As noted in our recent blog post, the US Department of Labor (DOL) has repeatedly signaled that it would be turning its focus toward the intersection of cybersecurity practices and ERISA’s fiduciary duties. On April 14, 2021, the DOL stopped signaling and started acting, issuing three pieces of subregulatory guidance addressing the cybersecurity practices of retirement plan sponsors, their service providers, and plan participants respectively.
While this subregulatory guidance does not have the deferential authority of a regulation subject to notice and comment—or arguably even the persuasive authority of an Advisory Opinion—the guidance provides a window into the DOL’s expectations of what ERISA’s prudence standards require with respect to cybersecurity matters. This window is particularly important given the specters of a threatened DOL enforcement initiative focusing on cybersecurity and privacy issues, increased private litigation arising out of cybersecurity events, and the general uptick in cybersecurity events affecting employee benefit plans.
ERISA’s duty of prudence requires fiduciaries to act “with the care, skill, prudence, and diligence under the circumstances then prevailing that a prudent man acting in a like capacity and familiar with such matters would use in the conduct of an enterprise of a like character and with like aims.” It has become generally accepted that ERISA fiduciaries have some responsibility to mitigate the plan’s exposure to cybersecurity events. But, prior to this guidance, it was not clear what the DOL considered to be prudent with respect to addressing cybersecurity risks associated, including those related to identity theft and fraudulent withdrawals.
Each of the three new pieces of guidance addresses a different audience. The first, Tips for Hiring a Service Provider with Strong Cybersecurity Practices (Tips for Hiring a Service Provider), provides guidance for plan fiduciaries when hiring a service provider, such as a recordkeeper, trustee, or other provider that has access to a plan’s nonpublic information. The second, Cybersecurity Program Best Practices (Cybersecurity Best Practices), is, as the name indicates, a collection of best practices for recordkeepers and other service providers, and may be viewed as a reference for plan fiduciaries when evaluating service providers’ cybersecurity practices. The third, Online Security Tips (Online Security Tips), contains online security advice for plan participants and beneficiaries. We have summarized each piece of guidance below along with our key observations.
Comments and Observations:
While the DOL characterizes the guidance for fiduciaries and service providers as “tips” and “best practices,” the DOL nevertheless included language indicating what an ERISA fiduciary or plan service provider should do. For example, Tips for Hiring a Service Provider states, “Plan Sponsors should use service providers that follow strong cybersecurity practices.” (emphasis added). Similarly, Cybersecurity Best Practices introduces its list of its 12 best practices as what “Plan’s service providers should” do (emphasis added). Although the guidance does not carry the authority of a regulation, there is risk that the DOL on audit (and for plaintiff’s lawyers in litigation) could seek to treat these best practices as mandates rather than helpful suggestions.
In light of this risk, plan fiduciaries could consider using the guidance to build or enhance a process to offset such risks, or bolster a compliance record in anticipation of such DOL investigations and private litigation.
The first piece of DOL guidance, Tips for Hiring Service Providers, outlines factors for “business owners and fiduciaries” to consider when selecting retirement plan service providers, and further provides that plan fiduciaries should hire service providers with strong data security practices.
More specifically, this guidance recommends steps that a plan fiduciary should take when hiring a service provider:
Comments and Observations:
Conspicuously absent from both Tips for Hiring a Service Provider and Cybersecurity Best Practice is a clear statement regarding a fiduciary’s obligations with respect to current service providers. However, it is reasonable to expect that the DOL on audit may assert that a plan fiduciary should have evaluated their current service providers and current agreements in light of this guidance. Thus, fiduciaries may want to consider evaluating current agreements to better understand the service provider’s obligations and sending questionnaires to service providers regarding their cybersecurity programs and exercising audit rights. A fiduciary may even consider approaching service providers to discuss amending the services agreement to address cybersecurity.
Regardless of whether the guidance applies only prospectively or to agreements already in place, plan fiduciaries could consider using the Tips for Hiring a Service Provider when preparing requests for information (RFI) and requests for proposal (RFP). Additionally, when entering into a new agreement, the plan fiduciary could engage in meaningful negotiations over the terms of the agreement implicated in this guidance (e.g., cybersecurity, protection and use of confidential data, insurance coverage, etc.).
The second piece of DOL guidance, Cybersecurity Best Practices, directed squarely at ERISA plan recordkeepers and other service providers who have access to plan-related IT systems and plan data, is the most detailed of the three pieces of subregulatory cybersecurity guidance. The guidance summarizes 12 “best practices” that plan service providers “should” implement to mitigate exposure to cybersecurity risks. Although this guidance is specific to service providers, the DOL points out that plan fiduciaries should be aware of these best practices to enable them to make prudent decisions when hiring a service provider. The 12 best practices described in this guidance indicate that:
Comments and Observations:
Plan fiduciaries issuing RFIs or RFPs, and those negotiating agreements with service providers, may use this guidance as a roadmap to determine the minimum standards to request as representations from their service providers. Similarly, service providers should anticipate their clients (and the DOL) to effectively treat these as minimum cybersecurity program standards.
Comments and Observations:
Plan fiduciaries may wish to request that service providers share the results of the annual risk assessments and annual audit reports. If a service provider is unwilling (or unable) to provide these reports (and the service provider’s contract does not afford the plan fiduciary a right to these reports), the plan fiduciary could consider requesting confirmation that the annual risk assessment and annual audit were completed and that either no new significant risks were identified or any new significant risks have been properly evaluated and mitigated.
Comments and Observations:
Plan fiduciaries are likely to find it difficult to monitor a service provider’s cybersecurity structural organization, control procedures, and oversight of cloud/third-party managed storage systems. After addressing these items as part of an RFI or RFP, plan fiduciaries might consider including these issues as part of an annual questionnaire that provides insight into the service provider’s ongoing compliance with the DOL’s best practices.
Comments and Observations:
The DOL’s emphasis on the risks posed by identity theft, coupled with recent high-profile litigation involving this issue, strongly incentivizes plan fiduciaries to ensure that their service providers have a strong policy of cybersecurity awareness training and to even confirm the subjects of that training (a level of interest that may not be well received by the service providers).
Comments and Observations:
Some plan fiduciaries may find it difficult to understand and evaluate the technical aspects of a service provider’s SDLC programs, business resiliency programs, and security controls. As a result, plan fiduciaries may find value in having a technical expert—such as a member of the plan sponsor’s IT department—assist in reviewing these aspects of a service provider’s cybersecurity practices and documenting the review as part of the fiduciary’s minutes or other fiduciary records. Moreover, as part of the ongoing monitoring of a service provider, fiduciaries might consider including these items as part of an annual questionnaire to ensure continued compliance and to gain information on any enhancements or changes to the service provider’s programs.
Comments and Observations:
Even where plan fiduciaries and the plan’s service providers take all reasonable steps to prevent cybersecurity events, they may nevertheless occur. What service providers do when these events occur is critical to mitigating the plan’s exposure to cybersecurity events. Plan fiduciaries should work to understand a service provider’s contractual obligations before the event and to ensure that all appropriate steps, as described in the guidance, are taken promptly in the event of a cybersecurity event.
The third piece of DOL guidance, Online Security Tips, inform plan participants and beneficiaries of ways to keep their online information and account safe. Some of the nine recommended security tips include the use of multifactor authentication, keeping contact information current, and avoiding phishing attacks. Plan fiduciaries could help mitigate the plan’s exposure to cybersecurity threats by encouraging participants and beneficiaries to follow these tips. This is especially true for the three tips highlighted in the foregoing sentence, which are particularly well-suited to limiting the risk of identity theft.
Comments and Observations:
While this guidance may not seem particularly important to plan fiduciaries at first, it can serve as a useful way to reiterate to plan participants and beneficiaries that they also have a responsibility to mitigate their exposure to cybersecurity events. Moreover, it may be helpful for plan fiduciaries to offer periodic educational and outreach on these responsibilities, and to reiterate to participants and beneficiaries during these target efforts (and in regular disclosures and communications, including the plan’s summary plan description) that the plan participants and beneficiaries bear responsibility for ensuring that they are taking precautions to secure their plan benefits from external threats.
The guidance issued on April 14, 2021 leaves open many questions. For example, how should plan fiduciaries and service providers address existing arrangements that do not comport with the guidance? Does the DOL believe that ERISA preempts state data privacy laws as they relate to ERISA benefit plans? Does the DOL expect fiduciaries to communicate the Online Security Tips to participants and beneficiaries, and, if so, how often? Nevertheless, it is a useful first step towards clarifying the DOL’s understanding of how ERISA’s duty of prudence applies to the world of cybersecurity.
As far as next steps are concerned, we encourage plan sponsors, fiduciaries, and service providers to consult the new guidance, enhance their existing data security protocols, and consider revisiting service provider agreements to better reflect the best practices set forth by the DOL. Please contact the authors or your Morgan Lewis contacts if you have any questions about this new guidance, the plan fiduciary’s duty of prudence, or what to do if (or when) a cybersecurity event affects your plan.
Boston
Lisa Barton
Chicago
Marla Kreindler
Dan Salemi
Julie Stapel
New York
Craig Bitman
Philadelphia
Bob Abramowitz
Amy Kelly
Gena Yoo
Pittsburgh
John Ferreira
Matt Hawes
Elizabeth Goldberg
Randall C. McGeorge
R. Randall Tracht
Washington, DC
Rosina Barker
Althea Day
Michael Gorman
Lindsay Jackson
Daniel Kleinman
Greg Needles
Michael Richman
Jonathan Zimmerman