"As a plan sponsor, taking steps to secure your plan data isn't optional, it's part of your legal duty to act in your participants' best interests.... [1] Review your vendor contracts for cybersecurity language. [2] Request and review audit reports from your service providers. [3] Implement basic security practices for your internal team. [4] Educate your participants about protecting their accounts. [5] Document your efforts as part of fiduciary oversight."  MORE >>