KUALA LUMPUR (Sept 22): Nearly one-third of record keepers expect to increase their cybersecurity staff, responding to an increased threat of retirement account fraud, according to Boston-based global research and consulting firm Cerulli Associates.

In its latest Cerulli Edge—U.S. Retirement Edition released today, the firm said that implementing an effective cybersecurity program will be essential to fostering a sustainable recordkeeping business and retaining defined contribution plan sponsor clients for the long term.

Cerulli said more than three-quarters (79%) of retirement specialist advisors indicate cybersecurity is a very important factor when selecting a record keeper.

Yet, it said less than two-thirds of small-to-mid-sized plan advisors have a formal written process for conducting due diligence on record keepers’ fraud prevention practices.

It said plan fiduciaries without the in-house expertise to properly evaluate record keepers’ cybersecurity programs and practices should seek to leverage their plan sponsor’s IT specialists or consider working with a third party to aid them through this component of the request for proposal process.

Cerulli senior analyst Shawn O’Brien said it is important for record keepers and plan fiduciaries to acknowledge that an effective cybersecurity program should be more than just an IT initiative.

“Rather, effective cybersecurity practices should permeate every aspect of a provider’s business, including its customer engagements, account management, website development, and data transmission and warehousing,” said O’Brien.

Cerulli said implementing new technologies, such as biometric log-in credentials (i.e., thumb prints or facial recognition), is one part of building an effective cybersecurity practice.

It said to prove effective, providers will need to play an active role in encouraging participants to adopt these technologies and enhance the security of their accounts and personal information on their own.

Furthermore, record keepers should look to evaluate the cybersecurity practices of the service providers with whom they exchange or share participant data.

O’Brien said that ultimately, the greater the number of parties sharing participant data for a given plan, the more complicated securing that data comes.

“Implementing the proper procedures, controls, and software, as well as evaluating the security of shared service providers, are crucial to retaining clients and mitigating reputational damage,” said O’Brien.