Archived Insight | April 25, 2019

Incident Response Plans: Be Prepared for a Data Breach

As plan fiduciaries, sponsors are ultimately responsible for data protection. That’s true even when day-to-day cybersecurity is delegated to the third-party administrator (TPA) handling benefits administration.

That’s why it’s important for sponsors of plans with outsourced administration to oversee cybersecurity and create an incident response plan.

Have a question? We have answers.

Send us a message. 

Speak with Us

Key aspects of cybersecurity oversight

Thorough oversight of outsourced cybersecurity includes these steps:

It’s also important for plan sponsors with outsourced administration to have an incident-response plan they can follow in the event of an actual data breach.

What to include in an incident response plan when you've outsourced to a TPA

You'll need an incident response plan even if you've outsourced all of your administration tasks to a TPA. To develop a meaningful incident response plan in this scenario, address all of the following:

Be prepared — and avoid finger-pointing

Monitoring outsourced cybersecurity gives you confidence that your plan data is being adequately protected.

Creating an incident response plan helps ensure you’ll be prepared to respond if plan data is breached. If you’ve outsourced functions to more than one vendor, having an incident response plan will help avoid finger-pointing among vendors in the event of a breach.

Read other insights

Male Therapist Encourages Distressed Male Veteran

MHPAEA Litigation and Enforcement News

See the Mental Health Parity and Addiction Equity Act (MHPAEA) litigation on hold and enforcement considerations, plus next steps for plan sponsors.
Worried Mature Man Calculating Domestic Bills At Home

Most Plans Remain Green as 2025 Brings Market Uncertainty

How did multiemployer pension plans perform in 2024? Find out in our infographic illustrating key data from Segal’s survey of 181 calendar-year plans.
Businesswoman Reviewing Finance Charts In The Office

Model Pension Plan's Funded Status Decreases by 3 Points

In Q1 2025, the funded status of our model private sector single-employer pension plan fell 3 points to 107%. Learn why in the latest Prism.

This page is for informational purposes only and does not constitute legal, tax or investment advice. You are encouraged to discuss the issues raised here with your legal, tax and other advisors before determining how the issues apply to your specific situations.