New report exposes retirement plan cybersecurity risks

Your company’s retirement plan poses serious cybersecurity risks.

So says the Government Accountability Office (GAO). It just released a new report on defined contribution plans.

First, think of all the sensitive info needed for a 401(k). Then that data travels between the employee, your company, the plan itself. And often a third party gets involved. Which makes retirement plans a massive vulnerability.

Now the Feds want your company, as a plan sponsor, to take steps to better protect that info.

So many chances to expose data

As a result, the GAO has asked the Department of Labor (DOL) to do two things:

• Clarify that cybersecurity is a fiduciary responsibility of private employers under ERISA, and
• Develop and issue guidance identifying minimum expectations to mitigate retirement plan cybersecurity risks.

Resourceful Finance Pro will keep you posted on the DOL’s response.

Keeping cybersecurity risks top-of-mind

But no matter what the DOL decides to do — or when it decides to do it — your company will want to keep cybersecurity a priority.

And, little surprise, IRS has some thoughts on the matter.

IR-2018-150: Tax Security 101 ­– Security Summit outlines “Security Six” must-have protections for solid cybersecurity:

1. anti-virus software
2. firewalls
3. two-factor authentication
4. backup software/services
5. drive encryption, and
6. a data security plan.

Jennifer Azara

Jennifer has covered business and finance for more than 24 years. She has written for CFOs, credit and collections professionals and accounts payable practitioners and has spoken at industry conferences on sales and use tax compliance.