Secure and Resilient System Development and Operations

September 3, 2026

Article Summary

Retirement plan sponsors are expected to take steps to ensure the applications and systems they are using to support their plan are developed and maintained securely.
It is essential to build resilient systems that can respond to and recover from incidents that would negatively impact operations or the confidentiality, integrity, or availability of participant data.
For plan sponsors that do not develop their own applications, it is important to ensure third-party service providers are building secure and resilient applications.

As part of the previous Articles in this series, we discussed the importance of a robust cybersecurity program in a retirement plan. We elaborated on the role that a regular risk assessment plays and outlined a few strong security practices surrounding access management and service provider oversight. This article introduces two new best practices focused on secure system development practices and strong resiliency in your system and operations. This article, and the series as a whole, is an effort to inform retirement plan sponsors about the expectations for cybersecurity set by the Department of Labor’s (DOL) Employee Benefits Security Administration and offer additional insight obtained through Larson’s experience performing information security audits.

ENSURING A SECURE SYSTEM DEVELOPMENT LIFECYCLE PROGRAM

Building Systems Securely

When we refer to the systems that we use within an organization, what we really mean is the combination of individual parts that help us accomplish our goals. It is likely that over time we will find new or better ways to complete certain tasks, and as such, implement changes to these systems to help them run more smoothly. A secure system development lifecycle program provides assurance that as these changes come up, they will not introduce any updates that threaten the confidentiality, integrity, or availability of plan participant data.

For retirement plan applications developed in-house, there are a few best practices that should be followed where possible. These include things like:

Ensuring developers are focusing their time and attention on changes that have been requested or approved by management.
Ensuring that any new code is reviewed by an individual other than the code’s original author before it is added to the system.
Performing quality assurance tests on changes before they are implemented to ensure they will not negatively impact the security or functionality of the application.
Performing monitoring activities on the system as a whole to ensure it continues to operate as intended.

Additionally, retirement plan applications developed in-house or acquired from third-party service providers should generate alerts when a participant's account information is changed. The system should also require additional validation when a distribution is requested shortly after personal information has been updated, or for full-balance distributions (other than rollovers).

Testing and Monitoring

Secure system development includes continuous validation to help guard against unknowingly introducing vulnerabilities into your system or correcting any that have been introduced. Any system built in-house or purchased from an external service provider should be continuously monitored for suspicious user behavior and should promptly report any anomalies. Logs should be maintained to track activity within the system, and a regular review of these logs should be performed to identify, address, and remediate any incidents that have occurred.

In addition to these monitoring activities, organizations should take an active role in identifying security flaws by implementing regular vulnerability scans and penetration tests.

Vulnerability scans check for common ways in which attackers would exploit or gain access to a system, catalog any findings in a report, and assign a score to each one indicating how much of a threat it poses. A robust cybersecurity program ensures that these scans are performed at regular intervals and that any findings are promptly and appropriately addressed.

While vulnerability scans might identify ways in which the system could be exploited, a penetration test will deliberately exploit these vulnerabilities to try to gauge just how much damage could be done by an attacker. These tests are typically performed by external organizations and are done within the scope and parameters set beforehand. Professional penetration testers will take on the role of an attacker trying to gain access to your system and will compile a report of their findings, including the methods they used. Such tests can provide valuable insight into the gaps of your cybersecurity program and should be performed at least annually, especially for customer-facing applications.

what is Resiliency?

Even systems that are secure and well tested will eventually face disruption. For this reason, it’s important to build systems that are resilient in addition to being secure. Resiliency in cybersecurity is the ability to anticipate, respond to, and adapt to current and future incidents that affect the confidentiality, integrity, and availability of your systems with minimal impact to operations.

Key components of an organization’s Business Resiliency Program are the Business Continuity Plan and Disaster Recovery Plan, which are formally documented procedures that the organization will follow in the event of an incident. These plans are created from the insight gained from a Business Impact Analysis, an exercise where key leaders assess the impact a disruption in business would cause, whether this comes from a cyber event, natural disaster, failure in the supply chain, or any other event that has a similar impact. The goal of the analysis is to establish two key metrics: the Recovery Time Objective and the Recovery Point Objective.

The Recovery Time Objective (RTO) is used to determine the maximum amount of downtime the organization can absorb before the impact of the outage becomes critical to the business.

The Recovery Point Objective (RPO) is the maximum amount of data that the organization could tolerate losing. Frequent backups of data help to ensure a low RPO is maintained.

Business Continuity

The Business Continuity Plan consists of formally documented procedures that an organization can follow after an incident to recover and resume operations at an acceptable level. The Business Continuity Plan mainly focuses on the high-level practices done to keep operations running and typically includes specific assignments and activities that help ensure the business continues to run through or shortly after an event.

Disaster Recovery

The Disaster Recovery Plan is focused mainly on restoring the IT infrastructure and essential applications in the event of major disruption. This plan is usually more granular, pointing to specific backups or components to be reset, along with individuals responsible for different aspects of the plan.

An important aspect of a Business Resiliency Program is periodically testing to ensure the business continuity and disaster recovery plans have effective and appropriate procedures, and that the relevant personnel are trained and well prepared to respond to events as they happen. These tests might involve running through simulated scenarios or disasters and should be conducted at least annually.

ADDITIONAL CONSIDERATIONS FOR THIRD-PARTY SERVICE PROVIDERS

In cases where retirement plan sponsors rely on applications developed and provided by third-party service providers, it is important that they gain a reasonable level of assurance that these applications will be developed securely and are built to be resilient. Contracts with vendors should include Service Level Agreements (SLAs) that offer commitments for consistent uptimes. Furthermore, reviewing compliance reports, such as a System and Organization Control Report (SOC 1 Type 2).

SOC 1 reports can provide additional insight into the software development practices and resilience strategies taken by vendors. Reviewing such reports before engaging a service provider should be standard practice.

Additionally, it is important for retirement plan sponsors to ensure that, as part of their agreement, vendors are required to disclose any breaches or major incidents that could impact the data stored in the application.

FINAL THOUGHTS

It is important to recognize that cybersecurity goes beyond having strong passwords and checking for phishing emails (although those are important); it also considers all facets of operations, including how we ensure the systems and applications we use are safe, and that we are able to respond to and recover when incidents happen. A secure system development lifecycle builds security directly into the system, and resiliency helps facilitate a speedy return to operations when disruptions occur. Taken together, plan sponsors can provide assurance that plan participants will have strong and reliable protections for their retirement plans.

FREQUENTLY ASKED QUESTIONS ABOUT SECURE SOFTWARE DEVELOPMENT AND SYSTEM RESILIENCY

Do plan sponsors need to be concerned with secure development practices if they don’t develop their own software?

It’s not uncommon for plan sponsors to rely on third-party applications that can fit their needs. In these cases, it’s still essential that they take reasonable steps to ensure these applications are developed securely. Many third-party organizations will offer these assurances in the form of compliance reports like SOC 2. These reports are performed by external auditors, outline controls that service providers have in place around software development and offer an overall opinion on whether the controls are designed appropriately and are operating effectively (Type 2 report). Reviewing these reports during vendor selection and regularly thereafter is a great way for plan sponsors to meet DOL expectations for service provider oversight.

Are shorter RTOs and RPOs always better?

Having a lower Recovery Time Objective and Recovery Point Objective is not always the right decision for an organization. Determining where to set the RTO and RPO is a balancing act of resources that measures greater resilience and quicker recovery against the cost that these can incur. Lower RTOs and RPOs will usually mean more frequent backups and redundant systems, which can offer diminishing returns as the cost to implement them increases. This is why it’s important to evaluate these tradeoffs in the Business Impact Analysis and decide what your organization can tolerate in case of disruption.

What should plan sponsors look for in a SOC 1 report when evaluating a service provider’s system security and resiliency?

A SOC 1 report is split into different sections that each provide different information to a reader of the report. Some of the most useful sections for plan sponsors to carefully review are sections III and IV. Section III provides a description of the system operated by the service organization, including the services provided, relevant business processes, and any complimentary user entity controls. Plan sponsors should review this section to understand how transactions are processed and what responsibilities remain with their organization. Section IV lists the controls the service organization has adopted, and in a Type 2 report, includes the results of testing performed by the auditor, as well as any exceptions identified. In some cases, a report may include Section V, where the service organization responds to the exceptions noted, or provides additional information and context.