With cybersecurity now a crucial issue in the retirement industry, some plan sponsors are turning to external firms to help prevent the next cyberattack.
"There's definitely a lot more attention on cybersecurity," said Robert R. Gower, director at Trucker Huss, a law firm focused on employee benefits law.
And for large plans with more than $1 billion in assets, Gower said there's been a "slow uptick" in the use of external cybersecurity firms.
Read more stories from P&I's Top 1,000 retirement plans survey on Feb. 12.
According to data collected from Pensions & Investments' survey of the 200 largest retirement plans, 12 public retirement funds disclosed they use an external cybersecurity vendor for their defined benefit plans, while four disclosed they use a vendor for their defined contribution plans. Though cybersecurity firms offer a variety of services, the retirement plans that use them often do so to supplement their own cybersecurity programs, sources said.
External firms can help "with the development, the implementation, (and) the maintenance of all the security programs that (plans) have," said Hank Kim, executive director and counsel for the National Conference on Public Employee Retirement Systems.
Specifically, many plans seek out "third-party 360 cybersecurity reviews," where a firm will conduct a review of both the plan's cybersecurity policies and procedures, and ensure that such policies are being followed by the plan's vendors, which can include their record keeper, custodian, managed account provider and investment consultant, Gower said. When looking over a plan's cybersecurity framework, those firms often utilize guidance from the Labor Department's Employee Benefits Security Administration, which issued cybersecurity guidance in April 2021.
The DOL guidance includes online security tips for plan participants, tips to help plan fiduciaries select a service provider, and best practices for fiduciaries and record keepers to manage cybersecurity risks. Such practices include having a formal, well-documented cybersecurity program; conducting prudent annual risk assessments; and obtaining a reliable third-party annual audit of security controls, among others.
EBSA oversees retirement plans that are governed by ERISA, which includes most private employer plans.
Tenable, a cybersecurity firm that provides services to the $63.3 billion Maryland State Retirement & Pension System, Baltimore, is focused on exposure management — helping organizations identify, understand and address the cyber-risks they face.
Since retirement systems rely heavily on technology, "the key to safeguarding these systems is in taking proactive action to understand where potential weaknesses lie in the technology environment and secure these issues before a criminal actor has a chance to exploit it," said Nathan Wenzler, chief security strategist at Tenable, in an email.
"Cybersecurity measures that help plan sponsors understand where (their technology is) at risk of cyberattack and prioritize what to fix first" are fundamental to a successful cybersecurity program, Wenzler added.
The most common types of issues seen from plans include "poor password hygiene, third-party risks, software vulnerabilities, cloud exposures and misconfigurations, and excessive privileges," according to Wenzler. Excessive privilege refers to the access, or privilege, that a user or application has to systems, as increased privilege often increases the opportunities for hackers to access important information.
According to NCPERS' Kim, plan sponsors rely on in-house experts, including chief technology officers and information technology professionals, "but they also rely on external vendors, who maybe focus exclusively on cybersecurity."
And while public retirement plans are not governed by the Department of Labor, they are still aware of the department's cybersecurity guidance and may look toward it, Kim said.
"The guidance is more advisory for us," Kim added, but "we recognize experts" like the department's EBSA, and "the plans that they do regulate have similar profiles as we do."
Kim also highlighted a group called the Public Retirement Information Systems Management, or PRISM, which brings together IT professionals from public pension funds for an annual conference.
"Obviously, cybersecurity is always a major topic and something that's talked about (at the annual conference) … and best practices and the latest developments (are shared)," he said.
According to their website, PRISM member fund representatives also share information with each other throughout the year.
Part of the reason for an increased focus on cybersecurity in the retirement space is that breaches are increasingly common, Gower said.
"Breaches are increasing, and many of the breaches that are occurring are impacting huge swathes of plans," Gower said. Due to consolidation in the retirement industry, each plan vendor "has a larger and larger share of the market," meaning each cybersecurity breach of a vendor impacts a greater share of plans, Gower explained. Vendor-level breaches are most common, he said, which often affect most, if not all, plans that a vendor works with.
According to Wenzler, "cyber criminal organizations are now functioning more like formal corporations and are more aggressively targeting anyone or anything which can net them a financial gain," which includes retirement plans.
However, "not all cybersecurity breaches are super technical," Gower said, and often involve someone picking up the phone and slowly gaining access to an account by gaining enough information to reset the password.
In July 2022, a former Colgate-Palmolive employee sued the company's employee relations committee, her retirement plan's record keeper and the plan's custodian, alleging a breach of fiduciary duty after she said an individual accessed and stole all the money in her retirement fund, which totaled over $750,000. The perpetrator successfully accessed the account through updating the phone number, email address and physical address on file, creating a new personal identification number, and changing the user ID and password, according to the plaintiff's complaint.
Kim noted that in the public sector, "because of our commitment to transparency," many public officials have their personal information publicly available. Therefore, "bad actors can get some of the information more readily."
Recognizing that threat, "we are doing everything we can to protect our systems and our participants," he added.
The Teacher Retirement System of Texas has a "robust cybersecurity effort," according to CIO Jase Auby, who called it an "agencywide mandate that pertains to benefits, healthcare services (and) investment management."
Gower also warned that an increase in the offering of financial wellness products inevitably means that more personal information is collected from participants, which increases the amount of data that a record keeper already holds.
It's an area that he warns plans to "tread cautiously in and thoughtfully in," he said, because the more data provided to record keepers, the greater potential impact a cybersecurity breach can have.
