Working with Vendors on Cybersecurity

Q. What are some steps and approaches we can take toward and with vendors in order to improve cybersecurity?

A. Following are some ideas for how to better ensure cybersecurity when working with outside vendors.

• Identify the vendors that maintain and protect plan data, review their contracts for indemnification provisions, and communicating best practices with participants.
• Implement a structured vendor due diligence process. Document all discussions and considerations related to your cybersecurity due diligence process.
• Check the indemnification language in your vendor agreements.
• Demand that vendors be excellent stewards of your data, and ask that providers spend time explaining their cybersecurity protection and fraud protection programs.
• Look for third-party evaluations of vendors and follow up with them periodically.
• Work with your recordkeeper to communicate and educate employees about security best practices.