Cybersecurity and employee benefit plans: questions and answers

These EBPAQC Qs & As help plan auditors understand cybersecurity risk in employee benefit plans, and to discuss cybersecurity risk, responsibilities, preparedness, and response with plan clients. They address how EBPs are at risk for cyberattacks; what plan information and assets are at risk; potential consequences of a cyber-attack; examples of cyber-threats to EBPs; fiduciary’s responsibilities for protecting plan information and responding to breaches; the plan auditor’s responsibility for evaluating cybersecurity risk and controls in a plan audit; cybersecurity considerations