The Connections Nobody Audits
Endpoint, email and firewall controls get reviewed every year. The service account your recordkeeper has used for file transfers since 2019 does not — and it is the path a plan sponsor will ask about next.
The short answer: most TPAs can describe their endpoint and email security in detail and cannot produce a list of every external system currently holding a credential into their environment. Plan sponsor due diligence has started asking for exactly that list. Building it is a half-day exercise; being asked for it without one is a bad week.
The DOL’s hiring guidance tells sponsors to require contract terms covering information security reporting, confidentiality, breach notification timing, records retention and destruction, and insurance. Source: EBSA, Tips for Hiring a Service Provider (opens in new tab)
The Inventory You Probably Do Not Have
A working TPA environment typically carries eight categories of external connection. Each is a credential, a data path, and an assumption:
- Recordkeeper file exchange — contribution files out, participant and balance data back, usually over SFTP on a fixed schedule
- Payroll feeds — from the plan sponsor or their payroll provider, often the highest-frequency path and the least formally contracted
- Custodian and trust reporting — statements, trust accounting, reconciliation extracts
- Plan sponsor portals — sponsors logging into systems you host, or your staff logging into theirs
- Advisor and auditor access — frequently granted for a project and never withdrawn
- Document delivery and e-signature — participant notices, distribution paperwork
- Banking and ACH — the path with the most direct financial consequence
- Administration software integrations — the connectors your plan administration platform maintains on your behalf, which you inherit without configuring
The inventory question is not “which of these do we use” but “for each one, who owns the credential, when was it last rotated, what is the least privilege it actually needs, and what happens to it when the relationship ends.”
Where These Break
Service accounts that outlive their purpose. An integration set up during an implementation, owned by someone who has since left, using a password stored in a document. It still works, so nobody touches it. This is the single most common finding.
Shared credentials across counterparties. One SFTP account used by two recordkeepers because it was easier. Now a compromise anywhere is a compromise everywhere, and the transfer log cannot tell you which party did what.
Staging directories nobody purges. Files land, get processed, and stay. Three years later the directory holds a complete census of every participant the firm has ever touched, sitting on the one system most exposed to external connections.
Offboarding that covers people but not integrations. Termination checklists disable user accounts. They rarely mention the API key issued to a vendor whose contract ended eighteen months ago.
The transfer tool itself. The MOVEit exploitation in 2023 is the cautionary case — the vulnerability was in the managed file transfer product, not in anyone’s configuration of it. In the retirement sector, Pension Benefit Information’s exposure of more than a million records reached multiple downstream clients at once. Details are in our TPA breach reports. Patch cadence on transfer infrastructure is not a hygiene metric; it is a concentration-risk control.
Controls Mapped to the Questions You Will Be Asked
Plan sponsor questionnaires are converging on a small set of connectivity questions. Each one has a control behind it and, more importantly, an artifact that answers it.
| What you will be asked | The control | The evidence to keep |
|---|---|---|
| How is participant data transmitted to and from your recordkeepers? | Encrypted transport, key-based authentication, no password-only SFTP | Configuration export or screenshot with a date, per integration |
| Who has standing access to your environment from outside? | Per-integration service accounts, least privilege, named internal owner | The integration register itself, reviewed quarterly |
| How often are credentials rotated? | Documented rotation schedule, keys and certificates alike | Rotation log with dates, not a policy statement |
| What happens to files after processing? | Automatic purge or archive from staging, tied to a retention schedule | Job configuration plus a directory listing showing it works |
| Can you tell us what a given account did last month? | Transfer and authentication logging, retained and searchable | A sample extract you can produce on request |
| How quickly would you notify us of an incident? | A contractual window you can actually meet | The executed agreement clause |
| Who else touches our data? | Subcontractor and fourth-party register with flow-down terms | Current register plus the relevant contract language |
The pattern across that table is the one running through all current due diligence: the question has shifted from whether a control exists to whether you can show it operating. That shift is covered in more depth in You Are the Third Party.
On MFA and Machine-to-Machine Connections
A recurring source of confusion. Multi-factor authentication is built for interactive human logins; it does not map onto an automated nightly transfer, and claiming otherwise on a questionnaire invites a follow-up you will not enjoy. The honest answer is that machine-to-machine paths are protected by credential hygiene — key-based authentication, per-integration accounts, least privilege, scheduled rotation, network restriction — while MFA is enforced on every interactive administrative path to the same systems.
Say it that way. Reviewers who know the subject will find it more credible than a blanket yes, and reviewers who do not will get a clearer answer than they asked for.
A Half-Day Exercise
Build the register before anyone asks for it. One row per external connection, seven columns:
- Counterparty and the business purpose
- Direction and data categories carried
- Protocol and authentication method
- Internal owner — a person, not a team
- Last credential rotation date
- Contract reference and breach-notification window
- Offboarding steps, written before they are needed
Most firms find two or three connections they had forgotten in the first hour. That discovery is the return on the exercise, independent of anything a sponsor ever asks. If your broader posture needs a baseline first, start with the TPA IT readiness assessment, then come back to this.
Frequently Asked Questions
What controls should a TPA have on recordkeeper file transfers?
Key-based or certificate authentication instead of shared passwords, a named owner per service account, documented rotation, IP allow-listing where supported, encryption in transit and at rest, automatic purging of staging directories, and retained transfer logs. Each should leave a dated artifact behind.
Does MFA apply to SFTP and other automated connections?
Not directly — MFA is for interactive logins. The equivalent for automated paths is credential hygiene and network restriction. What reviewers genuinely expect is that no interactive administrative route into the transfer system remains password-only.
How do we offboard an integration properly?
Treat it as an identity: disable rather than immediately delete so logs stay interpretable, revoke keys and certificates, remove allow-list entries, purge or archive residual files under your retention schedule, obtain written confirmation that the counterparty has returned or destroyed data, and record the date.
Can You List Every External Connection?
A free assessment inventories the credentials reaching into your environment and shows which ones would survive a sponsor’s questionnaire.
Book Free IT & Cyber Assessment (opens in new tab)