In This Article
Communicating cybersecurity with employees
Technology and provider controls support retirement-plan cybersecurity, but communications also matter. Employees may receive plan emails, use a recordkeeper website, contact support teams, or respond to notices that appear to concern their accounts. Business owners and plan sponsors can make cybersecurity awareness part of retirement communications without shifting plan oversight to employees or creating alarm. The aim is to provide clear, neutral reminders about safe interaction with plan information and established channels for questions.
Keep the sponsor's role clear
The plan sponsor remains responsible for prudent oversight of the plan and its providers. Employee communications should not suggest that individuals are responsible for solving a security incident or evaluating the provider's technical controls. Instead, they can explain straightforward practices: use the official site or support number, be cautious about unexpected messages, protect login credentials, and report suspected fraud or unusual communications through verified channels. Clear boundaries help awareness messages complement, rather than replace, sponsor governance.
Use plain language and familiar moments.
Cybersecurity reminders are more useful when they are short, understandable, and delivered as part of normal plan communications. Enrollment materials, annual notices, provider-change messages, and benefit reminders can include a concise security section. Rather than overwhelming readers with technical terminology, the communication can describe what an official message may look like, where to find a verified contact approach, and what to do if something seems unusual. Consistency among HR, payroll, and provider materials can reduce confusion.
Coordinate the message with providers.
Recordkeepers often have their own account-security resources, website language, and procedures. Before distributing a notification, sponsors can ask the provider for current approved guidance and correct links or contact points. This reduces the chance of directing employees to an outdated process or creating a message that conflicts with provider support practices. Sponsors can also determine which party handles reports of suspicious account activity and how the employer will be informed if an issue affects plan administration.
Avoid turning communications into promises.
Security communications should be accurate and practical. They should not guarantee that a method will prevent fraud or imply that a particular action resolves all risk. It can be helpful to avoid overstating the scope of sponsor monitoring or disclosing superfluous details about security controls. Instead, focus on observable cues, verified channels, and prompt reporting. Legal or compliance review may be appropriate for messages that address a specific event, a new provider process, or communications that include confidential information.
Make awareness part of the calendar.
A single annual reminder can be useful, but awareness is stronger when it has a planned place in the communication calendar. Sponsors can decide which recurring messages will include a brief security note, who approves the wording, and how provider updates will be incorporated. They can also track questions received to identify confusing language or recurring concerns. This turns awareness into a modest, sustainable part of plan administration rather than a reaction only after a problem occurs.
A useful awareness message gives employees an easy way to act on the information. After sending a notification, sponsors can monitor questions HR or the plan contact receives and consider whether the wording directs people to the right place. Repeated questions may suggest that the provider's terminology, the official support path, or the message's examples require explanation. The goal is a simple, dependable communication interaction, not frequent or alarming warnings.
Sponsors should also preserve governance records of the communication process. Keeping an approved copy, the date used, the provider contact who verified any details, and notes on material follow-up may help preserve consistency across future messages. If the plan changes recordkeepers or access procedures, that record makes it easier to identify what needs updating. Thoughtful documentation lets communication practices evolve with the plan while continuing a clear distinction between education, provider support, and the sponsor's oversight role.
A practical communication process
1. Choose appropriate communication moments. Identify routine retirement-plan messages, such as annual notices or enrollment materials, where you can include a short cybersecurity reminder without obscuring required information.
2. Verify content with providers. Confirm current official websites, support contacts, reporting channels, and account-security guidance with the recordkeeper or other relevant provider before publishing.
3. Use concise, neutral language. Explain how to recognize recognized channels, protect account credentials, and report questionable communications. Refrain from technical claims, guarantees, or instructions that conflict with provider procedures.
4. Route questions consistently. Tell employees where verified help is available and establish an internal process for directing plan-related security reports to the right provider or internal contact.
5. Review and refresh. Revisit the language periodically, especially after a provider change or an update to account-access procedures. Keep approved versions and a record of when you used them.
Cybersecurity awareness communications work best as one component of a wider plan-governance process. By coordinating clear reminders with providers, using verified channels, and reviewing the message over time, business owners can support safer interactions with retirement-plan information while preserving appropriate oversight responsibilities.
Want help reviewing retirement-plan cybersecurity communications?
Duncan Williams Asset Management can help you work through communication-planning questions, understand what to ask your service providers, and recognize areas where additional professional input may be useful. To discuss your plan's cybersecurity awareness process, call our team at (901) 435-4250 to arrange a conversation about your retirement plan.
Sources & further reading
• U.S. Department of Labor — Cybersecurity Program Best Practices: https://www.dol.gov/agencies/ebsa/key-topics/retirement-benefits/cybersecurity/best-practices
• U.S. Department of Labor — 2024 cybersecurity guidance update: https://www.dol.gov/newsroom/releases/ebsa/ebsa20240906-0
• U.S. Department of Labor — 2021 cybersecurity guidance announcement: https://www.dol.gov/newsroom/releases/ebsa/ebsa20210414
• U.S. Department of Labor — Tips for Selecting and Monitoring Service Providers: https://www.dol.gov/sites/dolgov/files/ebsa/about-ebsa/our-activities/resource-center/fact-sheets/tips-for-selecting-and-monitoring-service-providers.pdf
• IRS — A Plan Sponsor's Responsibilities: https://www.irs.gov/retirement-plans/plan-sponsor/a-plan-sponsors-responsibilities
Ready to take action?
Let's talk about your financial future.
A local Memphis advisor is ready to listen. No pressure, no obligation.