"Fiduciaries should ask potential and incumbent DC plan recordkeepers if they provide a participant guarantee.... For legitimate reasons, service providers may not want to share details of their cybersecurity programs. Nonetheless, the agreement should include a reasonable degree of specificity, which the DOL's best practices may provide.... Fiduciaries may want to post copies of the Online Security Tips on HR or benefit portals, or on the plan's website."