Cybersecurity can seem overwhelming for plan sponsors. Data breaches, phishing attacks, ransomware, account takeovers\u2014the list of threats keeps growing. It\u2019s easy to assume protecting a retirement plan requires expensive software, outside consultants, and a six-figure technology budget.<\/p>\n
It doesn\u2019t.<\/p>\n
One of the simplest and least expensive cybersecurity decisions you can make is requiring multi-factor authentication (MFA).<\/p>\n
Think about what\u2019s sitting in your retirement plan. Social Security numbers, dates of birth, payroll information, beneficiary designations, and participant account balances. To a cybercriminal, that\u2019s a treasure chest.<\/p>\n
For years, a username and password were considered enough. They aren\u2019t anymore. Passwords are stolen every day through phishing emails, data breaches, and reused credentials from other websites. Once someone has your password, they\u2019re halfway through the front door.<\/p>\n
MFA adds another lock.<\/p>\n
Whether it\u2019s a text message, an authentication app, or a biometric scan, that second step makes it dramatically harder for someone to gain unauthorized access. Is it foolproof? No. But it is one of the most effective ways to reduce the risk of account compromise.<\/p>\n
The Department of Labor has repeatedly emphasized cybersecurity as part of a fiduciary\u2019s responsibility. While ERISA doesn\u2019t specifically require multi-factor authentication, ignoring readily available security measures becomes increasingly difficult to justify as industry standards evolve.<\/p>\n
The good news is that most recordkeepers already offer MFA for plan sponsors and participants. The challenge isn\u2019t availability\u2014it\u2019s making sure everyone actually uses it.<\/p>\n
If you\u2019re a plan sponsor, ask your recordkeeper whether MFA is available, whether it\u2019s mandatory, and what percentage of participants have enabled it. If the answer is \u201cI don\u2019t know,\u201d that\u2019s a conversation worth having.<\/p>\n
Sometimes fiduciary decisions involve complicated legal analysis or difficult business judgment.<\/p>\n
This isn\u2019t one of them.<\/p>\n
Turning on multi-factor authentication may take only a few minutes, cost little or nothing, and significantly reduce the risk of a cybersecurity incident.<\/p>\n
For a fiduciary, that\u2019s about as easy a decision as you\u2019ll ever make.<\/p>\n
<\/span><\/p>","protected":false},"excerpt":{"rendered":" Cybersecurity can seem overwhelming for plan sponsors. Data breaches, phishing attacks, ransomware, account takeovers\u2014the list of threats keeps growing. It\u2019s easy to assume protecting a retirement plan requires expensive software, outside consultants, and a six-figure technology budget. It doesn\u2019t. One … Continue reading