--- title: Cybersecurity Best Practices for Plan Sponsors description: Follow these steps to implement cybersecurity practices for your company. image: https://www.oakbourne.com/hubfs/cybersecurity%20image.jpeg --- [![Oakbourne Advisors logo](https://www.oakbourne.com/hubfs/logos/OakbourneAdvisors_Logo-v1.svg "Oakbourne Advisors logo")](https://oakbourne.com) [![oakbourne Logo](https://www.oakbourne.com/hs-fs/hubfs/raw_assets/public/oakbourne-theme/images/mobile-logo-oakbourne.png?width=36&height=39&name=mobile-logo-oakbourne.png "oakbourne Logo")](https://oakbourne.com) [Contact Us](https://www.oakbourne.com/contact) [401(K) Plan Benchmarker](https://www.oakbourne.com/checkmyplan) - [About](https://www.oakbourne.com/about-us) - Services Services - [Retirement Plan Consulting](https://www.oakbourne.com/retirement-consulting) - [Private Wealth](https://www.oakbourne.com/private-wealth-management) - Client Access [Client Access](https://www.oakbourne.com/client-access) - [TD Ameritrade](https://www.advisorclient.com/login) - [SEI](https://www.accessmyportfolio.com/) - [Private Client Portal](https://login.bdreporting.com/Auth/NSAM/SignIn) - [Financial Plan](https://www.rightcapital.com/login?cobrand=t624d4kUxMP0KbIPgfuNXg&type=client) - [Blog](https://www.oakbourne.com/401kbulletin) ###### [cybersecurity](https://www.oakbourne.com/401kbulletin/tag/cybersecurity) ###### [401k](https://www.oakbourne.com/401kbulletin/tag/401k) # Cybersecurity Best Practices for Plan Sponsors By Oakbourne Advisors ![TimeIcon](https://23722879.fs1.hubspotusercontent-na1.net/hubfs/23722879/Icons/clock-icon-white.png) 2min ![DateIcon](https://23722879.fs1.hubspotusercontent-na1.net/hubfs/23722879/Icons/calendar-icon-white.png) Jun 28, 2022 SHARE - - - [mailto:?subject=Check%20out%20https://www.oakbourne.com/401kbulletin/cybersecurity-best-practices-for-plan-sponsors&body=Check%20out%20https://www.oakbourne.com/401kbulletin/cybersecurity-best-practices-for-plan-sponsors&media=https://www.oakbourne.com/hubfs/cybersecurity%20image.jpeg](mailto:?subject=Check%20out%20https://www.oakbourne.com/401kbulletin/cybersecurity-best-practices-for-plan-sponsors&body=Check%20out%20https://www.oakbourne.com/401kbulletin/cybersecurity-best-practices-for-plan-sponsors&media=https://www.oakbourne.com/hubfs/cybersecurity%20image.jpeg) - - Participant data and financial accounts comprise some of the most sensitive and potentially vulnerable information under a company’s care. These highly valuable assets can be an attractive target for cybercriminals and therefore present considerable security risk. Breaches to this information can be devastating to plan participants and to the reputation of the organization. For plan sponsors, ensuring protections around participant data and investment assets is a key fiduciary responsibility. In fact, as law firm Hodgson Russ noted recently, “The causation standard under Section 409(a) of ERISA is an issue that could lead to more litigation as cyberattacks on employee benefit plans increase.” The provision states that plan fiduciaries who breach their fiduciary responsibilities are personally liable for any losses that result from the breach. The law firm continues: “Outside of the ERISA context, however, courts have looked at similar questions … \[and\] found that proximate cause was sufficiently alleged when a complaint contended that the defendant’s failure to establish industry-standard information security safeguards was the proximate cause of the stolen personal information.” Sponsors should consider their potential exposure under Section 409(a), in the event of a failure to adhere to a prudent process for mitigating risk (upholding the higher prudent man standard). Earlier this year, the U.S. Department of Labor (DOL) issued guidance aimed at plan sponsors, plan fiduciaries, recordkeepers and plan participants, offering best practices for maintaining cybersecurity. The guidance is structured along three main areas of focus: service provider selection, establishment of a cybersecurity program and participant protection. Hiring a Provider Per the DOL, plan sponsors should perform a series of due diligence checks prior to engaging a provider. The department’s advice includes inquiring about the provider’s information security standards, practices and policies, and audit results, as well as comparing them to the industry standards adopted by other financial institutions. The DOL also recommends examining the provider’s track record in the industry — including a public records search of information security incidents and litigation related to its services — and asking about the level of security it has met and implemented, how it has responded to past security breaches and whether it carries insurance that would cover losses due to a cybersecurity incident.   Implementing a Cybersecurity Program For establishing and maintaining an effective program, the DOL points to best practices prepared by the Employee Benefits Security Administration (EBSA). The agency’s advice includes having strong access control procedures as well as an effective business resiliency program addressing business continuity, disaster recovery and incident response. It also recommends conducting periodical cybersecurity awareness training and an annual third-party assessment of security controls. Participant Cyber-safety Because participants and beneficiaries can fall directly within cybercriminals’ attack vector, DOL’s guidance also offers tips aimed at helping retirement account holders reduce the risk of fraud and loss. For example, the DOL advises that participants routinely monitor their online account, create strong passwords, and use multi-factor authentication. Other recommended precautions include signing up for account activity notifications and exercising caution with regard to use of free, publicly available Wi-Fi networks. Defending Against Cyberthreats Cybersecurity breaches have become increasingly prevalent in the modern world and have added another layer of complexity for plan sponsors. Given the current regulatory and legal climate, it's more important than ever to stay abreast of changes in a dynamic risk landscape — and partner with an advisor and service providers who can help mitigate the risks and keep plan participants’ data and assets safe from cyberthreats. To view the full DOL guidance, visit the department’s website \[[https://www.dol.gov/agencies/ebsa/key-topics/retirement-benefits/cybersecurity](https://www.dol.gov/agencies/ebsa/key-topics/retirement-benefits/cybersecurity)\] Sources [https://www.jdsupra.com/legalnews/causation-under-erisa-in-a-4086713/](https://www.jdsupra.com/legalnews/causation-under-erisa-in-a-4086713/) [https://www.dol.gov/agencies/ebsa/key-topics/retirement-benefits/cybersecurity](https://www.dol.gov/agencies/ebsa/key-topics/retirement-benefits/cybersecurity)   ![Email Icon](https://f.hubspotusercontent10.net/hubfs/1781314/Email%20Icon.svg) ### Subscribe to Our Blog ## Related Posts [![](https://www.oakbourne.com/hs-fs/hubfs/ready.jpg?width=900&name=ready.jpg)](https://www.oakbourne.com/401kbulletin/retirement-readiness) ###### [401k](https://www.oakbourne.com/401kbulletin/tag/401k) ###### [retirement](https://www.oakbourne.com/401kbulletin/tag/retirement) ###### [participant](https://www.oakbourne.com/401kbulletin/tag/participant) ###### [behavioral finance](https://www.oakbourne.com/401kbulletin/tag/behavioral-finance) ###### [fiduciary](https://www.oakbourne.com/401kbulletin/tag/fiduciary) ###### [401k plan](https://www.oakbourne.com/401kbulletin/tag/401k-plan) ##### [Retirement Readiness: How will you prepa...](https://www.oakbourne.com/401kbulletin/retirement-readiness) Dec 7, 2022 2min Much has been made of the current state of the American worker as it pertains ... [READ MORE](https://www.oakbourne.com/401kbulletin/retirement-readiness) [![Retirement Readiness: Cybersecurity Must Be a Priority for Plan Fiduciaries](https://www.oakbourne.com/hs-fs/hubfs/cybersecurity.jpeg?width=900&name=cybersecurity.jpeg)](https://www.oakbourne.com/401kbulletin/retirement-readiness-cybersecurity-must-be-a-priority-for-plan-fiduciaries) ###### [cybersecurity](https://www.oakbourne.com/401kbulletin/tag/cybersecurity) ###### [cyber security](https://www.oakbourne.com/401kbulletin/tag/cyber-security) ###### [plan sponsors](https://www.oakbourne.com/401kbulletin/tag/plan-sponsors) ###### [advisor](https://www.oakbourne.com/401kbulletin/tag/advisor) ###### [401k plan](https://www.oakbourne.com/401kbulletin/tag/401k-plan) ##### [Retirement Readiness: Cybersecurity Must...](https://www.oakbourne.com/401kbulletin/retirement-readiness-cybersecurity-must-be-a-priority-for-plan-fiduciaries) Dec 30, 2022 2min Most 401(k) plans have access to a large pool of funds, making them an attract... [READ MORE](https://www.oakbourne.com/401kbulletin/retirement-readiness-cybersecurity-must-be-a-priority-for-plan-fiduciaries) [![](https://www.oakbourne.com/hs-fs/hubfs/gift%20budget.jpeg?width=900&name=gift%20budget.jpeg)](https://www.oakbourne.com/401kbulletin/holiday-budget) ###### [401k](https://www.oakbourne.com/401kbulletin/tag/401k) ###### [participant](https://www.oakbourne.com/401kbulletin/tag/participant) ###### [behavioral finance](https://www.oakbourne.com/401kbulletin/tag/behavioral-finance) ##### [Participant Corner: Carving A Holiday Bu...](https://www.oakbourne.com/401kbulletin/holiday-budget) Oct 4, 2022 1min The holidays are a time for giving, but often people can be a little overgener... [READ MORE](https://www.oakbourne.com/401kbulletin/holiday-budget) [![Oakbourne Advisors logo](https://www.oakbourne.com/hubfs/logos/OakbourneAdvisors_Logo-v1.svg "Oakbourne Advisors logo")](https://oakbourne.com) Oakbourne Advisors is an independent investment consulting firm providing customized solutions for families, business owners and 401(k) plan sponsors. Berkeley Heights 908-850-9991 Oakbourne Advisors 200 Connell Drive Suite 1000 Berkeley Heights, NJ 07922 West Chester 610-798-6641 Oakbourne Advisors 121 North Walnut Street Suite 320 West Chester, PA 19380 Follow us Copyright © 2026 Oakbourne Advisors - [Privacy policy](https://www.oakbourne.com/privacy-policy) - [Designation Disclosures](https://www.oakbourne.com/designation-disclosures) - [Form CRS](https://www.oakbourne.com/hubfs/Form%20ADV%20Part%203%20%E2%80%93%20Client%20Relationship%20Summary-1.pdf) - [Form ADV](https://www.oakbourne.com/hubfs/20230323%20ADV%20Part%202A%20-%20Oakbourne%20Advisors.pdf) ```json { "@context" : "http://schema.org", "@type" : "Organization", "address" : { "@type" : "PostalAddress", "addressCountry" : "", "addressLocality" : "Berkeley Heights, NJ", "addressRegion" : "NJ", "postalCode" : "07922", "streetAddress" : "200 Connell Drive Suite 1000" }, "alternateName" : "Oakbourne", "areaServed" : { "@type" : "GeoCircle", "geoMidpoint" : { "@type" : "GeoCoordinates", "latitude" : "40.905151", "longitude" : "-74.822510" }, "geoRadius" : "150 km" }, "description" : "Oakbourne Advisors provides businesses like yours comprehensive retirement planning that meets your objectives, supports employee engagement, and eases related administrative obligations.", "email" : "investors@oakbourne.com", "image" : "https://f.hubspotusercontent30.net/hubfs/20929034/OakbourneAdvisors_OG-Image-v1.png", "logo" : "https://f.hubspotusercontent30.net/hubfs/20929034/logos/OakbourneAdvisors_Logo-v1.svg", "mainEntityOfPage" : { "@id" : "https://www.oakbourne.com/401kbulletin/cybersecurity-best-practices-for-plan-sponsors", "@type" : "WebPage", "description" : "Follow these steps to implement cybersecurity practices for your company. " }, "naics" : "523930", "name" : "Oakbourne Advisors", "sameAs" : [ "https://www.linkedin.com/company/oakbourne-advisors" ], "telephone" : "", "url" : "https://www.oakbourne.com/" } ```