All 12 EBSA best practices explained with practical implementation steps for Third-Party Administrators. Updated for the January 2026 National Enforcement Project.
By Mike Parker, CEO — nearly 20 years as CIO/CTO at national TPA firmsLast updated: October 4, 2026
January 2026 Update: EBSA named cybersecurity one of six national enforcement projects for fiscal year 2026, alongside mental health and substance use disorder benefits, benefit distributions, retirement asset management, surprise billing and criminal abuse of contributory plans. In FY 2025, EBSA recovered $1.4 billion for plans, participants and beneficiaries, including $714.4 million from its 878 closed civil investigations (EBSA FY 2025 results (opens in new tab)).
In Walsh v. Alight Solutions (7th Circuit, 2022), the court upheld a DOL subpoena for a plan service provider’s cybersecurity records and held that DOL’s investigative authority does not depend on whether the provider is a fiduciary. Your TPA IT security program is squarely within DOL's investigatory authority.
April 2021
DOL issues its first-ever cybersecurity guidance for ERISA plans and service providers.
2022
Walsh v. Alight Solutions (7th Cir.) upholds a DOL subpoena for a plan service provider’s cybersecurity records, whether or not the provider is a fiduciary.
September 2024
Compliance Assistance Release 2024-01 confirms the guidance applies to all ERISA-covered plans, including health and welfare plans.
January 15, 2026
Cybersecurity becomes one of EBSA’s national enforcement projects for fiscal year 2026.
The 12 DOL Cybersecurity Best Practices
EBSA's guidance sets out 12 cybersecurity best practices for recordkeepers and other service providers responsible for plan IT systems and data, which includes TPAs. They are guidance rather than regulations, but plan fiduciaries use them to choose and monitor providers, and EBSA investigators use them as the yardstick (source: DOL EBSA, Cybersecurity Program Best Practices (opens in new tab)). Here's what each one calls for and how to implement it—use the map below to jump to any practice.
What DOL expects: A formal, well-documented cybersecurity program covering your entire organization, not just IT, with policies approved by senior leadership, reviewed at least annually, explained to users and covering areas from access control and incident response to vendor management and data disposal.
How to implement: Create a comprehensive Information Security Policy aligned with NIST CSF 2.0. Document your security governance structure including who has authority over security decisions. Review and update at least annually or after any significant change to your environment.
2. Annual Risk Assessments
What DOL expects: A prudent annual risk assessment, with a documented scope, method and frequency, that identifies internal and external threats to participant data, systems and operations, shows how existing controls address them, and is kept current as systems and threats change.
How to implement: Conduct annual risk assessments that identify threats specific to TPA operations—unauthorized access to participant PII, ransomware attacks during compliance testing season, vendor compromise. Document findings and remediation plans with timelines.
3. Annual Third-Party Audit of Security Controls
What DOL expects: A reliable annual third-party audit of your security controls. EBSA says it would expect to see audit reports, audit files and penetration test reports, plus documented fixes for any weaknesses found. DOL does not name a report type.
How to implement: Engage an independent auditor to perform SOC 2 Type II examinations annually; it is the most widely accepted way to meet this practice. If a full SOC 2 is cost-prohibitive, start with a SOC 2 Type I or a NIST CSF assessment. Many plan sponsors ask for SOC reports during due diligence—having one ready demonstrates compliance maturity.
4. Clearly Defined Security Roles and Responsibilities
What DOL expects: A cybersecurity program managed at the senior executive level, with named, qualified people responsible for cybersecurity decisions, incident response, and compliance oversight.
How to implement: Designate a security officer (internal or outsourced) with documented authority and accountability. Define roles for incident response, access management, vendor oversight, and training. Ensure your TPA IT provider has clearly defined responsibilities in your service agreement.
5. Strong Access Control Procedures
What DOL expects: Least-privilege access, unique strong passwords, multi-factor authentication (MFA) wherever possible, access reviews at least every three months, prompt removal of former employees’ accounts, and confirming the identity of whoever receives a distribution.
How to implement: Implement MFA on all internet-exposed systems, phishing-resistant where possible (DOL’s best practices now call for phishing-resistant MFA if possible). Conduct quarterly access reviews. Automate account deprovisioning for terminated employees. Restrict administrative access to named individuals only.
6. Third-Party Vendor Security Reviews
What DOL expects: Security reviews and independent assessments of cloud and third-party providers that hold or manage plan data—recordkeepers, software vendors, payroll providers, and IT service providers—with contracts that address access controls, encryption and breach notification.
How to implement: Maintain a vendor inventory with data classification for each. Require SOC 2 reports or equivalent security attestations from all vendors handling participant data. Include cybersecurity requirements in all vendor contracts. Conduct annual vendor risk assessments.
7. Cybersecurity Awareness Training
What DOL expects: Cybersecurity awareness training at least annually for all personnel, updated for the risks found in the latest risk assessment, with identity theft and fraudulent distributions as key topics.
How to implement: Deploy monthly phishing simulations and quarterly security awareness training. Track completion rates and remediate failures. Training should cover TPA-specific scenarios: fraudulent distribution requests, impersonation of plan sponsors, and social engineering targeting participant data.
8. Secure System Development Life Cycle (SDLC)
What DOL expects: Secure development for in-house applications, including alerts when account information changes, extra validation when personal information changes before a distribution, and extra validation for full-balance distributions other than rollovers; testing of externally developed applications; regular vulnerability scans; and annual penetration tests, particularly of customer-facing applications.
How to implement: Document change management procedures for all system modifications. Test changes in a staging environment before production deployment. Maintain audit trails for all configuration changes to TPA administration systems.
9. Business Resiliency Program
What DOL expects: A business resiliency program with a business continuity plan, a disaster recovery plan and an incident response plan, tested annually, including protocols to notify plan sponsors and affected users if needed.
How to implement: Maintain immutable backups with tested recovery procedures. Define Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) for critical TPA systems. Test disaster recovery annually—ideally with a tabletop exercise simulating ransomware during year-end compliance testing season.
10. Data Encryption
What DOL expects: Encryption of sensitive data, stored and in transit, using current, prudent standards.
How to implement: Encrypt all storage volumes containing participant data (AES-256 minimum). Use TLS 1.2+ for all data transmission. Encrypt email communications containing PII. Encrypt backup data and verify encryption on offsite replicas.
11. Strong Technical Controls
What DOL expects: Technical controls in line with best security practices: up-to-date hardware and software, vendor-supported firewalls and intrusion detection, current antivirus, routine (preferably automated) patching and backups, network segregation, and system hardening. DOL does not name a framework.
How to implement: Align your security controls with a recognized framework such as NIST CSF 2.0 or NIST 800-53. Deploy endpoint detection and response (EDR) on all devices. Implement network segmentation (VLAN isolation) between administrative and production environments. Maintain 24/7 security monitoring through a SOC/MDR service.
12. Responding to Cybersecurity Incidents
What DOL expects: Appropriate action when an incident happens: informing law enforcement, notifying the insurer, investigating, notifying affected participants, giving plans and participants the information they need to reduce harm, honoring contractual and legal notice obligations, and fixing the cause. (The written incident response plan itself belongs to practice #9.)
How to implement: Create a documented incident response plan that defines severity levels, escalation paths, containment procedures, and notification timelines. DOL’s best practices call for notifying participants of unauthorized acquisition of their personal data “without unreasonable delay.” Include contact information for legal counsel, cyber insurance carriers, and law enforcement. Test the plan annually with tabletop exercises.
What Happens During a DOL Cybersecurity Examination
When EBSA investigators examine a plan's cybersecurity practices, they typically issue a document request letter asking for your cybersecurity policy, most recent risk assessment, SOC reports or third-party audit results, access control documentation, incident response plan, employee training records, vendor security assessments, and evidence of encryption and monitoring.
TPAs that cannot produce organized documentation face extended investigations and potential enforcement actions. The TPA firms that maintain audit-ready documentation—updated continuously, not assembled after receiving a request letter—demonstrate the compliance maturity that DOL expects.
Common Questions
What are the DOL's 12 cybersecurity best practices for TPAs?
EBSA’s 12 cybersecurity best practices, written for recordkeepers and other plan service providers such as TPAs, call for: (1) a formal, well-documented cybersecurity program, (2) prudent annual risk assessments, (3) a reliable annual third-party audit of security controls, (4) clearly defined security roles, (5) strong access controls, (6) security reviews of cloud and third-party providers, (7) cybersecurity awareness training at least annually, (8) a secure system development life cycle, (9) a business resiliency program covering continuity, disaster recovery and incident response, (10) encryption of sensitive data, (11) strong technical controls, and (12) an appropriate response to cybersecurity incidents. They are guidance, not regulations.
When did DOL cybersecurity become a National Enforcement Project?
On January 15, 2026, EBSA announced its national enforcement projects for fiscal year 2026, and cybersecurity is one of six priority areas. This followed the September 2024 guidance update confirming that the best practices apply to all ERISA-covered plans, including health and welfare plans.
Can the DOL audit a TPA's cybersecurity practices?
Yes. In Walsh v. Alight Solutions (7th Circuit, 2022), the court upheld a DOL subpoena for a service provider’s cybersecurity records and held that DOL’s investigative authority does not depend on whether the provider is a fiduciary. EBSA investigators can request cybersecurity policies, risk assessments, audit reports, and incident response plans from TPAs during plan examinations.
TPAIT's TPA IT services are designed around these 12 best practices from the ground up. Our cybersecurity program addresses every DOL best practice with documented controls, continuous monitoring, and audit-ready reporting. We maintain the documentation, run the assessments, deploy the technical controls, and coordinate with your compliance team to ensure your TPA meets or exceeds DOL expectations.
We built our services specifically for Third-Party Administrators because we've spent nearly two decades inside TPA operations. We understand that compliance testing season creates different risk profiles than Q1 onboarding, that ESOP valuation transfers require different security controls than routine payroll integrations, and that a 15-minute response time during Form 5500 filing season isn't a luxury—it's a business requirement.
Download the Checklist
Score your TPA against all 12 DOL cybersecurity best practices with our free one-page self-assessment tool.
