What Your RIA Needs Ready Before a DOL Cybersecurity Exam

Key Takeaways

• The DOL issued formal cybersecurity guidance in April 2021 and has included cybersecurity on its examination list for retirement plan service providers since then.
• RIAs managing 401(k) or other retirement plan assets are service providers under ERISA and subject to this guidance, even if they think of themselves only as investment advisors.
• DOL examiners ask for specific written documentation: a security policy, an incident response plan, vendor contracts with security provisions, and evidence of annual reviews.
• Not having a written incident response plan is the single most common finding. Most small RIAs have never drafted one.
• Getting exam-ready takes about 60 days of focused work for a 10-to-30-person firm. Waiting until the exam notice arrives is not enough time.

The letter from the DOL's Employee Benefits Security Administration arrives with about 30 days' notice. It asks for policies, procedures, security assessments, vendor contracts, and training records. Most small RIAs who manage retirement plan assets have exactly one of those five things ready.

That is not a hypothetical. Since the DOL formalized its cybersecurity expectations in April 2021, its examiners have been walking through the same list. The gap between what firms think they need and what examiners ask for has stayed wide.

This post covers what the DOL guidance requires, what examiners look for during an examination, and what your firm needs to have in place before you get that letter.

Why the DOL Issued Cybersecurity Guidance for Retirement Plans

ERISA makes plan fiduciaries responsible for acting prudently on behalf of participants. In practice, that includes how they select and oversee the service providers who touch participant data.

In April 2021, the DOL published three cybersecurity documents targeting different audiences: one for plan fiduciaries hiring service providers, one for record-keepers and investment managers operating as service providers, and one for participants. All three came from the Employee Benefits Security Administration and carry the weight of agency guidance.

The document that matters most to RIAs is the second one: Cybersecurity Program Best Practices. It sets out twelve categories of security practices the DOL expects service providers to maintain. These are not suggestions. DOL examiners use them as a checklist.

Actionable tip: Download DOL's Cybersecurity Program Best Practices from dol.gov/agencies/ebsa and go through the twelve categories with your IT provider this quarter. Mark what you have documented and what you do not. That gap list becomes your project plan.

The Fiduciary Connection

ERISA Section 404 requires fiduciaries to act with the care and skill of a "prudent expert" when managing plan assets. Cybersecurity is now part of that standard. Plan sponsors who hire an RIA that lacks basic security controls can be held liable alongside the advisor for a breach that harms participants.

That is why plan sponsors, especially larger ones with HR or legal oversight, have started including security questions in their vendor due diligence. Some are asking for SOC 2 reports or written security attestations before signing on.

What Changed in 2023

In 2023, the DOL published FAQs clarifying that the 2021 guidance applies to all plan types, including 403(b) plans, governmental plans, and health and welfare plans, not just 401(k) plans. If you manage any type of ERISA-covered plan, the guidance applies to you.

What DOL Examiners Ask For

A DOL cybersecurity examination is not a broad audit of your entire business. Examiners focus on the systems, vendors, and processes connected to plan participant data. Here is what they typically request.

Written Security Policy

Examiners ask for your written information security policy. This is a formal document, not a list of habits. It needs to cover how you protect participant data, who has access, how you authenticate users, and how you respond to a potential incident.

Many small RIAs have never written one. If your security policy is a conversation rather than a document, that is a finding.

Incident Response Plan

This is the most common gap. DOL expects a written plan that describes what your firm does when a breach occurs: who gets notified, in what order, within what timeframe, and what steps you take to contain and assess the situation.

The plan needs to include a timeline. Under ERISA, plan participants are entitled to notification of a breach affecting their data. The DOL does not set a specific hour count the way HIPAA does, but examiners expect you to have thought through what a 24-hour versus 72-hour response looks like.

Actionable tip: Write a one-page incident response plan this week. It does not need to be long. It needs five sections: who declares an incident, who is notified (internal), who is notified externally (participants, regulators, counsel), how data is preserved, and how you document the event. One page done beats a hundred-page template sitting in a folder.

Vendor Contracts with Security Provisions

Examiners ask for the contracts you have with any vendor that accesses participant data: your custodian, your record-keeper, your portfolio management software provider, and your IT support firm. They look for specific security provisions in those contracts: requirements for the vendor to maintain a security program, notify you of a breach, and cooperate with your investigation.

Many vendor contracts do not include these provisions unless you ask. This is worth reviewing with counsel before your next exam notice arrives.

Evidence of Annual Reviews

DOL expects a documented annual review of your cybersecurity program. This means you have records showing that you assessed your controls, identified gaps, and tracked remediation. A review meeting that happened but was never documented does not satisfy the examiner.

I sat in on a review conversation with an RIA last year that had genuinely strong security practices: MFA, encrypted file storage, a decent vendor review process. The problem was none of it was written down. The examiner could not give them credit for what they could not prove on paper.

Training Records

Examiners ask whether staff have been trained on cybersecurity practices and how often. Annual training with attendance records is the floor. Quarterly phishing simulations with tracked results are better. The training needs to cover how to spot phishing, how to handle participant data requests, and how to report a suspected incident.

The Twelve Best Practice Categories

DOL's Cybersecurity Program Best Practices document covers twelve categories. Here is a summary of what each requires, with the ones most likely to generate findings for a small firm marked:

Access Control and Authentication (High Finding Risk)

Multi-factor authentication on all systems that hold participant data. This includes your portfolio management software, email, and any cloud storage where plan documents are kept. Many small RIAs have MFA on email but not on legacy software they have used for years. That is a gap.

Encryption (High Finding Risk)

Participant data must be encrypted at rest and in transit. Data on a laptop that travels to client meetings needs encryption. Data sent by email needs to be in an encrypted portal, not an attachment. If you use a cloud-based file sharing tool, it needs to encrypt at rest.

Penetration Testing and Independent Audits

DOL expects annual or biennial penetration tests. For a small RIA, this is typically a vulnerability assessment combined with a review of your configurations. The test needs to be performed by someone outside your firm and the results need to be documented with a remediation plan.

Actionable tip: If you have never had a third-party vulnerability assessment, schedule one for Q1 of next year. Bring the results report to your annual cybersecurity review meeting. The report itself is part of what examiners want to see.

Vendor Management

Every third-party vendor with access to participant data needs to be reviewed. That review needs to include: what data they access, how they protect it, whether they have had any incidents, and what your contract says about their security obligations. The review should be documented annually.

Disaster Recovery and Business Continuity

Examiners ask whether you can restore plan data if your systems go down. This includes off-site or cloud backups, tested restoration procedures, and documentation showing the last time you tested them. A backup that has never been restored is not a backup in the examiner's view.

How Long It Takes to Get Ready

For a 10-to-30-person RIA with no existing documentation, getting examination-ready takes about 60 days of focused work. That assumes you have competent IT support helping you, which is not always true.

The 60 days breaks down roughly like this:

• Week 1-2: gap assessment against DOL's twelve categories
• Week 3-4: draft written security policy and incident response plan
• Week 5-6: review and update vendor contracts
• Week 7-8: schedule and complete annual cybersecurity review meeting with documentation

This assumes you do not discover major technical gaps, like systems without MFA or unencrypted backup drives. Those add time.

Actionable tip: If you have never had a DOL cybersecurity examination and your practice manages retirement plan assets, treat Q4 as preparation time. A gap assessment now gives you all of Q1 to fix what you find before the spring examination cycle.

If your firm manages retirement assets for clients in the South Florida market and you're not sure where you stand, a free security and compliance assessment can tell you what an examiner would find today.

What Happens If the Examiner Finds Gaps

A DOL cybersecurity examination finding does not automatically mean a fine. The DOL typically issues a Voluntary Compliance Letter or a Notice of Violation. For a first examination with good-faith cooperation, the firm is usually given 90 to 180 days to correct the gaps.

The more serious risk is secondary: a client's plan sponsor receives the examination report. Many plan sponsors are required by their own governance rules to report material findings to their board or investment committee. A finding that your firm lacks a written incident response plan can trigger a request to explain what happened and what you are doing about it. Some plan sponsors use that as grounds to put the relationship out for bid.

The compliance management services that keep firms examination-ready are the same ones that protect client relationships when something goes wrong. The two are not separate.

Frequently Asked Questions

Does this apply to my firm if I only advise on 401(k) plans, not manage the assets directly?

Yes. If you have a service relationship with a plan, access to participant data, or a fiduciary role under ERISA, the DOL guidance applies. Advisory-only relationships do not exempt you from the service provider requirements.

We use a major custodian. Don't their security practices cover us?

No. Your custodian's SOC 2 report covers their systems. It does not cover your firm's systems, your staff's access practices, or your incident response plan. DOL examiners want to see your firm's documentation, not your custodian's.

How often does the DOL examine small RIAs?

The DOL does not publish examination frequency statistics by firm size, but EBSA has expanded its examination program since 2021. Firms managing retirement plan assets for multiple clients are more likely to be examined. A breach or participant complaint can also trigger a targeted examination outside the normal cycle.

Do I need a SOC 2 report to satisfy the DOL guidance?

Not necessarily, but it helps. A SOC 2 Type 2 report provides third-party evidence that your controls are operating as described. Some plan sponsors now ask for it as part of their own vendor due diligence, separate from the DOL examination. If you manage assets for larger institutional clients, it is worth asking whether they expect one.

What is the fastest way to get started if I have nothing documented?

Start with the incident response plan and the vendor contract review. Those are the two items examiners flag most often and both can be addressed quickly. The incident response plan can be drafted in a day. The vendor contract review takes longer but can run in parallel with other work. Having those two items done gets you past the most common findings.

Ready to Know Where You Stand Before the Exam Does?

A DOL cybersecurity examination is not the right time to find out what you are missing. If your firm manages retirement plan assets and you have not done a formal review against DOL's twelve best practice categories, the gap assessment is the first step.

Gradient Data Solutions works with RIAs, CPA firms, and insurance agencies across South Florida to build the documentation and security programs that satisfy compliance requirements and protect client relationships. Our cybersecurity services include gap assessments, written policy development, incident response planning, and annual review support.

Start with a free assessment to see what an examiner would find at your firm today.