When I started in this business, plan sponsors worried about lost checks. Now, they should be worried about lost data. Back then, if a participant\u2019s address was wrong, you mailed a letter and hoped for the best. Today, if a hacker gets your payroll feed, you\u2019re not mailing letters\u2014you\u2019re calling your cyber insurer and your lawyer.<\/p>\n
ERISA\u2019s Section 404 talks about acting prudently and solely in the interest of participants. That used to mean watching fees, monitoring investments, and keeping minutes. But in 2025, prudence means locking down your participant data like it\u2019s Fort Knox. Every Social Security number, every date of birth, every account balance\u2014those are plan assets in digital form.<\/p>\n
The Department of Labor isn\u2019t subtle about it anymore. Cybersecurity is a fiduciary issue. If your TPA or recordkeeper treats data protection like an afterthought, that\u2019s your problem too. Because if participant data gets breached, no one\u2019s pointing fingers at the IT guy\u2014they\u2019re pointing them at you, the plan sponsor.<\/p>\n
So, ask questions. Demand documentation of your providers\u2019 security protocols. Review your internal controls. Don\u2019t let an intern email participant data unencrypted. You wouldn\u2019t leave plan assets in a shoebox under your desk, so don\u2019t leave sensitive data floating around in Outlook.<\/p>\n
Fiduciary prudence used to mean \u201cprotecting the money.\u201d Now it also means protecting the information about the money. Data is the new 404\u2014and unlike plan assets, once it\u2019s leaked, you can\u2019t roll it back into the trust.<\/p>\n
<\/span><\/p>","protected":false},"excerpt":{"rendered":" When I started in this business, plan sponsors worried about lost checks. Now, they should be worried about lost data. Back then, if a participant\u2019s address was wrong, you mailed a letter and hoped for the best. Today, if a … Continue reading