Cybersecurity Due Diligence
Evaluate recordkeeper security practices as part of a prudent provider oversight process.
Retirement plans hold sensitive participant information and substantial assets, making cybersecurity an important part of provider selection and ongoing monitoring. PointOak helps plan sponsors incorporate cybersecurity due diligence into a broader fiduciary review of recordkeepers and other plan service providers.
Our role is to help committees ask the right questions, organize provider responses, compare practices, and document the review. PointOak does not perform technical cybersecurity audits or certify a provider's systems.
What We Review
Security Governance & Independent Reporting
We review available information about a provider's security program, including independent reports and assessments, governance practices, and the way cybersecurity responsibilities are managed.
Access Controls & Participant Account Protection
We evaluate available information about authentication, account-access controls, fraud-prevention practices, participant protections, and any reimbursement policies and conditions that may apply after unauthorized account activity.
Account-Reimbursement Policies and Conditions
We review how a recordkeeper describes its response to unauthorized participant-account activity, including reimbursement commitments, exclusions, reporting requirements, and any participant obligations such as account-activity requirements. The terms differ among providers. Our role is to help the committee understand and communicate the actual policy, not to guarantee reimbursement.
Incident Response & Business Continuity
We review how providers describe incident response, breach notification, recovery planning, business continuity, and responsibilities following a cybersecurity event.
Contractual & Insurance Considerations
Where relevant, we help committees identify contractual provisions, insurance information, allocation of responsibilities, and other terms that may warrant further review with legal counsel or other specialists.
How Cybersecurity Due Diligence Fits Into Provider Oversight
Cybersecurity is one component of a broader provider evaluation. PointOak considers it alongside fees, service quality, technology, participant experience, administration, investment flexibility, and contractual terms so the committee can evaluate overall provider fit rather than a single factor in isolation.
Our Process
- 1
Gather
Collect relevant provider materials, responses, policies, reports, and available participant-protection information.
- 2
Evaluate
Review the information within a consistent due-diligence framework and identify areas requiring clarification or follow-up.
- 3
Document
Prepare committee-ready findings that record the information reviewed, questions raised, responses received, and the rationale for any follow-up actions.
- 4
Monitor
Revisit cybersecurity as part of ongoing provider oversight and when material changes, incidents, or contract decisions warrant additional review.
Frequently Asked Questions
Does PointOak perform cybersecurity audits?
No. PointOak provides fiduciary due-diligence support and helps plan sponsors evaluate information supplied by service providers. We do not conduct penetration testing, technical security audits, or cybersecurity certifications.
Is cybersecurity part of recordkeeper selection?
It should be considered as one part of the overall provider evaluation. The appropriate weight depends on the plan, provider relationship, available information, and the committee's broader due-diligence process.
Should cybersecurity be reviewed after a provider is hired?
Yes. Provider oversight is ongoing. Cybersecurity practices, incidents, participant protections, and contractual terms can change and may warrant periodic review.
