the DOL requires plan sponsors to ensure the electronic systems they authorize for use in the administration of their plans keeps participants’ personal information relating to their accounts and benefits confidential. While, currently, no comprehensive cybersecurity protocol for retirement plan administration exists at the federal level—we do have a series of guidelines, suggestions and best practices.
Any information provided is for informational purposes only. It cannot be used for the purposes of avoiding penalties and taxes. Consumers should consult with their tax advisor or attorney regarding their specific situation.
©2021, Retirement Learning Center, LLC. Used with permission.
