How to Answer a Plan Sponsor Cybersecurity Questionnaire
Your biggest client just sent one. Here's what they're asking, why, and how to turn it into a competitive advantage.
The trend: Plan sponsors have a fiduciary duty to evaluate your cybersecurity. These questionnaires are becoming annual, more detailed, and non-negotiable. The TPAs that answer confidently don't just retain clients — they win new ones.
This Is Happening to TPAs Right Now
Your largest plan sponsor sends an email with a 15-page cybersecurity questionnaire attached. They need it back in 30 days. The questions are specific, technical, and unforgiving: Do you have a formal cybersecurity program? Can you provide a SOC 2 Type II report? What is your incident response plan? How do you handle encryption? When was your last penetration test?
If your stomach drops when you read those questions, you're not alone. But you need to understand why this is happening and what it means for your business.
Why Plan Sponsors Are Asking
Plan sponsors have a fiduciary duty under ERISA to evaluate the cybersecurity practices of every service provider that touches participant data. The DOL made this explicit in their "Tips for Hiring a Service Provider" guidance, and the January 2026 elevation of cybersecurity to a National Enforcement Project has made plan sponsors acutely aware of their exposure.
These questionnaires aren't a one-time compliance exercise. They're becoming annual, and they're getting more detailed every year. Plan sponsors who don't conduct cybersecurity due diligence on their TPAs are themselves at risk of DOL enforcement action.
The Questions They're Asking
While every questionnaire is different, the core questions map directly to DOL's 12 cybersecurity best practices. Plan sponsors typically want to know whether you maintain a written cybersecurity policy, whether you conduct annual risk assessments, whether you can provide SOC 2 or equivalent third-party audit results, who is responsible for cybersecurity at your firm, how you control access to participant data, how you vet your own vendors' security, whether you conduct employee security awareness training, how you handle system changes and updates, what your disaster recovery and business continuity plans look like, how you encrypt data at rest and in transit, what technical security controls you have in place, and what your incident response procedures are if a breach occurs.
Where the Questions Come From: DOL’s Six Hiring Tips
Two EBSA documents shape what plan sponsors ask. The 12 Cybersecurity Program Best Practices describe what a service provider’s program should contain. EBSA’s Tips for Hiring a Service Provider with Strong Cybersecurity Practices (opens in new tab) tell plan sponsors what to ask and what to put in the contract. The second is written directly for plan sponsors, which is why its questions are worth knowing before a questionnaire arrives:
| EBSA tip to plan sponsors | How it shows up in the questionnaire | Evidence to have ready |
|---|---|---|
| 1. Ask about security standards, policies, and audit results, and look for a recognized standard validated by an outside auditor | Which framework do you follow? Can you send your most recent independent audit? | A written security policy that names its framework (for example, the NIST Cybersecurity Framework) and a current third-party audit such as a SOC 2 Type II report |
| 2. Ask how the provider validates its practices, and secure a contract right to review audit results | How often are your controls tested, and will you share the results each year? | An annual testing schedule, penetration test executive summaries, and a willingness to grant audit-review rights |
| 3. Evaluate the provider’s track record, including public information on security incidents, litigation, and legal proceedings | Have you been involved in any security-related litigation or regulatory proceedings? | A short, accurate disclosure statement. Assume the sponsor will also search public breach filings, like those collected in our TPA breach reports |
| 4. Ask about past breaches: what happened and how the provider responded | Have you had a security incident? What changed afterward? | An incident log summary, post-incident reviews, and evidence the remediation was completed |
| 5. Ask whether insurance covers cybersecurity and identity theft losses, including insider misconduct and outside account takeover | What cyber coverage do you carry, and does it cover employee misconduct and hijacked participant accounts? | A certificate of insurance, policy limits, and confirmation of what the policy actually covers. See what carriers now require |
| 6. Require ongoing security compliance in the contract, and watch for clauses that limit the provider’s responsibility for breaches | A security addendum: annual third-party audit, confidentiality, breach notification timing, legal compliance, and insurance | Contract language you can accept as written, and a notification window you can actually meet. See the 72-hour clause |
The contract terms in tip 6 are specific. EBSA suggests sponsors require an annual third-party audit, spell out confidentiality and use-of-information obligations, state how quickly the provider must report a breach and cooperate in the investigation, require compliance with privacy, security, and records-retention laws, and consider professional liability and errors and omissions coverage, cyber liability and privacy breach insurance, and a fidelity bond or blanket crime coverage. A TPA that has already decided which of those terms it can accept answers the questionnaire, and negotiates the contract, far faster.
Answer With Evidence, Not Adjectives
“We take security seriously” does not answer anything. Strong responses share a few habits:
- Attach the proof. Reference the policy, report, or test result behind each answer, with its date.
- State the scope. Say which systems and locations an audit or control covers, including any that hold participant data outside your main environment.
- Be candid about gaps. A gap with an owner and a remediation date reads better than an answer the sponsor later finds to be untrue.
- Keep an answer library. Maintain approved answers mapped to the 12 DOL practices, with one owner and a set review date, so each new questionnaire takes days instead of weeks.
The Wrong Way to Respond
The worst thing you can do is scramble to assemble answers from scratch. Pulling documentation together under pressure leads to vague responses, missing evidence, and inconsistencies that erode plan sponsor confidence. If your answers read like they were written the week the questionnaire arrived, plan sponsors will notice.
The Right Way to Respond
TPAs that answer cybersecurity questionnaires confidently share one trait: they maintain audit-ready documentation continuously, not reactively. Their cybersecurity policy is current. Their risk assessment was completed within the last 12 months. Their SOC report is on file. Their incident response plan has been tested. When the questionnaire arrives, they pull pre-existing documentation off the shelf rather than creating it under deadline pressure.
This isn't just about compliance. It's a competitive advantage. TPAs that can respond to cybersecurity questionnaires quickly, thoroughly, and with supporting documentation don't just retain existing clients — they win new ones. In a market where plan sponsors are actively evaluating whether their current TPA can meet DOL expectations, your cybersecurity posture becomes a differentiator.
How TPAIT Helps
TPAIT maintains your cybersecurity documentation as part of our ongoing service — not as a scramble when a questionnaire arrives. Your security policies, risk assessments, access control documentation, incident response plans, and compliance evidence are organized and current at all times. When a plan sponsor sends a questionnaire, you respond with confidence instead of panic.
For a detailed breakdown of what DOL expects, see our DOL Cybersecurity Compliance Guide.
Common Questions
Are plan sponsors required to send TPAs a cybersecurity questionnaire?
ERISA requires plan fiduciaries to prudently select and monitor their service providers, and EBSA’s Tips for Hiring a Service Provider tell sponsors to ask about security standards, audit results, past breaches, and insurance. The DOL does not prescribe a specific form, but a written questionnaire is a common way for sponsors to document that diligence.
Will a SOC 2 report answer the whole questionnaire?
It answers a large part of it. EBSA’s first tip points sponsors to annual third-party audit reports covering information security, availability, processing integrity, and confidentiality. Sponsors still ask about breach history, insurance, contract terms, and notification timing, which an audit report does not cover.
What insurance do plan sponsors ask TPAs about?
EBSA’s tips list professional liability and errors and omissions coverage, cyber liability and privacy breach insurance, and fidelity bond or blanket crime coverage. They also tell sponsors to confirm the policy covers cybersecurity incidents involving the plan, including breaches caused by the provider’s own employees and by outsiders taking over participant accounts.
Key Takeaways
Don't Scramble
Maintain audit-ready documentation continuously, not reactively when a questionnaire arrives.
Know the 12 Practices
Every question maps to DOL's 12 cybersecurity best practices. Master them and you master the questionnaire.
Turn Compliance Into Sales
Strong security documentation differentiates your TPA from competitors during plan sponsor evaluations.
Turn Cybersecurity Due Diligence Into Your Competitive Edge
Get a free assessment of your current security posture — and the documentation to prove it.
Book Free IT & Cyber Assessment (opens in new tab)