401(k) cybersecurity is not an IT department problem that happens to touch your retirement plan. Under Department of Labor guidance, protecting participant data and plan assets from cyber threats is part of running the plan prudently — which makes it a fiduciary responsibility of the employer, the plan administrator and anyone who selects and monitors service providers.
The DOL’s cybersecurity guidance, first issued for retirement plans in 2021 and since confirmed by the Department to apply to health and welfare plans as well, is organized into three pieces: tips for plan sponsors and fiduciaries on hiring a service provider, best practices for recordkeepers and other providers, and online security tips for participants.
Why cybersecurity is a fiduciary duty, not a clerical one
ERISA does not contain a cybersecurity statute. It contains a duty of prudence, and prudence is measured by process. Three ordinary fiduciary duties do the work here:
- Selecting service providers prudently. You choose the recordkeeper, third-party administrator, payroll provider and advisor who hold your participants’ Social Security numbers, dates of birth, compensation and account balances.
- Monitoring them on an ongoing basis. A provider’s controls in the year you hired them tell you nothing about their controls today. Monitoring is a continuing obligation for as long as the relationship lasts.
- Protecting plan assets. A fraudulent distribution drains a participant account, and the fiduciary question of whether you had a reasonable process comes first.
Note what is not delegable by wishful thinking. Your company controls the payroll file, the HRIS export, the spreadsheet on somebody’s laptop and the email in which a manager sent a census to an advisor. Those are employer-side exposures no recordkeeper can fix for you. Our note on reconciling payroll and recordkeeper records covers the data-flow side of the same pipeline.
How it goes wrong
- Census and payroll files are emailed as unencrypted attachments because “that’s how we’ve always sent them.”
- A terminated HR employee keeps recordkeeper portal access for months; nobody owns the deprovisioning list.
- Nobody has ever read the provider’s SOC 2 report, or even asked whether one exists.
- The service agreement is silent on breach notification, data ownership, subcontractors and what happens to the data when the contract ends.
- Cybersecurity has never appeared on a committee agenda, so there is no record that the fiduciaries considered it at all.
What sponsors should actually do
1. Inventory who holds your participant data
Write down every party that receives or stores plan data: recordkeeper, TPA, payroll provider, advisor, auditor, benefits broker, enrollment vendor, and any subcontractor they use. Include what each one receives and how it gets there.
2. Ask providers the questions the DOL’s tips point to
The Department’s hiring tips push fiduciaries toward specific, answerable questions rather than marketing language. In practice that means asking about: information security standards and how they compare to industry norms; independent third-party audits or validations and whether you can see the results; how the provider’s track record includes past breaches and what changed afterward; insurance coverage for cyber and identity-theft losses; and the contractual terms governing data use, subcontractors and breach notification. Ask in writing and keep the answers.
3. Read the audit report, not just the certificate
A SOC 2 Type 2 report is the common artifact. What matters is the scope, the period covered, whether the auditor noted exceptions, and whether the systems that actually hold your plan’s data are in scope.
4. Fix the contract language
Service agreements are where cybersecurity expectations become enforceable. Look for who owns the data, permitted uses (including whether the provider may market to your participants), subcontractor approval, breach notification timing and content, cooperation during an investigation, insurance requirements, audit rights, and what happens to the data at termination — return, deletion, certification. These terms are negotiable far more often than sponsors assume, and reviewing them belongs in the same cycle as your 408(b)(2) fee disclosure review.
5. Lock down the employer side
Encrypt file transfers instead of emailing attachments. Restrict who can export a census. Maintain a deprovisioning checklist tied to your termination process so portal access dies with employment. Require multi-factor authentication on every account that can move money or change participant records.
6. Define the approval path for money movement
Distributions, loans, address changes and banking changes are the fraud targets. Decide who approves what, what identity verification is required, and what happens when a request arrives outside the normal channel. Then write it down. An undocumented practice is indistinguishable, after the fact, from no practice at all — the same lesson sponsors learn with in-service distributions and loan administration.
7. Put it on the committee calendar
Cybersecurity should be a recurring agenda item, not an emergency topic. Review the provider’s current audit report, any incidents, any changes in subcontractors, and your own access list. Record the review in your committee meeting minutes the way you record an investment review, and give the responsibility a home in your committee charter.
8. Know what you will do in the first 24 hours of an incident
Who calls whom? Who contacts the recordkeeper? Who decides on participant communication? Who preserves records? A one-page response path, agreed in advance, is worth more than a binder nobody opens.
9. Help participants protect their own accounts
The DOL’s online security tips exist because participant behavior is part of the risk surface: unregistered online accounts, reused passwords, stale contact information, ignored account alerts. Accurate contact data also protects you elsewhere, as anyone who has worked a missing participant search knows.
A sponsor self-check
- Can you produce a current list of every party holding plan participant data?
- Have you asked each one, in writing, about their security controls — and kept the answers?
- Has someone actually read the most recent independent audit report for your recordkeeper?
- Does the service agreement address breach notification, data ownership and end-of-contract deletion?
- Is multi-factor authentication required on every account that can move plan money?
- Does portal access get revoked the same week an employee leaves?
- Are census and payroll files transmitted through an encrypted channel every time?
- Do your minutes show the fiduciaries reviewing cybersecurity at least annually?
Any “no” above is a gap you can close with process, not budget.
Where sponsors get hurt
- Assuming the recordkeeper’s controls are your controls. Their audit report says nothing about your payroll file or your access list.
- Treating a provider’s assurance as a completed fiduciary review. The duty is to evaluate, not to receive.
- No evidence. You may have handled cybersecurity well for years; if nothing is written down, you cannot demonstrate it on request.
- Stale relationships. Providers merge, subcontract and re-platform. A review from several years ago describes a company that may no longer exist in the same form — one reason cybersecurity belongs in every provider transition checklist.
What you can delegate — and what you cannot
You can delegate the operational work: secure file transfer, monitoring provider audit reports, maintaining the data inventory, building the access-revocation checklist, drafting the annual review memo, keeping the evidence file that an auditor or examiner would ask for. A capable 3(16) plan administration partner does this as routine work rather than as a project nobody has time for, and the same discipline shows up in audit readiness.
You cannot delegate away the employer’s control of its own systems and staff, the decision to hire or keep a provider, or the ultimate responsibility to monitor. What you can do is make sure someone competent owns the process and creates the record — and that the person named in the plan document as responsible is actually willing to be named. For a refresher on how those roles divide, see the ERISA plan administrator role and our overview of retirement plan governance.
Where Admin316 fits
Most providers will happily describe their own security and then decline to take any named responsibility for your plan. Admin316 does something most of the industry refuses to do: we accept the ERISA 402(a) named fiduciary appointment in the plan document and serve as your 3(16) plan administrator — which means the process, the documentation and the monitoring have an accountable owner instead of living in the gap between HR, IT and the recordkeeper.
If you are not certain who currently owns cybersecurity for your retirement plan, that uncertainty is the finding. Book a short call and we will walk your data map, your provider agreements and your evidence file,.
