"A critical task for a plan sponsor is to gather sufficient knowledge about how a candidate asset manager or other type of vendor secures its operations from unwanted hackers. Asking questions as part of an RFP makes sense although responses could be too technical ... As a result, a plan sponsor could end up having to hire another vendor -- an organization to make sense of the replies about cyber security from the first vendor."