DOL Cybersecurity Readiness Checklist for TPAs

The Department of Labor’s Cybersecurity Program Best Practices (opens in new tab) set out 12 practices EBSA says plan service providers, including TPAs, should follow. With cybersecurity a formal National Enforcement Project since January 2026 (opens in new tab), these are the practices an EBSA document request is likely to probe.

Scoring: Yes = fully implemented and documented. Partial = in progress or undocumented. No = not in place. Click any practice name for implementation guidance.

The 12 DOL EBSA cybersecurity best practices — TPA self-assessment

Practice	Yes	Partial	No
1. Formal, Documented Cybersecurity Program Written program covering your entire TPA, approved by senior leadership, reviewed at least annually, with defined scope and governance.	Yes	Partial	No
2. Annual Risk Assessments Documented evaluation of threats to participant data, systems, and operations — with remediation plans.	Yes	Partial	No
3. Annual Third-Party Audit of Security Controls An independent audit of your security controls every year (for example, a SOC 2 Type II), with weaknesses documented and fixed.	Yes	Partial	No
4. Clearly Defined Security Roles Named individual(s) responsible for cybersecurity decisions, incident response, and compliance oversight.	Yes	Partial	No
5. Strong Access Control Procedures MFA on all internet-exposed systems, phishing-resistant where possible. Least privilege. Access reviews at least every three months.	Yes	Partial	No
6. Third-Party Vendor Security Reviews Documented due diligence on every vendor touching participant data — recordkeepers, payroll, IT providers.	Yes	Partial	No
7. Cybersecurity Awareness Training Training for all personnel at least annually, updated for current risks, plus phishing simulations and documented completion rates.	Yes	Partial	No
8. Secure System Development Life Cycle Secure development and change management, account-change alerts, extra checks before distributions, regular vulnerability scans and annual penetration tests.	Yes	Partial	No
9. Business Resiliency Program Business continuity, disaster recovery and incident response plans, tested annually, with defined RTO/RPO for critical TPA systems.	Yes	Partial	No
10. Data Encryption AES-256 encryption at rest. TLS 1.2+ in transit. Encrypted backups with separate key management.	Yes	Partial	No
11. Strong Technical Controls Up-to-date systems, firewalls and intrusion detection, EDR/MDR, routine patching and backups, network segmentation, system hardening, 24/7 monitoring.	Yes	Partial	No
12. Responding to Incidents Procedures to inform law enforcement and your insurer, investigate, notify affected participants without unreasonable delay, meet contractual notice duties and fix the cause.	Yes	Partial	No

What to Do with Your Gaps

Every Partial or No is an item EBSA investigators, plan-sponsor due-diligence questionnaires, and cyber-insurance underwriters can ask you to explain. Our DOL Cybersecurity Compliance Guide covers what each practice requires and how to implement it in a TPA environment, and our plan sponsor questionnaire guide shows how to present your posture to clients.