Protecting Retirement Assets from Cyber Threats

Posted on Apr 10, 2024

Cybersecurity is critically important for retirement accounts due to the substantial financial resources and sensitive personal data they contain. Retirement accounts like 401(k)s and pension plans represent a significant portion of an individual's financial wealth, accumulated over their working years. These accounts also store critical personal information such as Social Security numbers, employment information, and banking details. The combination of these assets and data creates a highly attractive target for cybercriminals, who can cause considerable financial damage and compromise the future security of retirees.

Guidelines released by the U.S. Department of Labor (DOL) outline best practices for plan participants, plan sponsors, recordkeepers, and plan fiduciaries to deter cyber thieves. Highlights include the following:

• Have a formal, well-documented cybersecurity program.
• Conduct prudent annual risk assessments.
• Have a reliable annual third-party audit of security controls.
• Clearly define and assign information security roles and responsibilities.
• Have strong access control procedures.
• Ensure that any assets or data stored in a cloud or managed by a third-party service provider are subject to appropriate security reviews and independent security assessments.
• Conduct periodic cybersecurity awareness training.
• Implement and manage a secure system development life cycle (SDLC) program.
• Have an effective business resiliency program addressing business continuity, disaster recovery, and incident response.
• Encrypt sensitive data, stored and in transit.
• Implement strong technical controls in accordance with best security practices.
• Appropriately respond to any past cybersecurity incidents.

Safeguarding retirement accounts from cyber threats demands vigilance and proactive measures. Organizations can help deter thieves by implementing robust security protocols, encouraging plan participants to regularly monitor account activity, and staying informed about emerging threats. Remember, the best defense against cyber threats combines awareness, preparation, and timely action.

This material is provided for informational purposes only, and is not intended as authoritative guidance, legal advice, or assurance of compliance with state and federal regulations.