Client Alert
Lynn A. Hinrichs, Billee Elliott McAuliffe, Kelly M. Gorman, Nicholas R. Lovejoy, Jack M. Terschluse
share this page:
Plans covered by the Employee Retirement Income Security Act (“ERISA”) are at a greater risk of cyber-incidents since they hold millions of dollars or more in assets and maintain an abundance of personal information about plan participants. Recognizing these risks, on April 14, 2021, the Department of Labor’s (“DOL’s”) Employee Benefits Security Administration (“EBSA”) published cybersecurity guidance for plan sponsors, plan fiduciaries, record keepers, and plan participants. The new guidance pertains to plan sponsors and fiduciaries regulated by ERISA, including plan participants and beneficiaries. Furthermore, in its 2022 budget, the EBSA has specifically requested increased expenditures for investigations into cybersecurity breaches and related enforcement actions. Below are highlights from the EBSA’s new guidance for plan sponsors, plan fiduciaries, and record keepers. Within the guidance, there are also tips that plan participants can use to protect their own personal information. The entirety of the EBSA’s guidance can be found here.
EBSA has for years recommended that ERISA plan sponsors, plan fiduciaries and record keepers use the following best practices to mitigate cybersecurity risks. In its new guidance, EBSA makes clear that ERISA requires plan fiduciaries to take appropriate precautions to mitigate these risks and outlines some of what constitutes “best practices” in this area. It is unclear from the guidance if the best practices included in the guidance are an exhaustive list, but we know for sure they are a good start.
ERISA mandates that fiduciaries act with “care, skill, prudence, and diligence ….” 29 U.S.C.A. § 1104. This standard applies to the selection of service providers and the EBSA’s new guidance interprets this standard to include an analysis of the service provider’s cybersecurity practices as part of the fiduciary’s service provider selection and maintenance process. The following are activities, noted in the EBSA’s new guidance, that an ERISA plan fiduciary can use during its service provider selection process to analyze the service provider’s cybersecurity sophistication.
By following the above recommendations, plan sponsors, plan fiduciaries, record keepers, and plan participants can help to mitigate some of the rapidly growing risk of cyber incidents. If you need assistance with your cybersecurity policies and procedures, with the selection/maintenance of, or contracts with, your current or potential service providers, or with more general questions regarding data privacy and/or cybersecurity laws, please contact a member of either the Cybersecurity & Data Privacy Practice Group or the Pension & Employee Benefits Practice Group.