{"id":258739,"date":"2026-05-29T10:27:00","date_gmt":"2026-05-29T14:27:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/05\/29\/erisa-cybersecurity-what-plan-fiduciaries-should-know\/"},"modified":"2026-05-29T10:30:10","modified_gmt":"2026-05-29T14:30:10","slug":"erisa-cybersecurity-what-plan-fiduciaries-should-know","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/05\/29\/erisa-cybersecurity-what-plan-fiduciaries-should-know\/","title":{"rendered":"ERISA Cybersecurity: What Plan Fiduciaries Should Know"},"content":{"rendered":"

ERISA Cybersecurity: What Plan Fiduciaries Should Know<\/a><\/p>\n

https:\/\/www.forvismazars.us\/forsights\/2026\/05\/erisa-cybersecurity-what-plan-fiduciaries-should-know<\/a><\/p>\n

Publish Date: 2026-05-29 10:27:00<\/a><\/p>\n

Source Domain: www.forvismazars.us<\/a><\/p>\n

If your organization sponsors an employee benefit plan under the Employee Retirement Income Security Act of 1974 (ERISA), cybersecurity risk is now a core fiduciary consideration. A single compromised record-keeper login, a missed vendor review, or an outdated incident response plan could put participant data, plan assets, and your fiduciary standing at risk.<\/p>\n

The U.S. Department of Labor (DOL) has clarified that ERISA-covered plans are expected, consistent with fiduciary duties of prudence and loyalty, to understand and oversee cybersecurity risks that could affect plan data and plan assets, regardless of plan size or whether services are outsourced.<\/p>\n

Recent DOL enforcement developments underscore that these expectations are not merely aspirational. On January 15, 2026, the DOL\u2019s Employee Benefits Security Administration (EBSA) announced that it overhauled its national enforcement projects for fiscal year 2026 and that investigations will prioritize cybersecurity, among other focus areas. This increased enforcement emphasis reiterates the importance of having a demonstrable, plan-specific process for assessing cyber risk and overseeing service providers that handle plan data and transactions.<\/p>\n

Deconstructing the DOL\u2019s Cybersecurity Guidance<\/h2>\n

The DOL\u2019s cybersecurity guidance, originally issued in April 2021 and expanded to all ERISA-covered plans in September 2024 through Compliance Assistance Release No. 2024-01, applies broadly to retirement plans, health and welfare plans, plan sponsors and fiduciaries, and service providers that create, store, process, or transmit plan data.<\/p>\n

The guidance is anchored by the DOL\u2019s \u201cCybersecurity Program Best Practices,\u201d which describe elements of reasonable cybersecurity governance and oversight for ERISA plans. These practices include:<\/p>\n