Part 24 · Chapter 3

Service-Provider Cyber Diligence, Contracts, and Insurance

Law stated as of October 3, 2026 · Benefits Cybersecurity and Data Incidents

Scope and status

This chapter covers the three levers a plan fiduciary actually controls on benefit-plan cyber risk: diligence on service providers, contractual allocation of security obligations and loss, and the insurance and bonding stack. It also identifies the external security frameworks against which a recordkeeper or TPA is realistically measured.

Citations are to primary authority (ERISA §§404, 408(b)(2), 410, 412; 29 C.F.R. §§2550.408b-2, 2580; 17 C.F.R. §248.30; 16 C.F.R. Part 314; and the named agency guidance). For §408(b)(2) fee-disclosure substance and the general prudence framework, see Part 3 (Fiduciary Duties and Prohibited Transactions); see Part 13 (COBRA, HIPAA, and Welfare Benefits) for health-plan business associate agreements; see this Part's DOL-guidance chapter for the DOL guidance itself.

Sections

The opening sections of Part A are shown in full. The other sections are listed by title; their text is available to subscribers.

Part A — Diligence

A1.The diligence duty and its source

Part 24, ch. 3, § A1

Service-provider cyber diligence is an application of the prudence standard and the continuing duty to monitor, not a freestanding requirement. Statute: ERISA §404(a)(1)(A)-(B); §408(b)(2); Final reg: 29 C.F.R. §2550.408b-2; Agency guidance — formal: interpretive bulletin, 29 C.F.R. §2509.75-8 (FR-17); Case law: Supreme Court — Tibble v. Edison Int'l, 575 U.S. 523 (2015). DOL's Tips for Hiring a Service Provider with Strong Cybersecurity Practices supplies the operative checklist (enumerated in this Part's DOL-guidance chapter, unit A3). Agency guidance — informal.

A2.What to actually collect

Part 24, ch. 3, § A2

A defensible diligence package contains: the provider's current third-party audit report (SOC 2 Type II is the market standard) with the bridge letter covering any gap since the report period, and the fiduciary's documented review of the exceptions and management responses; the provider's information-security policy set; the most recent risk assessment and penetration-test chapter; the provider's incident history and its description of how each incident was handled; the provider's insurance certificates (cyber/privacy, professional liability/E&O, and fidelity/crime), confirming that plan-related incidents and both internal and external threats are covered; documentation of any security framework the provider claims (A5); the provider's subcontractor and cloud arrangements with corresponding assessments; and the provider's data-handling and data-use policies (collection, storage, deletion, anonymization, sharing, and any marketing or cross-selling use). Agency guidance — informal: EBSA Tips and Best Practices #3, #6; Practitioner consensus.

A3.Reviewing the SOC 2 rather than collecting it

Part 24, ch. 3, § A3

Obtaining the report is not the diligence; reading it is. The committee record should reflect who reviewed the report, which trust-services criteria it covered, whether the opinion was qualified, what exceptions were noted, whether management's responses were adequate, and whether the report's scope actually covers the systems that hold this plan's data. Practitioner consensus.

A4Ongoing monitoringSubscribers
A5The frameworks a provider is measured againstSubscribers

Part B — Contract Allocation

B1DOL's contract expectationsSubscribers
B2The terms that decide who paysSubscribers
B3Health plans — the BAA is a separate instrumentSubscribers

Part C — Insurance and Bonding

C1The §412 fidelity bond — what it does and does not coverSubscribers
C2Fiduciary liability insuranceSubscribers
C3Cyber and crime coverage — where the recovery actually isSubscribers
C4Mapping the stack before an incidentSubscribers

The first Part of each chapter is open to everyone. The remaining sections, with their authority and practice points, are available to subscribers and to clients of ERISA Benefits Law Group, PLLC whose engagement includes access.