--- title: Cybersecurity and ERISA description: Learn about the Department of Labor's updated 2024 cybersecurity guidelines for ERISA plans and their impact on plan sponsors’ fiduciary duties. image: https://1652561.fs1.hubspotusercontent-na1.net/hubfs/1652561/Cybersecurity%20and%20ERISA%20Adobe%20Stock.jpeg --- [Skip to content](https://www.auerbachandgussin.com/blog/cybersecurity-and-erisa#main-content) [![Auerbach & Gussin](https://www.auerbachandgussin.com/hubfs/01507-Auerbach-Gussin-Logo-CC.png)](https://www.auerbachandgussin.com) - [Home](https://www.auerbachandgussin.com) - Services - [Health Insurance](https://www.auerbachandgussin.com/en/services) - [Your Medicare Guide](https://www.auerbachandgussin.com/auerbauch-gussin-your-guide-to-understanding-medicare-options) - [About](https://www.auerbachandgussin.com/about) - [Blog](https://www.auerbachandgussin.com/blog) - [Contact](https://www.auerbachandgussin.com/contact) # Cybersecurity and ERISA [![MZQ Logo](https://1652561.fs1.hubspotusercontent-na1.net/hub/1652561/hubfs/MZQ_logo_2019_FINAL-01%20copy%202.jpg?width=254&height=130&name=MZQ_logo_2019_FINAL-01%20copy%202.jpg)](https://www.mzqconsulting.com/) *Prefer to listen instead of read? No problem! [Listen to the blog post at any time by clicking here](https://1652561.fs1.hubspotusercontent-na1.net/hubfs/1652561/Cybersecurity%20and%20ERISA%20Blog%20Narration.mp3).* ---   On September 6th, 2024, the Department of Labor (DOL) issued a press release reminding ERISA plan fiduciaries that it considers cybersecurity to be an area of “great concern.” Due to a rash of cybersecurity incidents, the DOL has increased its investigations of violations in this area. The DOL also published [updated cybersecurity guidance](https://www.dol.gov/agencies/ebsa/key-topics/retirement-benefits/cybersecurity/compliance-assistance-release-2024-01) that builds on documents the Department released in 2021. Most importantly, these new publications clarify that the DOL’s cybersecurity guidelines apply to all types of ERISA plans, including health and welfare plans. ### Overview of 2021 DOL Cybersecurity guidance  The guidance the DOL released in 2021 consists of three documents:  - *Cybersecurity Program Best Practices*, which includes a detailed set of twelve best practices that organizations should adopt to mitigate cybersecurity risks;  - *Tips for Hiring a Service Provider with Strong Cybersecurity Practices*, which offers six tips to help organizations select service providers with strong cybersecurity practices; and  - *Online Security Tips*, which lists nine online security tips to help individuals protect their accounts against fraud and loss.  ### Clarification and notable enhancements in 2024 guidance  Some service providers interpreted that this guidance only applied to retirement plans, prompting the DOL to affirm in the 2024 iteration of their guidance that the cybersecurity recommendations apply to all plans subject to ERISA. Aside from new language to this effect, the 2024 versions of the documents listed above remain largely the same. One notable enhancement is the inclusion of additional language specifying that plan sponsors should ensure their vendors’ insurance covers cybersecurity breaches and incidents involving the plan. The updated guidance now also reflects specific multifactor authentication process recommendations, a participant notification requirement if a cybersecurity breach occurs, and a list of additional cybersecurity resources.  Given the DOL’s clarification that their cybersecurity guidelines apply to all plans subject to ERISA *and* that they find this topic to be of great concern, we would encourage employers as plan sponsors to audit their existing cybersecurity protocols for any plan data that is stored or accessed internally against these updated requirements and recommendations and to take reasonable steps to address any gaps. In addition, the employer should confirm that their vendors/service providers are separately implementing these requirements for any plan data they handle. Doing so will help employers fulfill their fiduciary duties towards participants, highlight potential areas of improvement, and reaffirm which of their cybersecurity practices are already in alignment with DOL guidance.  ### HIPAA's role in cybersecurity compliance  Of note, while HIPAA privacy and security compliance efforts for group health plans may not address all ERISA plans sponsored by an employer, they will provide a meaningful framework to apply to any plans that fall outside HIPAA’s scope. Employers that have not yet addressed HIPAA’s privacy and security requirements, including developing written policies and procedures and conducting a HIPAA security risk analysis, may want to prioritize this in light of the updated cybersecurity guidance.    *© 2024 MZQ Consulting, LLC. All rights reserved.* *Content provided to [Q4intelligence](https://www.q4intel.com) members by MZQ Consulting, LLC* Photo by [K Seisa](https://stock.adobe.com/contributor/210716081/k-seisa-peopleimages-com?load_type=author&prev_url=detail)  - - - - [mailto:?subject=Cybersecurity%20and%20ERISA&body=Cybersecurity%20and%20ERISA%20%20https://www.auerbachandgussin.com/blog/cybersecurity-and-erisa](mailto:?subject=Cybersecurity%20and%20ERISA&body=Cybersecurity%20and%20ERISA%20%20https://www.auerbachandgussin.com/blog/cybersecurity-and-erisa) [Next post](https://www.auerbachandgussin.com/blog/compliance-corner-webinar-the-top-10-compliance-topics-you-must-know-or-do-for-2025) [All posts](https://www.auerbachandgussin.com/blog) [Previous post](https://www.auerbachandgussin.com/blog/dei-done-right-how-balance-and-kindness-lead-to-lasting-inclusion) ## View related posts #### [ACA Affordability Percentage Remains Below 9.5% for 2025](https://www.auerbachandgussin.com/blog/aca-affordability-percentage-remains-below-9-5-for-2025) #### [5500 Filings Are Due, But Don’t Panic If You’re Not Ready!](https://www.auerbachandgussin.com/blog/5500-filings-are-due-but-dont-panic-if-youre-not-ready) #### [One Big Beautiful Bill Act (OBBBA)](https://www.auerbachandgussin.com/blog/one-big-beautiful-bill-act-obbba) ![Auerbach & Gussin](https://www.auerbachandgussin.com/hubfs/01507-Auerbach-Gussin-Logo-WH-1.png) Auerbach & Gussin is an insurance agency specializing in group and individual health plans, disability, life, and long-term care insurance. We help businesses and individuals find the benefits and coverages that fit their needs. - Learn more - [Our services](https://www.auerbachandgussin.com/en/services) - [About us](https://www.auerbachandgussin.com/about) - [Privacy Policy](https://www.auerbachandgussin.com/-temporary-slug-762091f5-5854-404a-97e8-26d02917a97d) - Contact - Auerbach & Gussin 701 Palomar Airport Road #260 Carlsbad, CA, 92011 - [(858) 546-4101](tel:8585464101) - [info@auerbachandgussin.com](mailto:info@auerbachandgussin.com) © 2026 All rights reserved. Developed by [Q4intelligence](https://www.q4intel.com/) ```json { "@context" : "https://schema.org", "@type" : "Article", "author" : { "@type" : "Organization", "name" : "Q4intelligence, LLC" }, "datePublished" : "2024-10-31T10:00:00+00:00", "headline" : "Cybersecurity and ERISA", "mainEntityOfPage" : { "@id" : "https://insights.q4intel.com/employers/cybersecurity-and-erisa", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "name" : "Q4intelligence, LLC", "url" : "https://www.q4intel.com" } } ```