TPA IT & Cybersecurity Insights

For Plan Advisers

Cybersecurity Questions to Ask a TPA: A Checklist for Plan Advisers

What to ask a third-party administrator about security, what a strong answer includes, and which answers call for a follow-up.

Incident Response

The 72-Hour Clause: What Amended SEC Regulation S-P Means for TPAs

Advisers and broker-dealers must now make their service providers report breaches within 72 hours. Many TPAs are those providers.

Public Sector

When ERISA Doesn’t Apply: Cybersecurity for Governmental Plan Administrators

Governmental 457(b) and 403(b) plans sit outside ERISA. GovRAMP, TX-RAMP and state addenda set the bar instead.

Data Security

The Connections Nobody Audits: Recordkeeper and Payroll Integration Security

Your firewall gets reviewed yearly. The SFTP account your recordkeeper has used since 2019 does not.

Vendor Risk

You Are the Third Party: Continuous Monitoring and TPA Vendor Risk

Third parties feature in 48% of breaches. Sponsors are moving past the annual questionnaire—what they will ask for next.

Risk Transfer

Cyber Insurance for TPAs: What Carriers Require in 2026

Carriers stopped taking your word for it. What renewal now tests—and why it mirrors your DOL file.

Enforcement

What EBSA Asks For in a Cybersecurity Investigation

The documents investigators ask for—mapped to DOL’s 12 practices—and the 48-hour readiness standard.

Due Diligence

SOC 2 for TPAs: What Plan Sponsors Actually Accept

SOC 1 vs SOC 2, the facility-vs-firm distinction, and a realistic audit path for smaller firms.

Compliance

How to Answer a Plan Sponsor Cybersecurity Questionnaire

Your biggest client just sent one. Here's what they're asking, why, and how to turn it into a competitive advantage.

Cybersecurity

The Human Factor: Why TPA Breaches Start with People

62% of breaches involve the human element. Your firewall doesn't matter when someone clicks a phishing link.

Fiduciary Duty

Every SSN You Hold Is a Fiduciary Obligation

ERISA’s fiduciary duties now reach cybersecurity. The costs of failure are measured in millions.

Industry Expertise

Generic IT vs. TPA-Specialized IT: What Your Firm Is Missing

Every hour your IT provider spends learning your business is an hour you're not serving clients.

Assessment

TPA IT Readiness: A Self-Assessment for Your Firm

Before your next plan sponsor review or DOL inquiry, honestly evaluate where your IT infrastructure stands.

Certification

CEFEX Certification for TPAs: The IT Requirements

What technology and cybersecurity controls the CEFEX certification process evaluates.