Cybersecurity belongs inside the prudence duty you already have, and a written file shows it.

EBSA ties its cybersecurity guidance to existing ERISA duties. This page explains section 404(a), who is a fiduciary and what a useful record looks like.

Talk To Us About This

What Section 404(a) Says.

ERISA section 404(a)(1), 29 U.S.C. 1104(a)(1), requires a fiduciary to discharge duties solely in the interest of participants and beneficiaries, for the exclusive purpose of providing benefits and defraying reasonable plan expenses. It also sets the prudence standard: acting with the care, skill, prudence and diligence under the circumstances then prevailing that a prudent person acting in a like capacity and familiar with such matters would use.

Under ERISA section 3(21)(A), 29 U.S.C. 1002(21)(A), a person is a fiduciary to the extent that person exercises discretionary authority or control over plan management or assets, or has discretionary authority or responsibility in plan administration, among other roles. For many employers, the plan sponsor or its committee fills that role for choosing and overseeing the plan’s vendors.

A File Worth Keeping.

What follows is our practice suggestion, not a Department requirement. Keep a dated copy of each written security request you send a carrier or administrator, and the answers you received. Keep the audit reports or summaries they provide, and the contract clauses on confidentiality, breach notification and insurance.

Note who reviewed the material and any follow-up. Add a yearly entry to your compliance calendar, and record any incident notice you receive and what you did next. The statute asks what a prudent person would do under the circumstances then prevailing, so a dated record shows what you knew and when.

Related Rules And Tools.

The Rest Of This Series.