Record keepers working together to fight attacks

Although they fight vigorously to attract new clients and retain existing ones, defined contribution plan record keepers have put aside their competitive nature when it comes to cybersecurity.

They share information, follow industry guidelines to develop best practices, collaborate to improve communication to sponsors and participants, and rarely use cybersecurity practices to differentiate their services from their peers, sources said.

Many record keepers, most notably the largest ones, have similar policies that will reimburse participants who lost money due to a cyberattack if — and only if — the participants and sponsors practice appropriate cyber hygiene.

And many of the record- keeper policies and practices started long before the Department of Labor issued cybersecurity guidelines in April 2021 covering online security tips, cybersecurity best practices and tips to sponsors for hiring a record keeper.

"The issue of cybersecurity is one that record keepers have been worried about for a long time," said Michael Hadley, a Washington-based partner in the law firm of Davis & Harman LLP and an advisory board member of the SPARK Institute Inc., which represents record keepers and other members of the defined contribution industry.

Upgrading cybersecurity "was not driven by requests from sponsors and consultants," Mr. Hadley said. "This is critical to their mission."

Large record keepers that are part of companies that provide financial services were long ago attuned to the need for cybersecurity protection, he said. As such, the challenges and responses are so ubiquitous that record keepers don't have to use them as a marketing tool. "All record keepers know they are going to be asked" by sponsors, he said.

The industry's sensitivity to cybersecurity also means that the requirements in the April 2021 DOL guidance was familiar to the industry. "Most of the record keepers saw this as (something) we had expected," Mr. Hadley said.

Through the SPARK Institute, Simsbury, Conn., the industry acted ahead of regulators and legislators with an industry best practices document on data security reporting published in 2017 and a security breach and cyberfraud report published in 2019. SPARK added a fraud control best practices report in July 2021.

"Job one is to protect the data," said Tim Rouse, executive director of the SPARK Institute. Cooperation among members is important because cyber damage to the weakest member "is damage to the industry."

One key component of SPARK's effort was to create a common language among record keepers in describing various cyber events. "The standardized information for all record keepers enables consultants to compare one record keeper vs. another," he said. The word "breach," for example, had been subject to different interpretations within the industry.

Now, the 2019 SPARK cybersecurity document narrows the definition of a breach as a "confirmed compromise of an information system within the authority or responsibility of a record keeper that results in: the unauthorized acquisition, disclosure, modification or use of unencrypted personal data, or encrypted personal data where the encryption key has also been compromised; and a likely risk of identity theft or fraud against the data subject."

SPARK adds that there are some exceptions to its definition. "A good faith but unauthorized or unintentional acquisition, disclosure, modification or use of personal data by an employee or contractor of the record keeper or a party who has signed a confidentiality agreement with the record keeper does not constitute a security breach if the personal data is not subject to further unauthorized acquisition, disclosure, loss, modification or use," the document says.

Record keepers have responded to the increased risks by adding staff.

The number of cybersecurity staff among DC plan record keepers was 7,834 as of Sept. 30, according to Pensions & Investments data. The figure is more than triple the 2,216 reported for Sept. 30, 2016, with the biggest gains coming during the last three annual surveys.

Record keepers "are incentivized to protect themselves," which means more money and more people devoted to cybersecurity, said Shawn O'Brien, Boston-based senior analyst for retirement at Cerulli Associates.

A survey conducted by his firm during the fourth quarter of 2021 found that one-third of record keepers said they expected to increase their cybersecurity staffing in the next 12 months.

The survey, in partnership with the SPARK Institute, polled 19 record keepers representing more than $7.4 trillion in assets under administration at year-end 2020. The respondents provided services for more than 420,000 DC plans with more than 83 million participant accounts.

"It's something they need to do," said Mr. O'Brien said. "Cyberattacks evolve. It's hard to know where the next attack will be."

Mr. O'Brien and others identified phishing — hackers posing as a legitimate institution to con participants into providing personal data — as the biggest problem.

Mr. O'Brien also noted that a survey of more than 700 401(k) plan sponsors conducted during the fourth quarter of 2021 found that data security was the second most important issue among 11 factors they consider when evaluating a record keeper. Cost (24% of respondents) was the highest, followed by data security (22%) and retirement income product availability (20%). Multiple answers were allowed.

Mr. O'Brien added that smaller record keepers may lack sufficient resources to continually upgrade their cybersecurity services.

"There are an awful lot of pressures on small record keepers, and cybersecurity is one of them," said Jennifer Eller, Washington-based principal and co-chairwoman of the retirement services practice group and fiduciary practice at Groom Law Group.

She said smaller record keepers can use "low-tech" strategies for cybersecurity protection such as requiring sponsors to approve every distribution by a plan participants or imposing a waiting period — perhaps five to seven days — for a distribution to be approved after it has been confirmed by the participant.

"It's not a silver bullet," she said. "It does allow back-and-forth communication" to confirm that a distribution request is legitimate.

Ms. Eller added that the reimbursement policies offered by record keepers are a "reasonable" response to cyberattacks to "make clear with sponsors to say this is what we can do and what you can do."

One such policy is the account protection program from T. Rowe Price Group Inc., whose program document outlines a set of cybersecurity protection guidelines, promising that the record keeper will "restore eligible account losses due to unauthorized activity" if security best practices are followed.

"It's a viable way to give participants confidence, and it allows us to engage them in the process," said Francisco Negron, the Baltimore-based head of client services for T. Rowe Price Retirement Plan Services.

T. Rowe Price had an informal reimbursement policy for several years prior to 2018, when it publicized its comprehensive effort. The account protection program describes six broad guidelines for participant compliance: improving login protection; monitoring online accounts every month; checking for suspicious emails and phishing emails; taking precautions at home, such as protecting wireless networks; browsing with vigilance, such as avoiding unsecure websites; and contacting the company immediately if unauthorized activity is suspected.

For example, the "improving login protection" category tells participants to choose a unique user name and password; establish or update security questions and make sure they are not easily answered; use two-factor authentication; maintain accurate and up-to-date contact information; and refrain from sharing account information.

Also, the "monitor your accounts" guidelines cite logging into a T. Rowe Price online account each month; reviewing correspondence and emails and account statements from T. Rowe Price within 30 days of receipt; and monitoring suspicious credit account activity.

The account protection program document says "all reported concerns with be thoroughly investigated, adding that participant errors — such as misuse or fraud by the account holder and sharing account information" — could invalidate a claim for reimbursement.

Mr. Negron didn't comment on the amount of reimbursements made by his firm.

He said T. Rowe Price doesn't require participants to certify in advance that they are following all the best practices. He added that his firm meets with sponsor-clients yearly to discuss cybersecurity efforts by reviewing data to see how well participants have improved their compliance.

Although existing and potential sponsors say cybersecurity protection is important in choosing a record keeper, Mr. Negron said he didn't detect industry members using this protection as a marketing device to distinguish their services. "There's an expectation that as a major provider, you have to have it," he said. "There's a high level of collaboration among the industry."

The Cerulli Associates-SPARK survey of 19 record keepers confirmed that cybersecurity isn't much of a differentiator in romancing or retaining clients.

Among 15 choices, the record keepers said cybersecurity wasn't a factor for winning 401(k) business among plans with less than $250 million in assets. For three separate asset categories of larger plans, only 8% in each category cited cybersecurity as a differentiator, well behind such factors as participant websites/tools, record-keeper reputation, total record-keeping costs and financial wellness capabilities.

Cerulli's Mr. O'Brien recalled the comments from one record keeper who said, "I don't think anyone wants to highlight their security as a competitive advantage" because "we'd rather not have the risk of a cybersecurity lapse enter the conversation at all." However, as cybersecurity becomes a bigger issue for the DC industry and as record keepers keep spending to upgrade their protection, sponsors will ask questions.

Attorney Kenneth K. Dort said he understands why many of his record-keeping clients don't initially cite cybersecurity in their efforts to attract sponsors. "They are afraid of the next question: Did you have a breach or an incident?" said Mr. Dort, a Chicago-based partner at Faegre Biddle Drinker & Reath LLP.

"By the time someone is talking to me, it's higher on their list — or they wouldn't be talking to me," said Mr. Dort, referring to the importance of discussing cybersecurity services when record-keeper clients are seeking to complete a deal with a sponsor.

Repeating an oft-told comment within the cybersecurity industry, Mr. Dort said there are two types of clients — ones that have had a breach and ones that will have a breach.