"Although the most detailed piece of the package -- the best practices summary -- is framed as applying to plan service providers (such as recordkeepers and administrators), enforcement actions already implemented suggest that these standards likely also apply to plan-related information maintained by the plan fiduciary.... [P]lan sponsors and fiduciaries should be aware that this cybersecurity guidance likely applies to all plans governed by ERISA, not just retirement plans."

MORE >>