On April 14, 2021, the U.S. Department of Labor (“DOL”), through its Employee Benefits Security Administration (“EBSA”) issued its first set of guidance on cybersecurity for plan sponsors, plan fiduciaries, recordkeepers and plan participants. Given the increase in cybersecurity attacks against pension plans, and the potential vulnerability of approximately $9.3 trillion in benefit plan assets (per DOL estimation), EBSA’s guidance on cybersecurity has been eagerly awaited and long overdue. In fact, in February 2021, the U.S. Government Accountability Office called upon the DOL to issue minimum cybersecurity standards.

EBSA’s guidance is intended to complement the DOL’s May 2020 regulations on electronic records and disclosures. While the 2020 regulations allow pension plans to transmit select plan documents electronically, such delivery created an increased risk of cybersecurity attacks. Though ERISA already requires plan sponsors to adhere to a high fiduciary standard to protect participants’ and beneficiaries’ benefits, EBSA’s guidance represents a vital step towards helping plan sponsors, fiduciaries, recordkeepers and plan participants safeguard pension benefits and personal information. It also signals what the DOL will look for when auditing plans and service providers. Plan sponsors, fiduciaries and recordkeepers should therefore carefully review the guidance and heed EBSA’s recommendations, including the action items we detail in this Alert, to ensure their cybersecurity programs meet EBSA’s best practice standards.

In lieu of a set of FAQs or a formal regulation, the EBSA’s guidance is made up of three “tip sheets,” two of which are geared towards plan sponsors, fiduciaries and recordkeepers (“Tips for Hiring a Service Provider” and “Cybersecurity Program Best Practices”), and one of which is geared toward retirement plan participants and beneficiaries (“Online Security Tips”).

While the guidance refers only to pension plans and benefits information, it serves as a helpful reference point for ERISA-covered welfare plans as well, to the extent such plans have not already put compliance programs in place that meet the requirements necessitated by HIPAA and/or other state and/or federal data security laws.

Tips for Pension Plan Sponsors, Fiduciaries and Recordkeepers

Cybersecurity Best Practices

For pension plan sponsors, fiduciaries and recordkeepers, EBSA provides guidance on cybersecurity best practices in 12 focus areas. In summary, EBSA recommends:

1. Having a formal, well-documented cybersecurity program that details security policies, procedures, guidelines and standards to protect the integrity and security of the information;
2. Conducting annual risk assessments that identify, estimate and prioritize information system risks;
3. Having a reliable annual third-party audit of security controls to provide an unbiased report of existing risks, vulnerabilities and weaknesses;
4. Clearly defining and assigning information security roles and responsibilities within the organization, and ensuring that there is someone on staff who is qualified to fulfill the role of an information security officer;
5. Having strong access control procedures to verify the identity of users, limit access to the specific information users require, and regularly review access privileges;
6. Ensuring that assets or data, if any, stored in the cloud or managed by a third-party service provider are subject to appropriate security reviews and independent security assessments;
7. Conducting periodic cybersecurity awareness training;
8. Implementing and managing a secure system development life cycle program (“SDLC”) that integrates penetration testing, code review and architecture analysis;
9. Having an effective business resiliency program addressing business continuity, disaster recovery and incident response in the event of a breach to ensure that business operations are not interrupted and information remains safeguarded;
10. Encrypting sensitive data (both stored internally or externally and at rest or in transit) by using encryption keys, message authentication and hashing;
11. Implementing strong technical controls in accordance with best security practices, such as regularly updating hardware, software and firmware, utilizing vendor-supported firewalls and intrusion detection, implementing network segregation and conducting routine patch management; and
12. Appropriately responding to any past cybersecurity incidents, including, but not limited to, notifying the affected participant base and law enforcement (if applicable), and taking steps to mitigate the likelihood of a reoccurrence.

Tips for Hiring a Service Provider

When hiring and monitoring a service provider, EBSA recommends that plan sponsors, fiduciaries and recordkeepers inquire about potential service providers’ cybersecurity programs and how such programs are maintained. Plan sponsors, fiduciaries and recordkeepers should compare potential service providers’ cybersecurity programs to the industry standards adopted by other financial institutions, and should evaluate potential service providers’ track records in the industry by reviewing public information about data security incidents and litigation. They should also ask potential service providers about whether they have experienced any cybersecurity incidents and how such incidents were handled, as well as whether the potential service provider has an insurance policy in place that would cover losses caused by cybersecurity breaches (including losses caused by internal and external threats). Plan sponsors, fiduciaries and recordkeepers should review service provider contracts to ensure that the contracts require the service providers to comply, on an ongoing basis, with cybersecurity and information security standards (and avoid contract provisions that limit service providers’ responsibility for cybersecurity and information technology breaches). Finally, they should pay particular attention to contract terms relating to confidentiality, the use and sharing of information, notice by the vendor of cybersecurity risk assessments and audit reports, cybersecurity breaches and records retention and destruction.

Tips for Plan Participants and Beneficiaries

For plan participants and beneficiaries who have access to their retirement benefit information online, EBSA recommends:

1. Registering, setting up and routinely monitoring retirement accounts to ensure no unauthorized changes have been made;
2. Using multi-factor authentication (such as a one-time code that is sent before logging in) and a strong and unique password, which should be changed relatively frequently;
3. Keeping personal information, such as cell phone numbers and email addresses, current, and closing or deleting unused accounts;
4. Avoiding free Wi-Fi and other unsecured internet access;
5. Being aware of phishing attacks and reporting any suspicious email before opening it;
6. Using antivirus software and running the most recent version of apps; and
7. Being familiar with resources on how to report identity theft and cybersecurity incidents.

Action Items

To comply with EBSA’s guidance, plan sponsors, fiduciaries and recordkeepers should:

• Consider conducting an internal audit to get a sense of existing cybersecurity programs and potential areas of weakness;
• Develop written policies and procedures to ensure cybersecurity programs are clear and are kept up-to-date;
• Clearly define and assign information security roles and responsibilities, and have someone on staff who is qualified to fulfill the role of an information security officer;
• Train staff on how to spot potential cyber-attacks, such as phishing, and employ cybersecurity best practices;
• Review service provider contracts to ensure appropriate contractual protections, such as requirements to conduct annual audits and to make prompt notice of any security breaches;
• Conduct cyber due diligence on service providers, both at the time of engagement and periodically thereafter;
• Respond timely to any cybersecurity incidents;
• Confirm current business liability insurance coverage includes cybersecurity protection or obtain specific cybersecurity insurance coverage protection; and
• Consider preparing a participant communication that details EBSA’s recommendations for cybersecurity safety and educates participants about their responsibility to participate in the process of mitigating cybersecurity risk.

Authored by Mark E. Brossman, Ronald E. Richman, Edward H. Sadtler, Susan E. Bernstein, and Melissa J. Sandak.

If you have any questions concerning this Client Alert, or wish to update your policies, procedures, and guidelines to reflect these measures, please contact your attorney or one of the authors.

On April 2, 2021, the Securities and Exchange Commission approved, on an accelerated basis, an amended proposal by the NYSE to amend certain of its stockholder approval rules set forth in the NYSE Listed Company Manual (“NYSE Manual”). The formal approval comes after the NYSE instituted a temporary waiver of these rules due to the challenges companies faced during the COVID-19 pandemic. See our Jan. 12, 2021 Alert and Oct. 9, 2020 Alert for more detail.

Rule 312.03(b) — As amended, the Related Party Stockholder Approval Rule:

• No longer requires prior stockholder approval for issuances to the subsidiaries, affiliates or other closely related persons of directors, officers and substantial securityholders (“Related Party”) or to entities in which a Related Party has a substantial interest (except where a Related Party has a 5% or greater interest in the counterparty (as described below)).
• No longer requires stockholder approval of cash sales to a Related Party if the sale meets the NYSE minimum price requirement, even where the number of shares of common stock to be issued (or the number of shares of common stock into which the securities may be convertible or exercisable) exceeds either 1% of the number of shares of common stock or 1% of the voting power outstanding before the issuance.
• Requires stockholder approval of any transaction or series of related transactions in which any Related Party has a 5% or greater interest (or collectively have a 10% or greater interest), directly or indirectly, in the company or assets to be acquired or in the consideration to be paid in the transaction and the issuance of common stock, or securities convertible into common stock, could increase the outstanding common shares by 5% or more.
• Deletes now irrelevant provisions relating to (i) cash sales that meet the NYSE minimum price requirement, and where the issuance does not exceed 5% of the shares of common stock or voting power before the issuance, to a Related Party where the Related Party involved in the transaction is classified as a Related Party solely because the person is a substantial security holder; and (ii) an exemption related to early stage companies.

Rule 312.03(c) — As amended, the 20% Stockholder Approval Rule:

• Replaces the reference to “bona fide private financing” in the exception from shareholder approval for transactions relating to 20% or more of the company’s outstanding common stock or voting power with “other financing (that is not a public offering for cash) in which the company is selling securities for cash.” This would eliminate the 5% limit for any single purchaser participating in a transaction, thus permitting companies to consummate a financing to a single purchaser.
• Requires shareholder approval if the securities in a financing are issued in connection with an acquisition of the stock or assets of another company and the issuance of the securities alone or when combined with any other present or potential issuance of common stock, or securities convertible into common stock, is equal to or exceeds either 20% of the number of shares of common stock or of the voting power outstanding before the issuance.

In addition, amendments to Section 314 of the NYSE Manual requires a company’s audit committee or other independent body of the board of directors to review related party transactions prior to any transaction and prohibit the transaction if it determines the transaction is not consistent with the interests of the company and its shareholders. For purposes of Section 314, related party transactions would mean those transactions required to be disclosed pursuant to Item 404 of Regulation S-K under the Securities Exchange Act of 1934, as amended (without giving effect to the transaction value threshold of that provision).

Authored by Ele Klein and Evan A. Berger.

If you have any questions concerning this Client Alert, please contact your attorney or one of the authors.

The SEC brought charges against a fund manager for 13D violations, in yet another reminder that it will pursue enforcement actions against filers for Schedule 13D violations even without a pattern of repeat violations.

On Sept. 17, 2020, the SEC announced the settlement of charges brought against an investment manager of certain private funds (“IM”) for failure to timely amend a statement of beneficial ownership report on Schedule 13D (Administrative Proceeding File No. 3-20020).^[1]

The 13D Requirements

Section 13(d) of the Securities Exchange Act of 1934 requires a “beneficial owner”:

• That acquires more than 5%;
• Of a class of any voting, equity securities registered under Section 12 of the Exchange Act;
• To file with the SEC within ten days of any such acquisition; and
• A statement on Schedule 13D describing such acquisition and containing certain other information, including a description of any plans or proposals that the beneficial owner may have with respect to certain enumerated matters regarding the issuer.

After the initial filing of a Schedule 13D, Rule 13d-2(a) requires the Schedule 13D to be amended “promptly” in the event of any “material change” in the information set forth therein. “Promptly” is not defined under the rules but is generally understood to be within two business days. Under Rule 13d-2(a), an increase or decrease in beneficial ownership of 1% or more is deemed to be “material,” but Schedule 13D filers must keep in mind that an amendment must also be filed promptly upon any material change to any of the other information disclosed in the Schedule 13D, including, without limitation, the filer’s plans or proposals.

The Facts

The IM filed an initial Schedule 13D with respect to its holdings in Hanger Inc. (“Issuer”) on July 22, 2016, disclosing that it beneficially owned 6.7% of the Issuer’s outstanding shares and that it may explore a possible acquisition or restructuring of the Issuer. The IM also included certain standard “boilerplate” language reserving the right to change its intentions. The IM did not amend its Schedule 13D until Sept. 6, 2019, after it had sold out of its entire position, which it accomplished through sales on July 1, 2019 and Aug. 8, 2019.

The SEC’s Findings

The SEC found that the IM failed to amend its original Schedule 13D:

• First, when it determined that it was no longer interested in pursuing a possible acquisition or restructuring of the Issuer and that it would liquidate its position; and
• Second, when it reduced its beneficial ownership by 1%.

Without admitting or denying the SEC’s findings, the IM agreed to a cease and desist order and to pay a penalty of $100,000.

Takeaways

This administrative proceeding serves as a reminder that:

• The SEC remains focused on enforcing beneficial ownership reporting obligations, even when a filer is not engaged in a pattern of recurring delinquent behavior;
• The value of boilerplate language reserving the right to change a filer’s intentions or take certain actions is limited once a filer has made a definitive determination to abandon or pursue a specific action; and
• Investment firms, even those that do not frequently file on Schedule 13D, need to have compliance procedures in place to properly monitor filing requirements and changes and events around their outstanding filings to properly update their filings in a timely manner.

Authored by Eleazer Klein, Adriana Schwartz, and Clara Zylberg.

If you have any questions concerning this Alert, please contact your attorney or one of the authors.