PLANSPONSOR - April/May 2020 - 9

Although the U.S. courts have yet
to decide whether managing cybersecurity
risk is a fiduciary function, the
ERISA Advisory Council has asked the
Department of Labor (DOL) to issue guidance
for plan cybersecurity. In addition,
lawmakers have asked the Government
Accountability Office (GAO) to examine
cybersecurity in the retirement system.
Should a breach or fraud occur, " a
sponsor could be liable if the claimant
establishes that the sponsor failed to follow
a prudent process to safeguard the plan
data, " says Joan Neri, counsel in Faegre,
Drinker, Biddle & Reath's ERISA practice.
Bart McDonough, CEO and founder
of Agio, a managed information technology
(IT) and cybersecurity services
firm, says he sees many retirement plan
fiduciaries doing a lackluster job of monitoring
the cybersecurity performance
of the vendors they work with daily. He
says rather than having providers fill out
a " check-the-box " questionnaire, they
should try to understand specifically
how technology employed by providers is
configured, used and maintained.
But even the strongest due diligence
on the part of plan sponsors cannot guard
against the human element. In its statement
regarding the latest lawsuit, Alight
noted that it offers multifactor authentication
of accounts-for which plan participants
must provide a phone number
or email address when they register for
online access to their account.
Many participants do not register
for online access and may feel that
keeps their account safe. " That can be
misguided, " says Charlie Nelson, CEO of
Voya Retirement. " Fraudsters will sometimes
try to get access to an unregistered
account so they can set the original data
points, such as a phone number or other
piece of information. "
Plan sponsors should make participants
aware of how they can take ownership
of protecting their retirement
accounts.
-John Manganaro and Rebecca Moore
More From Washington
And the Courts
CARES Act Gives
Retirement Plan Relief
The Coronavirus Aid, Relief and
Economic Security (CARES) Act creates a
new emergency retirement plan distribution
option: the coronavirus-related distribution
(CRD). A CRD of up to $100,000
may be drawn from an employer-sponsored
retirement plan such as a 401(k)
or from an individual retirement account
(IRA). Under terms of the act, the normal
10% penalty tax levied on early plan distributions
by the IRS is waived. Further, for
tax purposes, the individual taking a CRD
may spread the reported income over
three years and take three years to repay
it. To request the CRD, participants will
have to self-certify that they either have
contracted COVID-19, that a spouse or
dependent has done so, or that they have
lost a job, been furloughed or have otherwise
suffered a heavy financial burden
because of the pandemic. The law also
doubles the loan amount a participant
may take-from the lesser of $50,000 or
50% of his vested balance, to the lesser of
$100,000 or 100% of his vested balance-
and extends outstanding-loan repayment
periods. Additionally, required minimum
distributions (RMDs) have been waived
for the entire year.
Paycheck Protection
Section 1102 of the Coronavirus Aid,
Relief and Economic Security (CARES)
Act establishes the Paycheck Protection
Program (PPP), by which businesses may
take a Small Business Association (SBA)
loan to help keep their workforce employed
during the COVID-19 crisis. The Treasury
Department has issued a set of frequently
asked questions (FAQ) to answer borrower
and lender questions. Noteworthy to retirement
plan sponsors is Question 7: " The
CARES Act excludes from the definition
of payroll costs any employee compensation
in excess of an annual salary of
$100,000. Does that exclusion apply to
all employee benefits of monetary value? "
In its response, the Treasury Department
says the $100,000 limit applies only to
cash compensation, not non-cash benefits.
Such would be employer contributions to
defined benefit (DB) or defined contribution
(DC) retirement plans; employers'
payments for group health care coverage,
including insurance premiums; and
employers' portion of state and local taxes
assessed on employee compensation. With
this answer, the department clarifies that
the PPP will help employers make contributions
to retirement plans and toward
health benefits for employees.
Tax Filing Relief Adds
Time for Contributions
In Notice 2020-18, the Treasury Department
and the IRS announced special
federal income tax return filing and
payment relief changes in response to
the ongoing coronavirus emergency. In a
Q&A, the IRS provides additional overall
guidance. For example, the due date for
filing federal income tax returns was
extended to July 15, which means the deadline
for making contributions to a health
savings account (HSA) was also extended
to July 15. For a participant who contributed
excess deferrals to his retirement plan
last year, those deferrals, and earnings on
them, still had to be paid to the participant
by April 15. For employers with a federal
income tax return due date of April 15,
the relief not only extended the filing due
date to July 15 but also the grace period for
an employer to make contributions to its
workplace-based retirement plan and have
them treated as being made in 2019.
PLANSPONSOR.COM April - May 2020 9
http://www.PLANSPONSOR.COM
PLANSPONSOR - April/May 2020

Table of Contents for the Digital Edition of PLANSPONSOR - April/May 2020
