Why it matters

Retirement plans often contain some of an organization's most sensitive information, including Social Security numbers, financial account details, and other personally identifiable information. As cybercriminals become more sophisticated, retirement plans have become increasingly attractive targets. Beyond protecting participant data, plan sponsors have a fiduciary responsibility to evaluate whether the service providers they rely on have appropriate safeguards in place to prevent, detect, and respond to cyber threats.

Why retirement plans are attractive targets

Retirement plans hold valuable financial and personal information that can be used for identity theft, fraudulent distributions, and other forms of financial fraud. Modern attacks extend far beyond phishing emails and now include ransomware, business email compromise, social engineering schemes, credential theft, and AI-assisted attacks designed to bypass traditional security measures.

As these threats continue to evolve, retirement plan sponsors should periodically reassess whether their cybersecurity practices and controls, and those of their service providers, remain appropriate.

Evaluate your retirement plan service providers

Many plan sponsors assume cybersecurity is entirely the responsibility of their recordkeeper. While service providers play a significant role in protecting plan data, plan sponsors should conduct appropriate due diligence when selecting and monitoring vendors they engage.

Consider asking questions such as:

• Does the provider maintain a formal and documented cybersecurity program?
• Are independent security audits performed regularly?
• How is participant data encrypted and protected?
• What access controls and multifactor authentication measures are in place?
• Has the provider experienced cybersecurity incidents, and how were they addressed?
• What are the provider’s incident-notification obligations and expected notification time frames?
• How are cybersecurity incidents detected, reported, and resolved?
• What cyber liability or crime insurance coverage does the provider maintain
• What employee cybersecurity training is conducted?

Plan fiduciaries should document the cybersecurity information reviewed, questions raised, responses received, identified concerns, and follow-up actions. Cybersecurity should also be revisited periodically and when there is a significant change in service providers, systems, plan operations, or known threats.

Cybersecurity requires more than technology

The strongest cybersecurity programs combine people, processes, technology and governance. Technical safeguards such as encryption, multifactor authentication, secure data transfers, and network monitoring are essential. However, organizations should also establish documented cybersecurity policies, perform regular risk assessments, develop incident response and business continuity plans, and provide ongoing employee awareness training.

Employees often serve as the first line of defense and unfortunately, sometimes the weakest link. Regular awareness training can significantly reduce the likelihood of successful phishing and social engineering attacks.

Don't overlook third-party risk

Retirement plans often rely on multiple service providers to support plan operations, including recordkeepers, trustees, TPAs, investment advisors, payroll providers and other technology vendors. Each third-party relationship introduces another potential access point for cybercriminals.

Plan sponsors should understand how vendors manage cybersecurity, review security reports when available, and periodically reassess vendor risk as technologies and threats continue to evolve.

Participant security matters too

Participants are also an important part of the cybersecurity process. They should be encouraged to:

• Enable multifactor authentication on retirement accounts
• Use strong and unique passwords
• Regularly review account activity
• Keep contact information current
• Promptly report suspected fraud or unauthorized activity
• Exercise caution when responding to emails requesting personal information

Cyber insurance is part of your risk management strategy

Even organizations with mature cybersecurity programs can experience a cyber incident. Cyber liability and crime insurance may help mitigate certain financial losses and should be considered an important component of an overall risk management strategy.

Reviewing cyber liability and crime insurance coverage can help ensure your organization understands what events and losses are covered, how claims must be reported, and whether current policy limits are appropriate.  

Cybersecurity is an essential part of retirement plan governance. By evaluating service providers, strengthening internal controls, addressing third-party risk, and maintaining an effective incident response strategy, plan sponsors can better protect participant data while fulfilling their fiduciary responsibilities.

The DOL has published cybersecurity guidance for plan sponsors, fiduciaries, recordkeepers, other service providers, and participants. The guidance includes tips for selecting service providers, cybersecurity program best practices, and online security recommendations for participants.

The threat landscape will continue to evolve, but organizations that take a proactive approach to cybersecurity will be better positioned to reduce risk and fulfill their fiduciary responsibilities.