Frequently Asked Questions
Common questions about IT, cybersecurity, and DOL compliance for Third-Party Administrators.
DOL Compliance & ERISA Requirements
What are the DOL cybersecurity requirements for TPAs?
The Department of Labor's Employee Benefits Security Administration (EBSA) has published 12 cybersecurity best practices for recordkeepers and other plan service providers, including TPAs; plan fiduciaries use them to choose and monitor providers. They are guidance rather than regulations. They call for a formal cybersecurity program, annual risk assessments, an annual third-party audit of security controls, defined security roles, strong access controls, security reviews of cloud and third-party providers, cybersecurity awareness training at least annually, secure development practices, a business resiliency program, encryption of sensitive data, strong technical controls, and an appropriate response to any incidents. Our DOL Cybersecurity Compliance Guide walks through implementation steps for each practice.
Do TPAs have fiduciary liability for cybersecurity?
It depends on the role. A TPA that serves as a 3(16) plan administrator, or otherwise exercises discretion over plan administration, is a fiduciary for those functions, and a fiduciary that breaches its duties can be personally liable for resulting plan losses. A TPA that performs only ministerial tasks generally is not a fiduciary. Either way, DOL treats cybersecurity as part of plan fiduciaries' duties, so sponsors expect their TPAs to show appropriate safeguards for participant data, and DOL can investigate service providers whether or not they are fiduciaries.
How does TPAIT help with DOL audits?
We provide audit-ready documentation of your IT controls, cybersecurity measures, access management, backup procedures, and incident response plans. When a plan sponsor conducts due diligence or the DOL requests evidence of your cybersecurity program, you'll have organized documentation ready to present.
What changed with DOL cybersecurity enforcement in 2026?
On January 15, 2026, EBSA announced its national enforcement projects for fiscal year 2026, and cybersecurity is one of six priority areas. In September 2024, Compliance Assistance Release 2024-01 confirmed the guidance applies to all ERISA-covered plans, and its best practices are addressed to recordkeepers and other service providers, including TPAs. In FY 2025, EBSA recovered $1.4 billion for plans, participants and beneficiaries; its 878 closed civil investigations recovered $714.4 million, and 63% closed with results. TPAs without documented cybersecurity programs, annual risk assessments, and incident response plans now face significantly higher regulatory risk. Sources: DOL news release, January 15, 2026 (opens in new tab); EBSA FY 2025 results (opens in new tab).
Services & Coverage
What types of retirement plans does TPAIT support?
TPAIT provides IT, cybersecurity, and private cloud services for TPAs administering 401(k) plans, 403(b) and 457(b) plans, profit sharing plans, cash balance plans, Section 125 cafeteria plans, and ESOPs. Our leadership has nearly two decades of experience running IT inside retirement plan administration firms and understands the specific compliance requirements and workflows of the TPA industry.
What TPA software platforms does TPAIT support?
Our leadership has hands-on experience with the full range of TPA software systems—plan administration platforms, compliance testing tools, document generation systems, and Form 5500 preparation software. We also support integrations with major recordkeepers and custodians.
What is a dedicated service desk manager?
Unlike traditional IT support with rotating technicians, you get a dedicated service desk manager who learns your technology stack, knows your team members, and understands your specific TPA workflows. When you call, you're speaking with someone who already knows your environment—no explaining your setup every time.
What is TPAIT's response time for IT issues?
Our response target for Priority 1 issues is 15 minutes. We provide 24/7/365 monitoring and support with a U.S.-based team. There are no offshore call centers—your support comes from technicians who understand TPA operations and speak your language.
Do you work directly with our vendors?
Yes—we eliminate the finger-pointing. When you experience an issue involving third-party systems, we coordinate directly with recordkeepers, software vendors, and telecom providers. You shouldn't waste time on three-way calls trying to identify who's responsible. We manage vendor escalations, track tickets, and ensure accountability—you get one throat to choke.
Infrastructure & Security
Where is my data stored with TPAIT's private cloud?
Your data resides in a California-based Tier III datacenter. The facility maintains ISO 27001, SOC 1 SSAE 18 Type II, SOC 2 Type II, NIST 800-53 PE High, and PCI DSS compliance. Our practices align with these standards. Your environment is isolated via VLAN segmentation with offsite replication for disaster recovery.
What happens if there's a security incident or ransomware attack?
We have a documented, tested incident response process. Within minutes, our SOC/MDR team detects the incident, isolates affected systems, and notifies you. Within hours, threats are analyzed and eradicated. Recovery from immutable backups typically happens same day or next business day. You receive a written incident timeline for regulatory reporting, breach notification support if PII was compromised, and evidence for cyber insurance claims.
Getting Started
How quickly can TPAIT onboard a new TPA client?
Onboarding is planned for 2-4 weeks. Week 1 focuses on security deployment—RMM, endpoint protection, patching, and initial hardening. Week 2 covers optimization and monitoring tuning. Complete IT documentation is delivered within 30 days. If you choose our Private Cloud, we handle migrations over a weekend: Friday deployment, Saturday migration, Sunday testing—your team connects seamlessly Monday morning.
What is the relationship between TPAIT and CRC Cloud?
TPAIT® is CRC Cloud®’s dedicated brand for third-party administrators and retirement-plan providers, delivered on the same CRC Cloud platform. CRC Cloud’s roots in IT and infrastructure go back to 1983; Mike Parker acquired the company in 2020 and leads it as CEO, bringing nearly 20 years of direct experience as CIO and CTO at multiple national TPA companies. CRC Cloud maintains Technology E&O and Cyber Liability insurance coverage.
How is TPAIT different from a regular IT provider?
We focus exclusively on TPAs and firms in the retirement administration space. Our systems, documentation, and support are purpose-built for TPA workflows, recordkeeper integrations, and Plan Sponsor due diligence—not adapted from generic IT templates. Unlike general IT providers, we understand filing deadlines, participant data protection requirements, and the specific audit standards TPAs face. You don't have to explain your business to us.
Can we cancel anytime?
Yes—you can cancel with 60 days written notice at any time. All outstanding invoices must be paid through the termination date, and we'll ensure a smooth transition if you choose to move services. No cancellation penalties or hidden fees. We would rather earn your renewal through the value we provide than lock you in.
Have More Questions?
Schedule a free consultation to discuss your TPA's specific IT and cybersecurity needs.
Book Free Consultation (opens in new tab)