Author: Edward McIlveen, CFA
Retirement plan accounts remain a persistent target for cybercriminals, and the Department of Labor has made clear that guarding plan assets from cyber theft falls squarely within a fiduciary’s duty of prudence. This expectation is often summarized as the plan’s Cybersecurity Program obligation, and it applies not only to the sponsor’s own systems but to every recordkeeper, TPA, and advisor with access to participant data.¹
This risk turned real in 2026, when TruStage, a retirement and insurance plan provider, confirmed a cyberattack that disrupted account access and remains under review for participant data exposure.² Recordkeepers coordinate behind the scenes, sharing threat intelligence to strengthen industry-wide defenses. Courts expect plan sponsors to vet retirement plan service providers’ security practices, have sound internal cybersecurity protocols, educate participants on the principles of proper personal cybersecurity, and respond quickly once a breach is suspected with documented diligence proving that a prudent process exists.³
What Plan Sponsors Should Confirm
The DOL’s guidance points retirement plan committees toward verifying that providers maintain:
Formal Security Program: a written information security program covering data encryption, access controls, and incident response.
Independent Audits: recent third-party audit results (such as a SOC 2 report) confirming the provider’s controls were tested and found effective.
Multi-Factor Authentication: MFA is required for any participant or administrator accessing accounts online or by phone.
Breach Notification Terms: contractual languages requiring prompt notice to the sponsor if a breach involving plan data occurs.
Fraud Reimbursement Policy: a clear, written policy describing how the provider handles losses from fraudulent distributions.
Where Plan Sponsors Get Tripped Up
Gaps that commonly surface when committees review their own practices:
No Documented Review: committees that have never formally requested or reviewed a recordkeeper’s security documentation.
Stale Diligence: security reviews performed once at the time of hiring a provider and never revisited since, despite an evolving threat landscape.
Unclear Liability: plan sponsors who assume their provider bears all fraud losses without confirming that in a signed agreement.
No Insurance Coverage: not all cyber insurance policies cover the costs of ERISA litigation due to a breach of the plan sponsor’s computer system that leads to a loss of plan assets.
No or Poor Employee Cybersecurity Awareness Training: the softest target for cyber thieves is usually the plan participant. Vendor reimbursement and corporate cyber insurance policies generally will not reimburse a participant who has allowed their own personal account access information to be compromised. Ongoing employee education and cyber threat awareness training are a necessary element of a proper cybersecurity protocol.
Plan Sponsor Due Diligence Checklist
Committees do not need deep technical expertise to conduct meaningful oversight; a consistent, documented request-and-review process is the standard regulators expect.
Track Record & Insurance: ask whether the retirement plan service providers have experienced past security breaches and confirm they carry insurance covering losses from cybersecurity and identity theft incidents.
Contract Terms: confirm service agreements require ongoing compliance with cybersecurity standards, prompt breach notification, and adherence to data privacy and records retention rules.
Independent Validation: request the provider’s most recent third-party audit results or security certifications as evidence that its practices meet recognized industry standards.
AI & Data Protection Documentation: Request the recordkeeper’s cybersecurity and AI governance policies, descriptions of AI data use, relevant independent audit reports, breach-notification provisions, insurance evidence, and allocation of responsibility for cyber losses, especially in the case of ERISA liability.
Plan Sponsor Protections: maintain appropriate cyber liability insurance, written cybersecurity policies, incident response procedures, and tested backup and disaster recovery capabilities for critical plan-related data.
Employee Education & Procedures: Document the regular training of employees who support the administration of the plan on the plan’s security procedures and secure handling of sensitive data. Provide recurring training to all employees on phishing, social engineering, passwords, AI tools, and sensitive data handling. Use phishing simulations, access reviews, vulnerability assessments, and incident-response exercises to identify and correct weaknesses.
Sources: 1) U.S. Dep’t of Labor, EBSA, Compliance Assistance Release No. 2024-01, Cybersecurity Guidance Update (Sept. 6, 2024), updating Tips for Hiring a Service Provider and Cybersecurity Program Best Practices (Apr. 14, 2021). 2) https://www.trustage.com/outage. 3) See, e.g., Bartnett v. Abbott Laboratories, No. 1:20-cv-02127 (N.D. Ill.); Berman v. Estée Lauder Inc., No. 3:19-cv-06489 (N.D. Cal. 2019); Leventhal v. MandMarblestone Group LLC, No. 2:18-cv-02727, 2019 WL 1953247 (E.D. Pa. May 2, 2019).
The information contained herein is provided for informational purposes only and does not constitute legal, tax, or investment advice. Plan fiduciaries should consult qualified legal counsel regarding their ERISA obligations. The information provided is from sources we believe to be reliable, but we cannot guarantee its accuracy or completeness. Neither the information nor any opinion expressed constitutes a solicitation for the purchase or sale of any security. Francis LLC does not offer personal legal advice.
