Attention All ERISA Plans: Cybersecurity Isn’t Just for Retirement Plans

The EBSA just released Compliance Assistance Release No. 2024-01, clarifying that the cybersecurity standards issued by the DOL in 2021 apply to all ERISA plans, not just retirement plans. Note that this is not a new requirement but merely a clarification that the EBSA felt compelled to make. Apparently, some health and welfare plan service providers were incorrectly informing employers that these standards only applied to retirement plans.

It is important to remember that the basic fiduciary requirements of ERISA apply to health and welfare plans too. Unfortunately, health and welfare plans are often left to insurers, and employers are unaware of the other requirements that can’t be delegated to a vendor. Just as with retirement plans, the ultimate responsibility for compliance lies with the employer.

So, it is a good time to look at the 2021 cybersecurity standards again, in the light that they apply to ERISA plans:

Cybersecurity is a hot topic everywhere. We read about huge breaches of our personal information in the news all the time. We have to go through all kinds of measures to see our own records—complicated passwords we never remember, two-factor authentication as an extra step, getting locked out after too many attempts—it is just a part of our daily life.

For employee benefits plans, it is not surprising that ensuring the security of plan data is a fiduciary responsibility under ERISA. The plan sponsor and other fiduciaries have a duty to safeguard plan data, either through direct action or through oversight of third-party vendors. Given the large amount of funds and personal data contained in benefits plans, which are attractive to cyber-criminals, data security is understandably subject to a high level of scrutiny by government regulators. The Department of Labor’s Employee Benefits Security Administration (“EBSA”) has an Office of Enforcement which performs special auditing of the cybersecurity oversight by plan fiduciaries.

In 2021, the EBSA issued guidance on cybersecurity directed at plan sponsors, fiduciaries, and participants. This guidance, set forth in three publications as described below, is both welcome technical assistance as well as a signal of the DOL’s expectations.

• Tips for Hiring a Service Provider is a helpful guide for plan fiduciaries to oversee service providers.
• Online Security Tips is directed at participants and beneficiaries, but the information is important for plan fiduciaries as well.
• Cybersecurity Best Practices provides the most useful insight into what the DOL expects plan fiduciaries and service providers to do. Specifically, the DOL expects that there be:
  • A formal, well-documented cybersecurity program. The program should protect infrastructure, information systems, and data from unauthorized access, use, or other malicious acts; establish strong security policies, procedures, guidelines, and standards that meet specific criteria; and establish formal and effective policies and procedures governing 18 different criteria.
  • Annual risk assessments. These can be performed by knowledgeable in-house IT personnel or by a third party.
  • Annual third-party audit of security controls.
  • Clearly defined and assigned information security roles and responsibilities, which can be incorporated into existing job descriptions.
  • Strong access control procedures. This might mean setting specific password criteria and two-factor authentication requirements.
  • Third-party vendor oversight. Assets or data stored in a cloud or managed by a third-party service provider are subject to appropriate security reviews and independent security assessments.
  • Cybersecurity awareness training conducted at least annually for all personnel and updated to reflect risks identified by the most recent risk assessment. Personnel should be trained for identifying suspect emails, effective password hygiene, actions to take if a breach is suspected, and applicable procedures designed to secure data. The human factor is often the weak link that cyber-criminals exploit, making a well-trained, cyber-sophisticated workforce the best defense.
  • Secure System Development Life Cycle (SDLC) program to ensure that security assurance systems are an integral part of the system development.
  • A business resilience program, which includes business continuity, disaster recovery, and incident response.
  • Encryption of sensitive data stored and in transit. Programs like Word, Excel, and Acrobat have encryption enabled, making it easy to encrypt a sensitive file. Be sure to provide the password in a phone call, never in an email, otherwise, the encryption becomes useless.
  • Strong technical controls implementing best security practices, including firewalls, anti-virus software, and regular testing of data backup systems.
  • Responsiveness to cybersecurity incidents or breaches to mitigate damage and guard against future attempts.

While much of cybersecurity best practices will involve the plan sponsor’s IT personnel and third-party vendors, remember that the security of personal data is a fiduciary responsibility. Fiduciaries must ensure that these policies and procedures are in place and being followed, requiring hands-on oversight by plan fiduciaries.

Cyber theft of plan assets and participant data is one of the biggest risks to ERISA plans today. While the convenience and speed that technology provides are largely beneficial and integral to our lives, they also create a large area of risk that can be exploited. Plan fiduciaries must ensure they are doing everything reasonably possible to protect their plans and participants from this danger. At a minimum, this means asking for a service provider’s SOC 2 report and performing annual self-audits, either with in-house expertise or a third-party specialist. The DOL has caught up with this, and so must we all. But never be complacent—hacks and frauds continue to evolve, and a plan’s cybersecurity vigilance must be dynamic. And now there is no doubt that this means you too, health and welfare plans.