CEFEX Certification for TPAs: The IT Requirements You Need to Know
CEFEX certification demonstrates fiduciary excellence to plan sponsors. Here's what technology controls the certification process evaluates.
CEFEX (Centre for Fiduciary Excellence) certifies TPAs against its Service Provider Standard of Practice, giving the plan fiduciaries they serve independent assurance that industry best practices are in place — including a practice on information systems and security.
What Is CEFEX Certification?
CEFEX — the Centre for Fiduciary Excellence (opens in new tab) — provides independent certification for investment stewards, advisors, recordkeepers, and Third-Party Administrators. For TPAs, the Administration Services Certification covers administrative work such as compliance testing and Form 5500 filings. The Service Provider Standard of Practice (opens in new tab) does not treat administration firms as fiduciaries; it certifies that they follow the industry’s best practices, which gives the fiduciaries they serve added assurance.
In a market where plan sponsors are conducting increasingly rigorous due diligence on their service providers, CEFEX certification provides a third-party validation that can differentiate your TPA from competitors who rely on self-attestation alone.
How CEFEX Evaluates Technology and Cybersecurity
The Standard of Practice has seventeen practices covering how a recordkeeping or administration firm is run. Technology sits in Practice 1.4, which asks whether information systems and technology “have a strong infrastructure, staff support and are adequately secured.” Its criteria look for a well-documented technology plan, backup procedures and disaster recovery plans, up-to-date technology supported by qualified staff, and processes that protect client assets and information from theft and embezzlement.
CEFEX also offers an optional DOL Cybersecurity Verification (opens in new tab), which it describes for advisors and recordkeepers: the CEFEX analyst reviews documents and records showing that the firm follows DOL’s cybersecurity best practices.
The Overlap with DOL’s Cybersecurity Best Practices
DOL’s 12 cybersecurity best practices go much further than CEFEX’s technology practice, so the overlap runs mostly one way. A TPA that follows DOL’s best practices will already have what Practice 1.4 looks for: a documented technology plan, tested backups and disaster recovery, qualified support and protection of client information. The reverse is not true; CEFEX certification on its own does not show that a firm follows all 12 DOL practices, which is what the optional DOL Cybersecurity Verification is meant to check.
This means that building your cybersecurity program on DOL’s best practices serves a dual purpose: it meets what EBSA and plan sponsors expect, and it produces the technology evidence a CEFEX assessment will review.
What TPAs Need to Prepare
If your TPA is considering CEFEX certification, your IT infrastructure preparation should include ensuring your cybersecurity program is documented, current, and independently verifiable (SOC 2 Type II is the gold standard), demonstrating that your data protection measures meet or exceed industry standards, maintaining tested disaster recovery and business continuity plans with documented RTO and RPO targets, showing evidence of regular employee cybersecurity training with completion tracking, having vendor security assessments on file for every third party that touches participant data, and documenting your technology governance structure with clearly defined roles and responsibilities.
CEFEX as a Competitive Differentiator
For TPAs competing for plan sponsor business, CEFEX certification is a tangible proof point that goes beyond marketing claims. When a plan sponsor evaluates two TPAs — one with CEFEX certification and one without — the certified firm has an independent third-party validation of their fiduciary practices. In a market increasingly driven by due diligence and compliance documentation, that distinction can be decisive.
How TPAIT Supports CEFEX Readiness
TPAIT's cybersecurity and managed IT services are built on DOL’s cybersecurity best practices, and they produce the technology documentation, controls and procedures a CEFEX assessment reviews. If your firm is pursuing CEFEX certification — or wants to meet that standard even without formal certification — we can help ensure your technology infrastructure is ready.
Start with our DOL Cybersecurity Compliance Guide to assess your current compliance posture against the 12 EBSA best practices.
Key Takeaways
DOL + CEFEX Overlap
Following DOL’s cybersecurity best practices produces the technology evidence a CEFEX assessment reviews.
Competitive Edge
Independent third-party validation that goes beyond marketing claims during plan sponsor evaluations.
Start with DOL Guide
The 12 EBSA best practices are the best starting point for CEFEX’s technology practice, and they go further.
Build the IT Foundation for Fiduciary Excellence
Whether you're pursuing CEFEX certification or simply meeting the standard, start with a free assessment.
Book Free IT & Cyber Assessment (opens in new tab)