Cybersecurity for Multiemployer Plans
Insider Insights for Multiemployer Plans | April 17, 2026 | 3-minute read
Featuring Lisa Gomez, former Assistant Secretary of Labor, Employee Benefits Security Administration (EBSA)
Key Takeaways
Cybersecurity is no longer just an IT issue. Trustees and fund offices are expected to oversee cyber risk as part of their fiduciary responsibilities.
Vendors can’t carry this alone. Fiduciaries must monitor service providers and maintain their own internal controls.
Regulators focus on process and proof, so documented policies, reviews, and oversight matter.
Risk can’t be eliminated, but strong governance helps plans prevent, detect, and respond.
Why Cybersecurity Matters for Multiemployer Plans
In Zenith American Solutions’ webinar “Cybersecurity for Multiemployer Plans: Fiduciary Obligations and Risk Management,” the message was clear: protecting plan assets and participant data is part of good governance.
Multiemployer plans hold sensitive participant information, financial data, and benefit payments, which makes them attractive targets. Their complex structure, reliance on multiple service providers, and connections to numerous employers add further exposure. As a result, fiduciaries are increasingly expected to treat cybersecurity as part of their overall risk management responsibilities.
Common Threats
Phishing and social engineering
Unauthorized distributions or account access
Vendor and third-party breaches
Ransomware
Compromised participant information
Weak password or authentication practices
External attacks get the most attention, but incidents can also start with internal processes, employee actions, or inadequate controls.
Why Fiduciaries Own the Risk
Cybersecurity isn’t solely the job of IT teams or vendors. Trustees and fiduciaries are expected to understand the risks, set up oversight, and make sure safeguards are in place. Good governance helps protect plan assets, participant information, benefit payments, business operations, and fiduciary reputation.
Vendor Oversight Is Necessary, but Not Enough
Plans rely on administrators, consultants, recordkeepers, and other providers to manage critical functions. Those providers secure their own systems, but fiduciaries can’t outsource responsibility. Effective oversight includes:
Ongoing vendor monitoring
Security reviews and assessments
Clear contractual expectations
Internal controls within the fund office
Defined accountability for cybersecurity oversight
A strong vendor doesn’t eliminate the need for internal cybersecurity practices.
Documentation: Your Proof of Prudence
When regulators evaluate a cybersecurity program, they often focus on process, oversight, and documentation. Plans should be able to show:
Cybersecurity policies and procedures
Governance and oversight activities
Vendor review processes
Risk assessments
Employee training
Incident response planning
Frequently Asked Questions
Are we responsible for cybersecurity if we use reputable vendors?
Yes. Vendors are responsible for securing their own systems, but fiduciaries remain responsible for monitoring them. Plans should be able to show that cyber risks are actively managed, regardless of who does the operational work.
What should we have in place today?
Needs differ by plan, but the checklist below covers what regulators generally expect to see.
Your Cybersecurity Governance Checklist
Establish a formal cybersecurity program and governance framework.
Define roles, responsibilities, and accountability.
Conduct regular risk assessments.
Review vendor security practices and controls.
Implement multi-factor authentication where appropriate.
Train staff to recognize phishing and fraud attempts.
Develop and test an incident response plan.
Document oversight activities and reviews.
How Strong Governance Reduces Risk
Most cybersecurity risks can’t be eliminated, but they can be managed. Plans with clear accountability, strong controls, vendor monitoring, and documented decisions are better positioned to identify threats, respond to incidents, and demonstrate prudent oversight.
Cybersecurity preparedness is less about technology and more about repeatable processes that protect participants and plan operations.
The Bottom Line
Cybersecurity is now a core governance issue for multiemployer plans. Trustees and fiduciaries are expected to oversee risk, monitor vendors, maintain internal controls, and document their efforts. Plans that prioritize this today will be better positioned to protect participant data, reduce operational risk, and respond to regulatory scrutiny.
About Zenith American Solutions' Insider Insights for Multiemployer Plans
Zenith American Solutions' Insider Insights for Multiemployer Plans webinar series delivers timely perspectives on regulatory developments, fiduciary responsibilities, operational best practices, and emerging trends impacting Taft-Hartley and multiemployer plans. Each session is designed to help trustees, fund offices, and industry professionals stay informed and make confident decisions in an evolving benefits landscape.