Has your organization put a cybersecurity plan into place as remote work and hybrid options have changed the way we do business? It is critical to be prepared as cybercrime becomes more sophisticated, creating legitimate looking forms of communication that have the potential to break through the barriers of your firewalls. You should be aware that malware and phishing attacks are on the rise.
Employee benefit plans have strict compliance rules and are becoming an ever-growing target for cybercrime as they contain a significant amount of sensitive participant data. In 2021 alone, cybercrime has cost businesses across the United States over $7 billion. According to the Employee Benefits Security Administration (“ESBA”), in 2018, there were an estimated 34 million defined benefit plan participants and 106 million defined contribution participants, producing an estimate of over $9.3 trillion in assets. That’s a big gamble when it comes to dealing with the potential risks posed by cybercrime and the importance of protecting your participants’ personal information and assets.
Don’t think it can’t happen to you? Here are a few examples of how employee benefit plans can be impacted by cybercrimes including ransom attacks:
- Impact the ability to pay out pension checks and health claims in a timely fashion
- Result in loss of critical data
- Open the door to employee identity theft
- Cause a loss of employee confidence and brand damage
When it comes to your data, luckily there has been a lot of discussion in recent months regarding the importance of insurance against loss along with training for employees throughout all levels of your organization. The Department of Labor’s ERISA Advisory Council (EAC) even deemed “cybersecurity insurance and employee benefit plans” to be one of their most crucial topics during their May 2022 meeting.
Within the last year, the Department of Labor (“DOL”), through its Employee Benefits Security Administration (“EBSA”), has released guidance regarding the duty that Plan Sponsors have in ensuring that participant data is protected.
Suggested best practices include:
- Having a formal, well documented cybersecurity program
- Conducting annual risk assessments
- Conducting a reliable, third-party audit of security controls
- Defining and assigning information security roles and responsibilities to employees
- Following strong access control procedures
- Ensuring assets and data are subject to security reviews and assessments and is stored in a Cloud or managed by a third-party service provider
- Conducting periodic cybersecurity awareness training
- Implementing and managing a secure system development life cycle (SDLC) program
- Having an effective business resiliency program addressing business continuity, disaster recovery, and incident response
- Encrypting sensitive information both stored and in transit
- Implementing strong technical controls following best practices
- Responding to any past cybersecurity incidents
In line with the new guidance, it’s been emphasized that a significant part of the Plan Sponsor’s duty is in the safeguarding of assets. Now is the time to start treating participant data as a key asset within your organization. As you move forward in enhancing your cybersecurity practices and start to assess your organization’s risks, it is recommended to turn to the DOL’s recent guidance and consult with service providers.
If you have any questions, please don’t hesitate to email us.
