Even if neither cybersecurity insurance nor fiduciary liability insurance is statute-prescribed, fidelity-bond insurance is.
The Employee Retirement Income Security Act of 1974 makes it a fiduciary breach (and a Federal crime) for a person to handle plan assets or serve as a plan’s fiduciary unless the person is “bonded” with sufficient ERISA fidelity-bond insurance.
(Perhaps because both labels begin with the letter “F” and use a word derived from Latin, many people confuse fidelity-bond insurance and fiduciary liability insurance. They are different kinds of insurance for different losses. Fidelity-bond insurance covers a theft.)
The minimum fidelity-bond insurance coverage ERISA expressly requires is 10% of the amount the covered person handles, except that the statute ordinarily does not expressly require more than $500,000 or, if the plan holds employer securities or is a pooled-employer plan, $1 million; and requires at least $1,000 (even if the amount the covered person handles is less than $10,000).
Fidelity-bond insurance is a plan’s expense, which may be paid from the plan’s assets.
A fiduciary who knows another fiduciary breached a duty to get fidelity-bond insurance, or to require an employee, agent, or other service provider to be bonded, is liable for not making reasonable efforts to remedy the other fiduciary’s breach. That liability might include restoring the plan’s loss that would have been insured.
ERISA permits, but does not require, fiduciary liability insurance. A fiduciary must at least consider obtaining this insurance, and should buy it if in the plan’s circumstances an experienced fiduciary acting with the care, skill, prudence, and diligence ERISA requires would do so.
A retirement plan may buy fiduciary liability insurance “if such insurance permits recourse by the insurer against the fiduciary in case of a breach of a fiduciary obligation by such fiduciary.” If the insurance contract permits (or at least does not preclude) the insurer’s recourse against a breaching fiduciary, the “premium”—insurance jargon for the price one pays for insurance coverage—may be paid by the plan.
If an insurance contract precludes recourse against a breaching fiduciary, a retirement plan cannot pay the portion of the insurance price that is attributable to the non-recourse provision. An insurer might allow more than one payer to pay the insurance price, and might, for the payers’ convenience, allocate the overall price into portions—a price attributable to the incremental value of the non-recourse provision, which is the price to be paid by a person other than the plan; and a price that is the difference between the total price and the price of the non-recourse provision—that is, the portion of the price that can be paid from a plan’s assets without violating ERISA.
For more information, see chapter 6 in ERISA: A Comprehensive Guide (Wolters Kluwer).