National Cybersecurity Awareness Month

THREE WAYS SPONSORS CAN SUPPORT PARTICIPANT CYBERSECURITY

Protecting participant accounts does not require a degree in information technology. It starts with
thoughtful questions, trusted partners, and practical education.

Retirement plans hold sensitive personal and financial information. As cyber threats evolve, sponsors can
make a meaningful difference without independently evaluating technical controls. The most practical
approach is to understand the protections available, keep cybersecurity in the provider conversation, and help
participants use the tools already available to them.

1. ASK

Are We Asking the Right Questions? The goal is not to audit the technology. It is to understand the protections and know what happens when something goes wrong.

• Is multifactor authentication available, and is it actively promoted?
• How does the provider identify and respond to suspicious account activity?
• What should a participant do if an account may be compromised?
• How and when would the sponsor and affected participants be notified?
• What education resources can the sponsor share?

2.VERIFY

Are We Working with Reputable Providers? Reasonable oversight begins with selecting established providers, maintaining an open dialogue, and revisiting participant protections periodically.

• Does the provider maintain an established cybersecurity program?
• Are account-protection and fraud-prevention practices discussed during reviews?
• Is there a clear incident-response and participant-notification process?
• Does the provider explain any account protection or reimbursement policy?
• Are security features easy for participants to activate and use?

3.EDUCATE

Are We Helping Participants Protect Themselves? Participant education may be the most practical cybersecurity tool available to a plan sponsor.

• Enable multifactor authentication.
• Use a strong, unique password for the retirement account.
• Keep email addresses and mobile numbers current.
• Review account activity and notices promptly.
• Treat unexpected links, calls, texts, and requests for credentials with caution.

PRACTICAL TAKEAWAY

Sponsors do not need to become cybersecurity experts. Ask practical questions, understand who to call, and make participant education a recurring part of plan communications.

CYBERSECURITY CHECKUPS

Simple questions can turn cybersecurity awareness into practical action.

FOR PLAN SPONSORS

☐ Have we discussed cybersecurity with our recordkeeper in the past year?
☐ Is multifactor authentication available, and do participants know how to enable it?
☐ Do we understand the process for reporting and addressing suspected account fraud?
☐ Do participants know whom to contact if they have a concern?
☐ Have we shared cybersecurity reminders recently?

FOR PARTICIPANTS

☐ Have I enabled multifactor authentication?
☐ Is my retirement-account password unique and difficult to guess?
☐ Have I reviewed my account activity recently?
☐ Are my email address and mobile number current?
☐ Would I pause before responding to an unexpected message or request for credentials?

FIDUCIARY PERSPECTIVE | Cybersecurity is also a fiduciary topic.

The U.S. Department of Labor has confirmed that its cybersecurity guidance applies to all ERISA-covered plans. The guidance addresses prudent service-provider selection and monitoring, cybersecurity practices, and online security tips for participants. For sponsors, the practical point is simple: include cybersecurity in
the broader provider-oversight conversation. Technical review may require assistance from internal IT, counsel, or another qualified resource.

THE BOTTOM LINE

Protect participants without becoming a cybersecurity expert.

Ask the right questions. Work with providers you trust. Help participants use strong security habits. Keep the topic visible, and know where to turn when a concern arises.

YOU’RE NEVER ALONE WITH ALIGN

With experience, structure, and steady guidance, Align helps plan sponsors navigate change with confidence. Explore what’s possible…