In This Article
Cybersecurity can feel like a specialized technology subject, yet several safeguards are basic operational questions for a 401(k) plan sponsor. Multi-factor authentication, controlled access, secure file sharing, and prompt removal of former users are controls you can discuss in practical terms with providers and internal teams. For business owners managing a year-end compliance calendar, confirming these fundamentals can help support more resilient plan administration.
Why multi-factor authentication matters
A password alone may not be enough to establish that the person signing in is authorized. Multi-factor authentication adds another authentication step, such as a device-based prompt, a verification app, or another approved factor. The sponsor does not need to prescribe a particular method. A useful oversight question is whether stronger authentication is available for plan-administration accounts and participant-facing systems, which users it covers, and how enrollment and recovery are managed. The response can help the sponsor understand the level of protection around sensitive access points.
Administrative access deserves special focus.
Not every user needs the same level of access. People who upload payroll files, change plan settings, view broad census data, or approve distributions may have access that creates greater exposure if misused. Sponsors can ask providers to explain access control based on roles and can review their own list of authorized administrators. The list should be current, limited to legitimate business need, and reviewed after staffing changes. A simple recurring review can be more effective than assuming that access automatically tracks job changes.
Secure information handling is a basic requirement.
Authentication is only one part of protecting plan data. Internal teams should also understand the approved methods for sending and storing sensitive files. A file sent through a personal email account or retained in an uncontrolled shared network can create risk even when the recordkeeper's portal is secure. Sponsors can ask providers which file-transfer methods they support and make sure payroll and HR teams know how to use them. Explicit procedures help replace convenience-driven habits with consistent ones.
Watch for social engineering.
Fraud attempts often seek information or access by impersonating a provider, executive, employee, or support representative. Requests can appear urgent and may ask someone to reset access, change account information, or send a file. A sponsor can encourage internal plan contacts to verify unusual requests through established contact information rather than responding through an unexpected message. This is an awareness practice, not a technical solution, and it is especially relevant for employees who handle plan files or provider communications.
Confirm recovery and offboarding.
Strong access controls also depend on what happens when a device is replaced, a credential is lost, or an authorized employee changes roles. Sponsors can ask how the provider verifies account recovery requests and what the employer must do to remove or modify administrator access. Internally, the plan contact list and offboarding process should connect with HR and technology procedures. A prompt, documented review can reduce the risk that access stays active after it is no longer appropriate.
Stronger controls can raise practical questions, particularly when employees need help with a lost device, an administrator changes roles, or a payroll deadline approaches. The sponsor can ask providers how they handle those situations and whether they have a documented, verified recovery process. The purpose is not to remove safeguards for convenience. It is to understand the operational process so that an urgent request is handled through an approved channel rather than an informal exception.
Written internal instructions can be brief. They might identify the approved portal for plan files, the person authorized to request administrator changes, the verified provider contact list, and the process for escalating unusual requests. Review these instructions when staff, systems, or providers change. A short, current guide supports consistent behavior. It helps a new plan contact understand that security is part of regular administration, not a separate responsibility that appears only during an incident.
A practical basics-confirmation process
1. Inventory administrator accounts. List every internal person with plan-related administrative access and the purpose of that access. Include payroll, HR, finance, and any external contacts who receive plan files.
2. Confirm available authentication controls. Ask the recordkeeper and other relevant providers whether multi-factor authentication is available, required, or configurable for each important access point, and document the response.
3. Review access levels. Compare each user's access with current job responsibilities. Ask providers how to adjust permissions and remove inactive accounts, then coordinate changes through established internal procedures.
4. Standardize secure file practices. Identify approved portals or transfer methods for plan files. Provide a concise internal reminder to avoid unapproved channels and verify unusual information requests.
5. Test the handoffs. Periodically check that an access removal, user addition, or secure file submission follows the documented process. Update contact lists and instructions when providers or personnel change.
Security basics are most effective when they are visible in daily routines rather than saved for an annual policy review. By confirming authentication, access, file handling, and offboarding practices, a sponsor can create a practical basis for ongoing cybersecurity oversight without turning plan governance into a technology project.
Want help reviewing plan-administration cybersecurity basics?
Duncan Williams Asset Management can help you walk through access-control questions, understand the questions to ask your service providers, and pinpoint areas where additional professional input may be useful. To discuss your plan's cybersecurity practices, call our team at (901) 435.4250 to arrange a conversation about your retirement plan.
Sources & further reading
• U.S. Department of Labor — Cybersecurity Program Best Practices: https://www.dol.gov/agencies/ebsa/key-topics/retirement-benefits/cybersecurity/best-practices
• U.S. Department of Labor — 2024 cybersecurity guidance update: https://www.dol.gov/newsroom/releases/ebsa/ebsa20240906-0
• U.S. Department of Labor — 2021 cybersecurity guidance announcement: https://www.dol.gov/newsroom/releases/ebsa/ebsa20210414
• U.S. Department of Labor — Tips for Selecting and Monitoring Service Providers: https://www.dol.gov/sites/dolgov/files/ebsa/about-ebsa/our-activities/resource-center/fact-sheets/tips-for-selecting-and-monitoring-service-providers.pdf
• IRS — A Plan Sponsor's Responsibilities: https://www.irs.gov/retirement-plans/plan-sponsor/a-plan-sponsors-responsibilities
Ready to take action?
Let's talk about your financial future.
A local Memphis advisor is ready to listen. No pressure, no obligation.