Information security and your organization’s retirement plan

Security is a real concern for you and your employees and for companies like Principal^® that manage data and financial accounts. That’s why we work together to help safeguard information and account access.

Three things you can do today to help your employees and yourself

1. Encourage online retirement account access

You may think it’s safer to avoid online account access and transactions, but it’s just the opposite.

For example, when employees set up their Principal retirement accounts online, they set a unique password and activate an extra layer of protection called “two-factor authentication.” Not establishing online access may leave the door open for someone else to do it. 

Other things participants can do to help ward off cybercriminals include: 1) setting up their retirement account to receive transaction updates via text messages and 2) keeping their contact information up to date.

2. Document your retirement plan security policies and procedures

Show that you have a prudent process in place.

If you’re a retirement plan fiduciary, you have responsibilities related to the security of employees’ personal and financial data. And if you’re like your peers, you may be paying more attention to cybercrime.

Put in writing what you’re doing to protect the data and financial assets of the retirement plan. Writing it down can be beneficial in a number of ways, such as making routine procedures easier to repeat. And when you put your cybersecurity plan in writing you can use it confidently if questioned what your policy is—because it’s already documented.

Here's a data security prudent process template (Word) for you to use.

3. Monitor providers and vendors

It’s important that the companies you work with have comprehensive security programs. That includes retirement plan service providers like Principal, your financial professional, and your third party administrator if you work with one. You should find out how they process data and protect personal and account information. Check out all the ways we meet DOL cybersecurity guidance, including their tips and best practices.

Check out a list of data security questions (PDF) to ask a provider

How do retirement plan recordkeepers help protect customer and account information?

In the retirement industry, there’s focus on many aspects of security. Here are some examples of what we do.

• Third-party verification. Checks and balances are important. An independent auditing firm reviews and evaluates our data security controls on an ongoing basis and publishes its findings in a System and Organization Controls 2 (SOC2) report. The report covers controls related to security, confidentiality, and availability of customer data. It confirms we’re helping fiduciaries meet their responsibilities.^1​
  To see the ways we meet/exceed DOL best practices, read a summary of the robust systems we follow to help ensure confidential and sensitive data is kept safe.
• Customer protection. We believe security is as important to you as it is to us, and we encourage our customers to help keep their account access secure. For retirement plan customers, we offer a customer protection guarantee. Our guarantee is simple: Principal^® will reimburse your employer-sponsored retirement account for losses from unauthorized activity occurring through no fault of your own.²
• Online account security. Companies can help by requiring two-factor authentication and strong passwords. We've been recognized with an award by Financial Advisor IQ for the strength of our cybersecurity and privacy standards that help keep investments secure.³
• Secure phone transactions. While many customers rely on websites, many still like to handle transactions over the phone. Our call centers rely on diligent processes and technology to help prevent fraud.