"For health and welfare plan sponsors, the good news is that that in many cases, these practices are already a focus of their vendors, especially given legislation earlier this year designed to encourage HIPAA covered entities to adopt some security practices. [The] guidance, while retirement-plan focused, provides a good roadmap for all sponsors of plans (including those not covered by ERISA) to consider in evaluating their service providers as part of their fiduciary due diligence."