Twelve practices describe what a well-run security program looks like at a plan vendor.
EBSA lists twelve cybersecurity program best practices. Here is each one in plain English, and how an employer with a group health plan can use the list.
Where This Page Fits.
General information, not legal advice. The practices come from the Department of Labor page cited below.
EBSA Cybersecurity Guidance for Health and Welfare Plans
The overview: what the guidance is and how employers can use it.
Hiring a Service Provider
Questions and contract terms for choosing a provider with strong security.
Fiduciary Duty and Documentation
How prudence under section 404(a) connects to a written file.
Who Owns Security, And How They Prove It.
A formal program. The vendor keeps a documented cybersecurity program with approved, regularly reviewed policies covering areas such as access, incident response, encryption and training.
Annual risk assessments. Risks are identified, ranked and written down every year, and updated as systems and operations change.
An annual third-party audit. An independent party tests the security controls, including penetration testing, and the vendor documents how it fixed any weaknesses.
Clear roles. Security responsibility is assigned, senior executives oversee it, and the staff are qualified, trained and background-checked.
Access, Training And Outside Parties.
Access controls. Access follows role and need, privileges are reviewed at least quarterly, passwords are unique and strong, multi-factor authentication is required (the page prefers phishing-resistant forms), activity is monitored, and the vendor verifies who participants are and where money is going.
Cloud and vendor oversight. The vendor assesses its own cloud and third-party providers before hiring them and periodically afterward, sets minimum standards, and writes access, encryption and breach-notification terms into contracts.
Training. All personnel receive security awareness training at least annually, updated for current risks, with attention to identity theft and impersonation of plan officials, fiduciaries, participants or beneficiaries.
How Systems Are Built And Protected.
Secure development. Security is built into system development through code review and testing, alerts when account information changes, extra validation before distributions, regular vulnerability scans and annual penetration tests.
Encryption. Sensitive data is encrypted both when stored and when sent, using current, prudent standards.
Technical controls. Hardware and software stay updated and vendor-supported, with firewalls, intrusion detection and prevention, current antivirus, routine patching, network segmentation, system hardening and regular automated backups.
When Something Goes Wrong.
Business resiliency. The vendor keeps business continuity, disaster recovery and incident response plans that define roles, communications and remediation, and tests them annually.
Incident response. After a breach the vendor notifies law enforcement and its insurer, investigates, tells affected participants without unreasonable delay, gives them information to reduce harm, meets contractual and legal obligations and fixes the root problems.
Reading The List For A Health Plan.
EBSA says the practices are written for recordkeepers and other service providers that run plan systems and data, and for fiduciaries choosing among them. For a group health plan, ask your carrier, administrator and pharmacy benefit manager how they meet them and whether an independent audit backs the answer. The practices are a benchmark for the conversation. They are not a certification, and the Department does not say a vendor must meet each one.
Related Rules And Tools.
Selecting and Monitoring Health Plan Service Providers
How a fiduciary chooses and reviews the carriers and administrators that run a health plan.
HIPAA for Employers
The separate federal privacy and security rules that apply to health plan information.
PBM Fee Disclosure Proposed Rule (ERISA Section 408(b)(2))
A proposed rule on what pharmacy benefit managers would have to disclose to plan fiduciaries.
Laws And Sources
DOL, Cybersecurity Program Best Practices: EBSA page listing the twelve best practices and who they are written for.
DOL, Compliance Assistance Release No. 2024-01: The September 6, 2024 release stating that the guidance applies to all types of ERISA plans, including health and welfare plans.
General information, not legal or tax advice.
Quick Answers.
Short replies on this page’s topic, each tied to a fuller guide.
Who are the twelve best practices written for?
EBSA says they are written for recordkeepers and other service providers that run plan-related IT systems and data, and are also intended for fiduciaries who choose those providers.
Does a vendor have to meet all twelve?
The Department of Labor page presents them as best practices. It does not say a vendor must meet each one. They work as a yardstick when you compare or review providers.
Which practice is easiest for an employer to check?
Ask for the date of the vendor’s latest independent security audit and for its breach-notification terms. Both are practices on EBSA’s list and both can be requested in writing.
The Rest Of This Series.
What EBSA Cybersecurity Guidance Covers
The 2021 release, the 2024 clarification and what it means for health plans.
Hiring a Service Provider
Questions and contract terms for choosing a provider with strong security.
Online Security Tips for Participants
Account habits employees can adopt today.
Fiduciary Duty and Documentation
How prudence under section 404(a) connects to a written file.
An independent employee benefits consulting firm. We look at the entire benefits program — cost, plan performance, risk and administration.
Switch to CFH. Unhappy with your broker? Your employees won’t notice. You will. →
Cookies on This Site
We use cookies to keep the site working properly and to understand how it is used. You can decline anything that is not essential. See our Privacy Policy for the detail.
- Essential — needed for the site to load and for you to move around it. These cannot be switched off.
- Analytics — tell us which pages get read, so we know what is worth writing more of.
- Advertising — set by third parties such as ad and social platforms to measure and target campaigns.