The Department of Labor's Employee Benefits Security Administration (EBSA) recently issued cybersecurity guidance for retirement plan fiduciaries and service providers, as well as plan participants.  The guidance supplements EBSA's electronic records and disclosures regulations and complements previous guidance issued by other agencies.

In the guidance, the EBSA states that ERISA fiduciaries are required to take appropriate steps to mitigate internal and external cybersecurity threats to plan participants and retirement plan assets.  To assist fiduciaries  and service providers in fulfilling this obligation, EBSA issued two documents that describe cybersecurity best practices – Cybersecurity Program Best Practices and Tips for Hiring a Service Provider.  EBSA also issued some basic rules — Online Security Tips — to help participants reduce the risk of fraud and loss to their retirement accounts.