Rethinking Cybersecurity Beyond the Firewall: Protecting Employee Benefit Plans in the Digital Era
Cyberattacks are no longer confined to headline-grabbing data breaches at major corporations. As digital threats evolve, so too must our understanding of what needs protection. One critical but often overlooked area is employee benefit plans, including retirement, health, and welfare plans. These plans hold vast amounts of sensitive personal and financial data, making them prime targets for cybercriminals.
For many organizations, cybersecurity efforts have focused on enterprise systems, yet benefit plans fall squarely within the scope of fiduciary responsibility. The Department of Labor (DOL) has made this clear through a series of guidance documents that form a practical roadmap for plan sponsors and service providers.
The DOL’s Expanding Cybersecurity Framework
The DOL’s April 2021 guidance was the first major warning shot, underscoring that plan fiduciaries must take active steps to safeguard participant data. Through resources such as:
- Cybersecurity Program Best Practices — outlining 12 essential practices, from maintaining documented programs to annual risk assessments and third-party security audits;
- Tips for Hiring a Service Provider with Strong Cybersecurity Practices — reminding sponsors to vet vendors for cyber liability insurance and prior incident history; and
- Online Security Tips for Plan Participants — empowering employees with simple but crucial protections like multi-factor authentication and secure passwords,
the DOL created an initial foundation for security expectations across the benefits ecosystem.
The landscape evolved further with Compliance Assistance Release No. 2024-01, issued in September 2024, which expanded these protections beyond retirement plans to all ERISA-covered employee benefit plans, including health and welfare arrangements. This clarification reinforced that every plan fiduciary must prudently evaluate cybersecurity risks, not just for financial systems but for any environment holding participant data or protected health information (PHI).
Together, these publications outline a clear message: cybersecurity is now a fiduciary duty.
From Compliance to Leadership
Leading organizations are not waiting for formal regulations; they are treating cybersecurity as a strategic imperative. A robust, future-ready approach should include:
- Developing a comprehensive, well-documented cybersecurity program aligned with DOL best practices.
- Conducting vendor and supplier risk assessments, ensuring third parties follow comparable standards.
- Implementing two-factor authentication and strong access controls for all plan portals.
- Keeping systems and security software continuously updated.
- Engaging independent experts to audit and validate security controls.
Cybersecurity excellence requires collaboration from plan fiduciaries, administrators, and participants themselves. By aligning with the DOL’s evolving guidance, plan sponsors demonstrate not only compliance but true thought leadership in protecting employee trust and financial well-being.
The DOL has charted a clear path for responsible governance, and the message is unmistakable: safeguarding benefit plan data is not optional, it is fundamental. Those who act now to strengthen defenses will be better prepared for regulatory scrutiny, future threats, and the growing expectation that fiduciary prudence includes digital resilience.
