Cybersecurity: it’s another area businesses are spending more and more on. And yep, Department of Labor regulations mean you can get audited on it.
It’s no surprise the government wants to take cybersecurity more seriously. The average data breach costs more than $4 million, and the figure is only rising. Indirect costs alone—like loss of reputation—can tank your business.
In April of 2021, the DOL issued new Cybersecurity Program Best Practices for plan sponsors, plan fiduciaries, record-keepers, and plan participants. With 12 key requirements, they represent a major overhaul of your responsibilities.
If you are already making cybersecurity investments, some areas of the DOL guidance might be accounted for in your current strategy.
For example, item #1 calls for a “formal, well-documented cybersecurity program.” #2 requires you to “conduct prudent annual risk assessments,” something your top security stakeholder should be doing.
New complications come in with point #3: “Have a reliable annual third party audit of security controls.” DOL has already stepped up its audit activity, and having a third-party audit report to present may help you avoid selection.
Going forward, retirement plan audits will also examine compliance with cybersecurity guidelines.
When working under an audit, plan sponsors must be prepared to produce “all documents relating to any cybersecurity or information security programs that apply to the data of the Plan, whether those programs are applied by the sponsor of the Plan or by any service provider of the Plan.”
That includes items such as policies, procedures, and guidelines around:
To start reviewing your compliance, see the Employee Benefits Security Administration’s Cybersecurity Program Best Practices.
For more information on keeping your 401(k) plan in compliance with all the latest regulations, contact Cassell Plan Audits.
Leave a Reply