On September 6, 2024, the U.S. Department of Labor (DOL) issued Compliance Assistance Release No. 2024-01, titled "Cybersecurity Guidance Update." The updated guidance clarifies that the DOL cybersecurity guidance applies to all ERISA-covered plans, and not just retirement plans, but also health and welfare plans. Also, as a direct response to service providers' concerns, the DOL expanded its 2021 guidance to emphasize that plan sponsors, fiduciaries, recordkeepers, and participants should adopt cybersecurity practices across all employee benefit plans. With cyber risks continually evolving, the update highlights the importance of implementing robust security practices to protect participant information and plan assets.
Background
When the DOL initially issued its cybersecurity guidance in April 2021, it was intended to help ERISA plan sponsors, fiduciaries, service providers, and participants safeguard sensitive data and assets. Some interpreted the guidelines as applicable only to retirement plans and not service providers or recordkeepers, which led to industry calls for clarity. The 2024 Compliance Assistance Release addresses these concerns by confirming that the DOL's cybersecurity expectations indeed are intended to extend to all ERISA-covered employee benefit plans, including health and welfare plans.
Expanded Guidance Highlights
The updated guidance maintains the original three-part format,
emphasizing Tips for Hiring a
Service Provider, Cybersecurity Program
Best Practices, and Online Security
Tips. Here's a breakdown of these components and key
updates from the recent guidance:
1. Tips for Hiring a Service Provider
Plan sponsors and fiduciaries have a critical responsibility when selecting and monitoring service providers to ensure strong cybersecurity practices are in place. The updated DOL guidance advises fiduciaries to thoroughly vet potential providers by asking specific, detailed questions. One key area to examine is insurance coverage. Fiduciaries should be verifying that the prospective provider's insurance includes coverage for losses resulting from cybersecurity incidents.
In addition, fiduciaries should review the provider's security history and validation processes. This involves requesting records of past security incidents, recent information security audits, and any evidence of the provider's compliance with cybersecurity standards. Finally, it is essential to establish clear contractual obligations with service providers. Contracts should contain provisions addressing data confidentiality, timely breach notification, ongoing compliance monitoring, and well-defined incident response protocols.
By specifying these points, the DOL aims to provide plan fiduciaries with concrete criteria for evaluating potential third-party providers, especially those managing sensitive health and welfare data.
2. Cybersecurity Program Best Practices
Educating participants plays a crucial role in reducing cyber risks, and the DOL encourages plan sponsors to empower participants with resources that strengthen their account security. One fundamental aspect of this education involves password management and the use of multi-factor authentication (MFA). The DOL recommends that participants use longer, unique passwords and change them annually. This approach offers a balance, maintaining security without overwhelming users with frequent updates.
Sponsors should also encourage participants to enable MFA wherever possible, as this extra layer of protection makes it significantly harder for unauthorized users to gain access. Additionally, the DOL highlights the importance of cyber threat awareness. Educating employees on recognizing phishing attempts, avoiding free public Wi-Fi when accessing sensitive accounts, and keeping contact information up to date are essential to safeguard against fraud. By understanding and implementing these practices, plan participants can actively contribute to the security of their accounts.
3. Online Security Tips for Participants
The updated guidance underscores the need for a comprehensive cybersecurity framework to protect ERISA plans. A cornerstone of this approach is conducting regular cybersecurity risk assessments. By identifying potential vulnerabilities, plan sponsors and fiduciaries can better understand the specific risks to their data and implement targeted access controls to ensure that only authorized individuals can access sensitive information. Data encryption is also a vital part of the DOL's recommendations. Encrypting data both in transit and at rest adds a critical layer of defense, protecting information from unauthorized access, even if the data is intercepted or compromised.
These tips further highlight the DOL's focus on enhanced MFA. Service providers, in particular, are encouraged to implement phishing-resistant MFA, especially for systems exposed to the internet or areas containing highly sensitive data. By deploying these robust authentication methods, ERISA plan administrators can significantly reduce the risk of unauthorized access and bolster overall security. Additionally, the DOL pointed health and welfare plan sponsors to resources from the Department of Health and Human Services (HHS), including the Health Industry Cybersecurity Practices and guidelines tailored for small, medium, and large healthcare organizations.
Takeaways and Action Items for Plan Sponsors and Fiduciaries
The updated guidance reinforces the importance of cybersecurity across all ERISA-covered plans. To adhere to the DOL's expectations and mitigate cyber risks effectively, plan sponsors and fiduciaries should consider these actions:
- Evaluate Service Provider Cybersecurity: Conduct due diligence by asking for information on service providers' cybersecurity policies, audits, and breach history. Include clear cybersecurity terms in contracts and ensure vendors have applicable insurance coverage.
- Implement Robust Cybersecurity Policies: Ensure your organization's cybersecurity policies align with DOL guidelines, including regular risk assessments, strong encryption practices, and incident response planning.
- Educate Participants: Provide ongoing resources to educate plan participants on online security, focusing on best practices like strong passwords, MFA, and phishing awareness.
- Leverage HHS Resources for Health Plans: For health and welfare plans, use the HHS cybersecurity guidance to align your practices with industry-specific standards.
- Conduct a Cybersecurity Self-Audit: Consider conducting a self-audit or hiring a cybersecurity expert to assess and improve your cybersecurity practices. Health plans, in particular, should coordinate these audits with HIPAA privacy and security requirements.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
