--- title: Consolidation is Vital to Reducing 401(k) Cybersecurity Risk description: Appealing to common sense, Ingalls notes that “fraud starts small” and that consolidation of small balance 401(k) accounts achieved via auto portability can effectively minimize the cyber “attack surface” these excess accounts represent. image: https://blog.rch1.com/hubfs/Cyber%20Padlock.png --- [![Retirement Clearinghouse Logo](https://blog.rch1.com/hs-fs/hubfs/raw_assets/public/Retirement_Clearinghouse_May2022/images/logo.png?width=1000&height=648&name=logo.png "Retirement Clearinghouse Logo")](https://rch1.com/) [Privacy Policy](https://securities.rch1.com/common/PrivacyStatement.pdf) [Sponsors/Service Providers](https://rch1.com/plan-sponsors) [Individuals](https://rch1.com/individuals) [Login](https://rch1.com/#) - [Home](https://rch1.com/home-page) - [Individuals](https://rch1.com/individuals) - [Individuals Home](https://rch1.com/individuals/individuals-home) - [Who is RCH?](https://rch1.com/individuals/who-is-rch) - [Why Does RCH Have My Retirement Savings?](https://rch1.com/individuals/why-does-rch-have-my-retirement-funds) - [Manage Your RCH IRA Account](https://rch1.com/individuals/manage-your-rch-ira-account) - [Cash Out Calculator](https://rch1.com/individuals/cash-out-calculator) - [Moving Your Retirement Savings Forward](https://rch1.com/individuals/moving-your-retirement-savings-forward) - [Contact Us](https://rch1.com/individuals/contact-us) - [Para español](https://rch1.com/individuals/contacto-retirement-clearinghouse) - [Learning Center](https://rch1.com/individuals/learning-center) - [Disclosure Central](https://rch1.com/individuals/learning-center/resources-%26-downloads) - [Glossary](https://rch1.com/individuals/learning-center/glossary) - [Frequently-Asked Questions](https://rch1.com/individuals/learning-center/faqs) - [Auto Portability](https://rch1.com/auto-portability) - [Auto Portability Overview](https://rch1.com/auto-portability/auto-portability-overview) - [Auto Portability FAQs](https://rch1.com/auto-portability/frequently-asked-questions) - [Recent Developments](https://rch1.com/auto-portability/recent-developments) - [Foundational Research](https://rch1.com/auto-portability/foundational-research) - [Public Policy](https://rch1.com/auto-portability/public-policy) - [Media Coverage](https://rch1.com/auto-portability/media-coverage) - [Press Releases](https://rch1.com/auto-portability/press-releases--auto-portability) - [Regulatory Information](https://rch1.com/auto-portability/regulatory-information) - [Enabling Regulation](https://rch1.com/auto-portability/regulatory-information/enabling-regulation) - [Participating Recordkeepers](https://rch1.com/auto-portability/regulatory-information/participating-recordkeepers) - [Auto Portability Plan Calculator](https://rch1.com/auto-portability/plan-calculator) - [National Cash Out Clock](https://rch1.com/auto-portability/national-cash-out-clock) - [Downloads & Video](https://rch1.com/auto-portability/downloads-video) - [Get Updates on Auto Portability](https://rch1.com/auto-portability/get-updates-on-auto-portability) - [Plan Sponsors](https://rch1.com/plan-sponsors) - [The Small Account Problem](https://rch1.com/plan-sponsors) - [RCH Portability Services](https://rch1.com/plan-sponsors/rch-portability-services) - [Plan Sponsor Support](https://rch1.com/plan-sponsors/rch-client-services) - [The Missing Participant Problem](https://rch1.com/plan-sponsors/addressing-the-problem-of-missing-participants) - [What is a Missing Participant?](https://rch1.com/plan-sponsors/addressing-the-problem-of-missing-participants/what-is-a-missing-participant) - [Why Plan Sponsors Should be Concerned](https://rch1.com/plan-sponsors/addressing-the-problem-of-missing-participants/why-plan-sponsors-should-be-concerned) - [What Causes Missing Participants?](https://rch1.com/plan-sponsors/addressing-the-problem-of-missing-participants/what-causes-missing-participants) - [The Magnitude of the Problem](https://rch1.com/plan-sponsors/addressing-the-problem-of-missing-participants/the-magnitude-of-the-missing-participant-problem) - [What Regulations Apply to Missing Participants?](https://rch1.com/plan-sponsors/addressing-the-problem-of-missing-participants/what-regulations-apply-to-missing-participants) - [Sources of Uncertainty for Plan Sponsors](https://rch1.com/plan-sponsors/addressing-the-problem-of-missing-participants/sources-of-uncertainty-for-plan-sponsors) - [Best Practices for Finding Missing Participants](https://rch1.com/plan-sponsors/addressing-the-problem-of-missing-participants/best-practices-for-finding-missing-participants) - [What to Look For in a Search Service](https://rch1.com/plan-sponsors/addressing-the-problem-of-missing-participants/what-to-look-for-in-a-missing-participant-search-service) - [Learn More About Missing Participants](https://rch1.com/plan-sponsors/addressing-the-problem-of-missing-participants/learn-more-about-missing-participants) - [RCH's Missing Participant Search Service](https://rch1.com/plan-sponsors/addressing-the-problem-of-missing-participants/the-rch-missing-participant-search-service) - [Terminating 401(k) Plans](https://rch1.com/plan-sponsors/terminating-a-401k-plan) - [Why 401(k) Plans Terminate](https://rch1.com/plan-sponsors/terminating-a-401k-plan/why-do-401k-plans-terminate) - [The Process for Terminating 401(k) Plans](https://rch1.com/plan-sponsors/terminating-a-401k-plan/what-is-the-process-for-terminating-a-401k-plan) - [Common Mistakes Sponsors Make](https://rch1.com/plan-sponsors/terminating-a-401k-plan/what-mistakes-do-plan-sponsors-make-when-terminating-401k-plans) - [What to Look for in a Service Provider](https://rch1.com/plan-sponsors/terminating-a-401k-plan/what-to-look-for-in-a-terminating-401k-service-provider) - [Get More Information](https://rch1.com/plan-sponsors/terminating-a-401k-plan/get-more-information-on-terminating-plans) - [RCH's Terminating Plan Service](https://rch1.com/plan-sponsors/terminating-a-401k-plan/plan-termination-services) - [Participant Testimonials](https://rch1.com/plan-sponsors/participant-testimonials) - [Due Diligence Material](https://rch1.com/plan-sponsors/due-diligence-material) - [Contact Us](https://rch1.com/plan-sponsors/contact-us) - [Accountholders](https://rch1.com/individuals) - [Individuals Home](https://rch1.com/individuals) - [Who is RCH?](https://rch1.com/individuals/who-is-rch) - [Why Does RCH Have My Retirement Savings?](https://rch1.com/individuals/why-does-rch-have-my-retirement-funds) - [Manage Your RCH IRA Account](https://rch1.com/individuals/manage-your-rch-ira-account) - [Cash Out Calculator](https://rch1.com/individuals/cash-out-calculator) - [RMD Calculator](https://rch1.com/individuals/rmd-calculator) - [Moving Your Retirement Savings Forward](https://rch1.com/individuals/moving-your-retirement-savings-forward) - [Contact Us](https://rch1.com/individuals/contact-us) - [Para español](https://rch1.com/individuals/contacto-retirement-clearinghouse) - [Learning Center](https://rch1.com/individuals/learning-center) - [Company](https://rch1.com/company) - [About RCH](https://rch1.com/company/about-rch) - [Mission](https://rch1.com/company/mission) - [Management Team](https://rch1.com/company/management-team) - [Contact RCH](https://rch1.com/contact-us) - [Careers - Job Opportunities](https://rch1.com/company/careers) - [Our Benefits](https://rch1.com/company/our-benefits) - [The RLJ Companies](https://rch1.com/company/the-rlj-companies) - [News & Information](https://rch1.com/news) - [News](https://rch1.com/news) - [Press Releases](https://rch1.com/press-releases) - [Thought Leadership](https://rch1.com/thought-leadership) - [Consolidation Corner Blog](https://rch1.com/blog) - [Consolidation Corner Channel](https://rch1.com/consolidation-corner-channel) - [Events](https://rch1.com/events) - [Login](https://rch1.com/#) ## Search Our Site Close Quicklinks - [Individuals](https://rch1.com/individuals) - [Individuals Home](https://rch1.com/individuals/individuals-home) - [Who is RCH?](https://rch1.com/individuals/who-is-rch) - [Why Does RCH Have My Retirement Funds?](https://rch1.com/individuals/why-does-rch-have-my-retirement-funds) - [Manage Your RCH IRA Account](https://rch1.com/individuals/manage-your-rch-ira-account) - [Cash Out Calculator](https://rch1.com/individuals/cash-out-calculator) - [Moving Your Retirement Savings Forward](https://rch1.com/individuals/moving-your-retirement-savings-forward) - [Contact Us](https://rch1.com/individuals/contact-us) - [Para español](https://rch1.com/individuals/contacto-retirement-clearinghouse) - [Learning Center](https://rch1.com/individuals/learning-center) - [Auto Portability](https://rch1.com/auto-portability) - [Auto Portability Overview](https://rch1.com/auto-portability/auto-portability-overview) - [Auto Portability FAQs](https://rch1.com/auto-portability/frequently-asked-questions) - [Recent Developments](https://rch1.com/auto-portability/recent-developments) - [Foundational Research](https://rch1.com/auto-portability/foundational-research) - [Public Policy](https://rch1.com/auto-portability/public-policy) - [Media Coverage](https://rch1.com/auto-portability/media-coverage) - [Press Releases](https://rch1.com/auto-portability/press-releases--auto-portability) - [Regulatory Information](https://rch1.com/auto-portability/regulatory-information) - [The RCH Auto Portability Plan Calculator](https://rch1.com/auto-portability/plan-calculator) - [National Cash Out Clock](https://rch1.com/auto-portability/national-cash-out-clock) - [Downloads & Video](https://rch1.com/auto-portability/downloads-video) - [Get Updates on Auto Portability](https://rch1.com/auto-portability/get-updates-on-auto-portability) - [Plan Sponsors](https://rch1.com/plan-sponsors) - [The Small Account Problem](https://rch1.com/plan-sponsors/sponsors-home) - [RCH Portability Services](https://rch1.com/plan-sponsors/rch-portability-services) - [RCH Client Services](https://rch1.com/plan-sponsors/rch-client-services) - [Addressing the Problem of Missing Participants](https://rch1.com/plan-sponsors/addressing-the-problem-of-missing-participants) - [Terminating 401(k) Plans](https://rch1.com/plan-sponsors/terminating-a-401k-plan) - [Participant Testimonials](https://rch1.com/plan-sponsors/participant-testimonials) - [Due Diligence Material](https://rch1.com/plan-sponsors/due-diligence-material) - [Contact Us](https://rch1.com/plan-sponsors/contact-us) - [Accountholders](https://rch1.com/individuals) - [Individuals Home](https://rch1.com/individuals) - [Who is RCH?](https://rch1.com/individuals/who-is-rch) - [Why Does RCH Have My Retirement Savings?](https://rch1.com/individuals/why-does-rch-have-my-retirement-funds) - [Manage Your RCH IRA Account](https://rch1.com/individuals/manage-your-rch-ira-account) - [Cash Out Calculator](https://rch1.com/individuals/cash-out-calculator) - [RMD Calculator](https://rch1.com/individuals/rmd-calculator) - [Moving Your Retirement Savings Forward](https://rch1.com/individuals/moving-your-retirement-savings-forward) - [Contact us](https://rch1.com/individuals/contact-us) - [Para español](https://rch1.com/individuals/contacto-retirement-clearinghouse) - [Learning Center](https://rch1.com/individuals/learning-center) - [Company](https://rch1.com/company) - [About RCH](https://rch1.com/company/about-rch) - [Mission](https://rch1.com/company/mission) - [Management Team](https://rch1.com/company/management-team) - [Contact RCH](https://rch1.com/contact-us) - [Careers - Job Opportunities](https://rch1.com/company/careers) - [Our Benefits](https://rch1.com/company/our-benefits) - [The RLJ Companies](https://rch1.com/company/the-rlj-companies) - [News & Information](https://rch1.com/news) - [News](https://rch1.com/news) - [Press Releases](https://rch1.com/press-releases) - [Thought Leadership](https://rch1.com/thought-leadership) - [Consolidation Corner Blog](https://rch1.com/blog) - [Consolidation Corner Channel](https://rch1.com/consolidation-corner-channel) - [Events](https://rch1.com/events) - [Auto Portability](https://rch1.com/auto-portability) # Consolidation is Vital to Reducing 401(k) Cybersecurity Risk #### [By Ricki Ingalls](https://blog.rch1.com/blog/author/ricki-ingalls) | March 8, 2022 ![Cyber Padlock](https://blog.rch1.com/hs-fs/hubfs/Cyber%20Padlock.png?width=200&name=Cyber%20Padlock.png)With $10 trillion in 401(k) and other defined contribution retirement assets to safeguard, retirement industry regulators are intensely focused on the issue of cybersecurity. The latest developments signifying regulatory resolve include enforcement actions by the Securities and Exchange Commission (SEC), who in August 2021 sanctioned 8 firms in three separate actions (links [here](https://www.sec.gov/litigation/admin/2021/34-92800.pdf), [here](https://www.sec.gov/litigation/admin/2021/34-92806.pdf) and [here](https://www.sec.gov/litigation/admin/2021/34-92807.pdf)), for failing to have cybersecurity policies and procedures in place, potentially leading to compromised private client data.  The SEC’s actions were preceded in April 2021 by the [Department of Labor (DOL), who issued three guidance documents](https://www.dol.gov/newsroom/releases/ebsa/ebsa20210414) for plan sponsors, plan fiduciaries, recordkeepers and plan participants on best practices for maintaining cybersecurity. Amid these actions, the retirement industry should expand their cybersecurity focus to actively address another vitally important element: the consolidation of small-balance retirement savings accounts, achieved by improved plan-to-plan portability. **Minimizing Fraud-Prone, Small-Balance Forgotten Accounts** A key principle in loss prevention is that “big frauds start small.” In our retirement system, nowhere is this axiom more applicable than for small-balance retirement savings accounts. In recent years, there’s been a very well-documented explosion of both [small-balance 401(k) accounts](https://rch1.com/blog/the-massive-explosion-of-small-401k-accounts) and [small-balance IRAs](https://rch1.com/blog/the-explosion-of-smallbalance-iras), which can present tempting targets, as system controls and monitoring can often be lax. In cybersecurity terminology, the presence of vast numbers of small, unconsolidated retirement savings accounts scattered across thousands of plans and housed on a myriad of recordkeeper platforms creates a larger cyber “attack surface” -- the sum of the different points, or attack vectors, that cyber-intruders can attempt to leverage to compromise security. That’s where consolidation comes in. Consolidation is, by definition, the combination of two accounts into one, resulting in one less retirement savings account. Combining retirement savings accounts translates into a smaller cyber attack surface. **How Auto Portability Promotes Retirement Cybersecurity** Auto portability, via consolidation, significantly reduces the odds of exposure for millions of 401(k) participants. Data from the Auto Portability Simulation shows that, over 40 years, the adoption of auto portability would result in a net increase of 124.3 million plan-to-plan account consolidations. That level of consolidation activity means that securing personal information is paramount, requiring the application of stringent cybersecurity standards. To achieve that, auto portability’s cybersecurity has been built to comply with NIST Special Publication 800-171, a security framework that is specifically designed to protect confidential information. To effect consolidation, auto portability relies upon highly secure, transient data exchanges to ensure that accounts are located, matched, and moved forward quickly, safely and securely, employing the following key cybersecurity features: - Sensitive data, including all personal information is continuously protected with strong encryption, whether the data is in-transit or at rest. - Social security numbers are not provided with any other personally identifiable information (PII) in data transfers. Thus, there is never enough PII in any data transmission for a hacker to steal an identity. - Any file containing encrypted personal information never includes the identity of either the plan sponsor or the recordkeeper, further thwarting a hacker from accessing an individual participant’s retirement account. - Each participating service provider has their own, dedicated and secure channel for transmitting participant data. Auto portability stands in stark contrast to other current or proposed policies that do not promote consolidation and do little to improve cybersecurity, including: - Forcing out small 401(k) balances into dead-end safe harbor IRAs. - Creating a [government-run lost and found](https://rch1.com/blog/resecuring-the-highest-purpose-for-a-retirement-savings-lost--found) to warehouse unclaimed balances. **Consolidation: A Vital Element for Retirement Cybersecurity** It’s clear that account consolidation can lower retirement savings cybersecurity risks by minimizing the sheer number of fraud-prone, small-balance retirement savings accounts, and the best path to enabling consolidation – particularly for small balance 401(k) accounts – is via auto portability. [Back](https://blog.rch1.com/blog) [![Retirement Clearinghouse An RLJ Company](https://blog.rch1.com/hs-fs/hubfs/raw_assets/public/Retirement_Clearinghouse_May2022/images/footer_logo.png?width=1000&height=648&name=footer_logo.png "Retirement Clearinghouse An RLJ Company")](https://rch1.com/) 1916 Ayrsley Town Boulevard Suite 200 Charlotte, NC 28273 - [Individuals](https://rch1.com/individuals) - [Plan Sponsors](https://rch1.com/plan-sponsors) - [Auto Portability](https://rch1.com/auto-portability) - [Company](https://rch1.com/company) - [News & Information](https://rch1.com/news) - [Mission](https://rch1.com/company/mission) - [Careers](https://rch1.com/company/careers) - [Contact Us](https://rch1.com/contact-us) - [Logins](https://rch1.com/#) - [Disclosure Central](https://rch1.com/individuals/learning-center/resources-%26-downloads) - [Do Not Sell or Share](https://blog.rch1.com/blog/consolidation-is-vital-to-reducing-401k-cybersecurity-risk#decline-cookies) - [My Personal Information](https://blog.rch1.com/blog/consolidation-is-vital-to-reducing-401k-cybersecurity-risk#decline-cookies) - - - Individuals should consult their tax advisers or legal counsel for advice and information concerning their particular situation. Retirement Clearinghouse does not give legal, investment, or tax advice. IRA account fees and product information provided by Retirement Clearinghouse, LLC is subject to change without notice at the discretion of the IRA Provider. RCH Shareholder Services is a wholly owned subsidiary of Retirement Clearinghouse, LLC and a registered transfer agent with the U.S. Securities and Exchange Commission. © 2026 Retirement Clearinghouse, LLC. This site is directed at, and made available to, persons in the U.S. and Puerto Rico. [Sitemap](https://rch1.com/sitemap)