Part 24 · Chapter 1

DOL Cybersecurity Guidance and the Fiduciary Process

Law stated as of October 3, 2026 · Benefits Cybersecurity and Data Incidents

Scope and status

This chapter covers DOL/EBSA's cybersecurity guidance for employee benefit plans and the fiduciary process it implies: the April 2021 three-document package, the September 2024 confirmation that the guidance reaches health and welfare plans, the fiduciary-duty hook and the guidance's actual authority level, committee-level governance, EBSA's cybersecurity enforcement posture and document requests, and the recordkeeping/participant-data exposures that sit alongside.

Citations are to primary authority (ERISA §§404, 107, 209, 504, 523; 29 C.F.R. §§2509.75-8, 2520.107-1, 2520.104b-31; and the named EBSA guidance documents). Authority-level discipline: DOL's cybersecurity guidance is sub-regulatory. Characterize it accurately (see A4) — the binding obligations are §404 prudence and loyalty plus the two electronic-records regulations, not the enumerated best practices. Related questions are treated elsewhere: HIPAA Security Rule obligations in Part 13 (COBRA, HIPAA, and Welfare Benefits); §404/§406 doctrine generally in Part 3 (Fiduciary Duties and Prohibited Transactions); and EBSA investigation procedure in Part 22 (Government Audits and Investigations).

Sections

Part A is shown in full. The other sections are listed by title; their text is available to subscribers.

Part A — The Guidance Package and Its Authority

A1.The April 2021 package — what issued, and how to cite it

Part 24, ch. 1, § A1

EBSA released its first cybersecurity guidance on April 14, 2021, announced by News Release No. 21-358-NAT, comprising three documents: Cybersecurity Program Best Practices (aimed at recordkeepers and other service providers, and at fiduciaries evaluating them), Tips for Hiring a Service Provider with Strong Cybersecurity Practices (aimed at plan fiduciaries), and Online Security Tips (aimed at participants). Agency guidance — informal: EBSA News Release No. 21-358-NAT (Apr. 14, 2021); the three documents themselves bear no release number and no printed date. Citation caution: there is no Compliance Assistance Release 2021-01 on cybersecurity — CAR No. 2021-01 (Jan. 12, 2021) is the Terminated Vested Participants Project audit memorandum, an unrelated document. Cite the 2021 package by document title and by the news release.

A2.Cybersecurity Program Best Practices — the twelve practices

Part 24, ch. 1, § A2

The Best Practices document enumerates twelve practices: (1) a formal, well-documented cybersecurity program; (2) prudent annual risk assessments; (3) a reliable annual third-party audit of security controls; (4) clearly defined and assigned information-security roles and responsibilities; (5) strong access-control procedures; (6) appropriate security reviews and independent security assessments for assets or data held in a cloud or managed by a third-party service provider; (7) cybersecurity awareness training conducted at least annually for all personnel and updated for risks identified in the most recent risk assessment; (8) a secure system development life cycle (SDLC) program; (9) a business resiliency program effectively addressing business continuity, disaster recovery, and incident response; (10) encryption of sensitive data stored and in transit; (11) strong technical controls implementing best security practices; and (12) responsiveness to cybersecurity incidents or breaches. Agency guidance — informal: EBSA Cybersecurity Program Best Practices. Several sub-items carry disproportionate practical weight: a senior-level CISO, with program personnel subject to initial and periodic background checks (#4); access privileges reviewed at least quarterly, MFA "wherever possible" with phishing-resistant MFA where feasible, and procedures confirming the identity of the authorized recipient of funds (#5); alerts on account-information changes and additional validation before a distribution that follows a change to personal information, additional validation for any distribution (other than a rollover) of the participant's entire account balance, plus annual penetration testing of customer-facing applications (#8); and annual testing of the resiliency program (#9).

A3.Tips for Hiring a Service Provider — the diligence and contract items

Part 24, ch. 1, § A3

The Tips document directs fiduciaries to: ask about the provider's information-security standards, practices, policies, and audit results and compare them to standards adopted by other financial and health institutions; look for a recognized information-security standard validated by an outside third-party auditor, with annual audit reports covering information security, system and data availability, processing integrity, and data confidentiality; ask how the provider validates its practices and secure contract provisions giving the right to review audit results; evaluate the provider's track record including public information on security incidents, litigation, and legal proceedings; ask about past breaches and how the provider responded; and determine whether the provider carries insurance covering cybersecurity and identity-theft losses, including internal threats (misconduct by the provider's own employees or contractors) and external threats (account hijacking). Agency guidance — informal: EBSA Tips for Hiring a Service Provider with Strong Cybersecurity Practices. On contracting, DOL says to require ongoing compliance with cybersecurity and information-security standards and to "beware contract provisions that limit the service provider's responsibility for IT security breaches," and recommends five terms: information-security reporting (annual third-party audit of compliance); clear provisions on use, sharing, and confidentiality of information (no use or disclosure without written permission, under a strong standard of care); notification of cybersecurity breaches (how quickly, plus cooperation to investigate and remediate); compliance with records-retention/destruction and privacy and information-security laws; and insurance (professional liability/E&O, cyber liability and privacy breach, and/or fidelity bond or blanket crime coverage).

A4.Authority level — sub-regulatory guidance, binding regulations elsewhere

Part 24, ch. 1, § A4

DOL frames cybersecurity as an application of ERISA's prudence and loyalty duties, not as an independent statutory duty: the Tips document is expressly framed as helping fiduciaries meet responsibilities "under ERISA to prudently select and monitor" providers, and the 2021 news release states that "ERISA requires plan fiduciaries to take appropriate precautions to mitigate these risks." Statute: ERISA §404(a)(1)(A)-(B), 29 U.S.C. §1104(a)(1)(A)-(B); Agency guidance — formal: interpretive bulletin, 29 C.F.R. §2509.75-8, FR-17 (duty to monitor appointees at reasonable intervals); Case law: Supreme Court — Tibble v. Edison Int'l, 575 U.S. 523 (2015) (continuing duty to monitor). There is no regulation imposing cybersecurity requirements on ERISA plans as such. The three documents were not published in the Federal Register, carry no preamble, are not codified in the CFR, and are entitled at most to Skidmore weight. DOL does point to two binding regulations its guidance "complements": 29 C.F.R. §2520.107-1 (electronic recordkeeping for §§107/209 records — requiring "reasonable controls to ensure the integrity, accuracy, authenticity and reliability of the records" at (b)(1), a safe and accessible place at (b)(2), and adequate records-management practices at (b)(5)), and 29 C.F.R. §2520.104b-31(e)(3) (the 2020 electronic-disclosure safe harbor — the administrator must take measures reasonably calculated to ensure the website protects the confidentiality of personal information) and (k)(4)(i) (the parallel confidentiality condition for the email-delivery alternative). Final reg: 29 C.F.R. §§2520.107-1, 2520.104b-31.

The first Part of each chapter is open to everyone. The remaining sections, with their authority and practice points, are available to subscribers and to clients of ERISA Benefits Law Group, PLLC whose engagement includes access.