Two cases he presented make clear why cybersecurity should be on every plan sponsor's radar:

In Barnett v. Abbott Laboratories, a cyber thief was able to impersonate a plan participant and request and obtain a sum from that person's account. The participant had signed up for phone and email notifications of such requests, but the recordkeeper instead sent a notification via postal mail. By the time the participant received it, the money had been transferred to overseas banks where it couldn't be retrieved. The participant sued the plan sponsor and the recordkeeper.
In Leventhal v. MandMarblestone, a cyberthief obtained a copy of the participant's application for a previous withdrawal, modified it, and sent it to the plan provider as if it had come from the plan sponsor. The money was transferred to a bank, then transferred overseas before it could be stopped. The plan sponsor sued the provider, but in an interesting—and significant—twist, the plan provider counter-sued the plan sponsor, arguing that the plan sponsor's "carelessness" with respect to its employees and computer policies enabled less stringent security policies, which made the theft possible.

One of a plan sponsor's responsibilities is looking at cybersecurity procedures of the plan's providers, Reish said. Although the DOL would likely start enforcement actions with the largest companies, he said, every business should incorporate the recent DOL cyber guidance for fiduciaries, providers, and participants now. Among other actions, plan sponsors should:

Take the participant guidance and distribute it to plan participants. Then redistribute it annually.
Make sure all retirement plan committee members have copies of the guidance and go over it, making sure the meeting minutes include that conversation.
Consider possibly using the guidance to modify requests for proposals (RFPs) for recordkeepers.

Instant Insights /

New DOL Guidance Addresses Responsibilities of Retirement Plan Sponsors

Related Stories

Recommended For You