--- title: Don’t forget about your service provider’s internal security description: One sign that a service provider has a strong commitment to security and controls is SOC certification, which results from successful Service Organization Controls (SOC) examinations. SOC examinations are conducted in accordance with attestation standards established by the American Institute of CPAs (AICPA), and are designed to provide comfort that a service organization meets key security principles, validated through an independent service audit.Once we understand the different states of data, we can formulate specific, protective security measures. Here is an important (but by no means exhaustive) list of some of the internal measures we believe are critical for all service providers to adopt, and that we’ve taken care to effectively implement throughout our organization. image: http://blog.rch1.com/hubfs/Set_Up_Images/Other_Generic_Images/securityonline.jpg --- [![Retirement Clearinghouse Logo](https://blog.rch1.com/hs-fs/hubfs/raw_assets/public/Retirement_Clearinghouse_May2022/images/logo.png?width=1000&height=648&name=logo.png "Retirement Clearinghouse Logo")](https://rch1.com/) [Privacy Policy](https://securities.rch1.com/common/PrivacyStatement.pdf) [Sponsors/Service Providers](https://rch1.com/plan-sponsors) [Individuals](https://rch1.com/individuals) [Login](https://rch1.com/#) - [Home](https://rch1.com/home-page) - [Individuals](https://rch1.com/individuals) - [Individuals Home](https://rch1.com/individuals/individuals-home) - [Who is RCH?](https://rch1.com/individuals/who-is-rch) - [Why Does RCH Have My Retirement Savings?](https://rch1.com/individuals/why-does-rch-have-my-retirement-funds) - [Manage Your RCH IRA Account](https://rch1.com/individuals/manage-your-rch-ira-account) - [Cash Out Calculator](https://rch1.com/individuals/cash-out-calculator) - [Moving Your Retirement Savings Forward](https://rch1.com/individuals/moving-your-retirement-savings-forward) - [Contact Us](https://rch1.com/individuals/contact-us) - [Para español](https://rch1.com/individuals/contacto-retirement-clearinghouse) - [Learning Center](https://rch1.com/individuals/learning-center) - [Disclosure Central](https://rch1.com/individuals/learning-center/resources-%26-downloads) - [Glossary](https://rch1.com/individuals/learning-center/glossary) - [Frequently-Asked Questions](https://rch1.com/individuals/learning-center/faqs) - [Auto Portability](https://rch1.com/auto-portability) - [Auto Portability Overview](https://rch1.com/auto-portability/auto-portability-overview) - [Auto Portability FAQs](https://rch1.com/auto-portability/frequently-asked-questions) - [Recent Developments](https://rch1.com/auto-portability/recent-developments) - [Foundational Research](https://rch1.com/auto-portability/foundational-research) - [Public Policy](https://rch1.com/auto-portability/public-policy) - [Media Coverage](https://rch1.com/auto-portability/media-coverage) - [Press Releases](https://rch1.com/auto-portability/press-releases--auto-portability) - [Regulatory Information](https://rch1.com/auto-portability/regulatory-information) - [Enabling Regulation](https://rch1.com/auto-portability/regulatory-information/enabling-regulation) - [Participating Recordkeepers](https://rch1.com/auto-portability/regulatory-information/participating-recordkeepers) - [Auto Portability Plan Calculator](https://rch1.com/auto-portability/plan-calculator) - [National Cash Out Clock](https://rch1.com/auto-portability/national-cash-out-clock) - [Downloads & Video](https://rch1.com/auto-portability/downloads-video) - [Get Updates on Auto Portability](https://rch1.com/auto-portability/get-updates-on-auto-portability) - [Plan Sponsors](https://rch1.com/plan-sponsors) - [The Small Account Problem](https://rch1.com/plan-sponsors) - [RCH Portability Services](https://rch1.com/plan-sponsors/rch-portability-services) - [Plan Sponsor Support](https://rch1.com/plan-sponsors/rch-client-services) - [The Missing Participant Problem](https://rch1.com/plan-sponsors/addressing-the-problem-of-missing-participants) - [What is a Missing Participant?](https://rch1.com/plan-sponsors/addressing-the-problem-of-missing-participants/what-is-a-missing-participant) - [Why Plan Sponsors Should be Concerned](https://rch1.com/plan-sponsors/addressing-the-problem-of-missing-participants/why-plan-sponsors-should-be-concerned) - [What Causes Missing Participants?](https://rch1.com/plan-sponsors/addressing-the-problem-of-missing-participants/what-causes-missing-participants) - [The Magnitude of the Problem](https://rch1.com/plan-sponsors/addressing-the-problem-of-missing-participants/the-magnitude-of-the-missing-participant-problem) - [What Regulations Apply to Missing Participants?](https://rch1.com/plan-sponsors/addressing-the-problem-of-missing-participants/what-regulations-apply-to-missing-participants) - [Sources of Uncertainty for Plan Sponsors](https://rch1.com/plan-sponsors/addressing-the-problem-of-missing-participants/sources-of-uncertainty-for-plan-sponsors) - [Best Practices for Finding Missing Participants](https://rch1.com/plan-sponsors/addressing-the-problem-of-missing-participants/best-practices-for-finding-missing-participants) - [What to Look For in a Search Service](https://rch1.com/plan-sponsors/addressing-the-problem-of-missing-participants/what-to-look-for-in-a-missing-participant-search-service) - [Learn More About Missing Participants](https://rch1.com/plan-sponsors/addressing-the-problem-of-missing-participants/learn-more-about-missing-participants) - [RCH's Missing Participant Search Service](https://rch1.com/plan-sponsors/addressing-the-problem-of-missing-participants/the-rch-missing-participant-search-service) - [Terminating 401(k) Plans](https://rch1.com/plan-sponsors/terminating-a-401k-plan) - [Why 401(k) Plans Terminate](https://rch1.com/plan-sponsors/terminating-a-401k-plan/why-do-401k-plans-terminate) - [The Process for Terminating 401(k) Plans](https://rch1.com/plan-sponsors/terminating-a-401k-plan/what-is-the-process-for-terminating-a-401k-plan) - [Common Mistakes Sponsors Make](https://rch1.com/plan-sponsors/terminating-a-401k-plan/what-mistakes-do-plan-sponsors-make-when-terminating-401k-plans) - [What to Look for in a Service Provider](https://rch1.com/plan-sponsors/terminating-a-401k-plan/what-to-look-for-in-a-terminating-401k-service-provider) - [Get More Information](https://rch1.com/plan-sponsors/terminating-a-401k-plan/get-more-information-on-terminating-plans) - [RCH's Terminating Plan Service](https://rch1.com/plan-sponsors/terminating-a-401k-plan/plan-termination-services) - [Participant Testimonials](https://rch1.com/plan-sponsors/participant-testimonials) - [Due Diligence Material](https://rch1.com/plan-sponsors/due-diligence-material) - [Contact Us](https://rch1.com/plan-sponsors/contact-us) - [Accountholders](https://rch1.com/individuals) - [Individuals Home](https://rch1.com/individuals) - [Who is RCH?](https://rch1.com/individuals/who-is-rch) - [Why Does RCH Have My Retirement Savings?](https://rch1.com/individuals/why-does-rch-have-my-retirement-funds) - [Manage Your RCH IRA Account](https://rch1.com/individuals/manage-your-rch-ira-account) - [Cash Out Calculator](https://rch1.com/individuals/cash-out-calculator) - [RMD Calculator](https://rch1.com/individuals/rmd-calculator) - [Moving Your Retirement Savings Forward](https://rch1.com/individuals/moving-your-retirement-savings-forward) - [Contact Us](https://rch1.com/individuals/contact-us) - [Para español](https://rch1.com/individuals/contacto-retirement-clearinghouse) - [Learning Center](https://rch1.com/individuals/learning-center) - [Company](https://rch1.com/company) - [About RCH](https://rch1.com/company/about-rch) - [Mission](https://rch1.com/company/mission) - [Management Team](https://rch1.com/company/management-team) - [Contact RCH](https://rch1.com/contact-us) - [Careers - Job Opportunities](https://rch1.com/company/careers) - [Our Benefits](https://rch1.com/company/our-benefits) - [The RLJ Companies](https://rch1.com/company/the-rlj-companies) - [News & Information](https://rch1.com/news) - [News](https://rch1.com/news) - [Press Releases](https://rch1.com/press-releases) - [Thought Leadership](https://rch1.com/thought-leadership) - [Consolidation Corner Blog](https://rch1.com/blog) - [Consolidation Corner Channel](https://rch1.com/consolidation-corner-channel) - [Events](https://rch1.com/events) - [Login](https://rch1.com/#) ## Search Our Site Close Quicklinks - [Individuals](https://rch1.com/individuals) - [Individuals Home](https://rch1.com/individuals/individuals-home) - [Who is RCH?](https://rch1.com/individuals/who-is-rch) - [Why Does RCH Have My Retirement Funds?](https://rch1.com/individuals/why-does-rch-have-my-retirement-funds) - [Manage Your RCH IRA Account](https://rch1.com/individuals/manage-your-rch-ira-account) - [Cash Out Calculator](https://rch1.com/individuals/cash-out-calculator) - [Moving Your Retirement Savings Forward](https://rch1.com/individuals/moving-your-retirement-savings-forward) - [Contact Us](https://rch1.com/individuals/contact-us) - [Para español](https://rch1.com/individuals/contacto-retirement-clearinghouse) - [Learning Center](https://rch1.com/individuals/learning-center) - [Auto Portability](https://rch1.com/auto-portability) - [Auto Portability Overview](https://rch1.com/auto-portability/auto-portability-overview) - [Auto Portability FAQs](https://rch1.com/auto-portability/frequently-asked-questions) - [Recent Developments](https://rch1.com/auto-portability/recent-developments) - [Foundational Research](https://rch1.com/auto-portability/foundational-research) - [Public Policy](https://rch1.com/auto-portability/public-policy) - [Media Coverage](https://rch1.com/auto-portability/media-coverage) - [Press Releases](https://rch1.com/auto-portability/press-releases--auto-portability) - [Regulatory Information](https://rch1.com/auto-portability/regulatory-information) - [The RCH Auto Portability Plan Calculator](https://rch1.com/auto-portability/plan-calculator) - [National Cash Out Clock](https://rch1.com/auto-portability/national-cash-out-clock) - [Downloads & Video](https://rch1.com/auto-portability/downloads-video) - [Get Updates on Auto Portability](https://rch1.com/auto-portability/get-updates-on-auto-portability) - [Plan Sponsors](https://rch1.com/plan-sponsors) - [The Small Account Problem](https://rch1.com/plan-sponsors/sponsors-home) - [RCH Portability Services](https://rch1.com/plan-sponsors/rch-portability-services) - [RCH Client Services](https://rch1.com/plan-sponsors/rch-client-services) - [Addressing the Problem of Missing Participants](https://rch1.com/plan-sponsors/addressing-the-problem-of-missing-participants) - [Terminating 401(k) Plans](https://rch1.com/plan-sponsors/terminating-a-401k-plan) - [Participant Testimonials](https://rch1.com/plan-sponsors/participant-testimonials) - [Due Diligence Material](https://rch1.com/plan-sponsors/due-diligence-material) - [Contact Us](https://rch1.com/plan-sponsors/contact-us) - [Accountholders](https://rch1.com/individuals) - [Individuals Home](https://rch1.com/individuals) - [Who is RCH?](https://rch1.com/individuals/who-is-rch) - [Why Does RCH Have My Retirement Savings?](https://rch1.com/individuals/why-does-rch-have-my-retirement-funds) - [Manage Your RCH IRA Account](https://rch1.com/individuals/manage-your-rch-ira-account) - [Cash Out Calculator](https://rch1.com/individuals/cash-out-calculator) - [RMD Calculator](https://rch1.com/individuals/rmd-calculator) - [Moving Your Retirement Savings Forward](https://rch1.com/individuals/moving-your-retirement-savings-forward) - [Contact us](https://rch1.com/individuals/contact-us) - [Para español](https://rch1.com/individuals/contacto-retirement-clearinghouse) - [Learning Center](https://rch1.com/individuals/learning-center) - [Company](https://rch1.com/company) - [About RCH](https://rch1.com/company/about-rch) - [Mission](https://rch1.com/company/mission) - [Management Team](https://rch1.com/company/management-team) - [Contact RCH](https://rch1.com/contact-us) - [Careers - Job Opportunities](https://rch1.com/company/careers) - [Our Benefits](https://rch1.com/company/our-benefits) - [The RLJ Companies](https://rch1.com/company/the-rlj-companies) - [News & Information](https://rch1.com/news) - [News](https://rch1.com/news) - [Press Releases](https://rch1.com/press-releases) - [Thought Leadership](https://rch1.com/thought-leadership) - [Consolidation Corner Blog](https://rch1.com/blog) - [Consolidation Corner Channel](https://rch1.com/consolidation-corner-channel) - [Events](https://rch1.com/events) - [Auto Portability](https://rch1.com/auto-portability) # Don’t forget about your service provider’s internal security #### [By Thomas Hawkins](https://blog.rch1.com/blog/author/thomas-hawkins) | December 10, 2015 ![Online Security](http://blog.rch1.com/hs-fs/hubfs/Set_Up_Images/Other_Generic_Images/securityonline.jpg?width=200&name=securityonline.jpg "Online Security") With attention-grabbing headlines about major security breaches occurring almost daily, plan sponsors need to be assured that their service providers are on guard 24-7, protecting sensitive information and intellectual property, wherever it may reside. One sign that a service provider has a strong commitment to security and controls is [SOC certification](https://blog.rch1.com/blog/soc-examinations-designed-to-provide-comfort), which results from successful Service Organization Controls (SOC) examinations. SOC examinations are conducted in accordance with attestation standards established by the [American Institute of CPAs (AICPA)](http://www.aicpa.org/interestareas/frc/assuranceadvisoryservices/pages/sorhome.aspx), and are designed to provide comfort that a service organization meets key security principles, validated through an independent service audit. **Protect Sensitive Information, In Whatever State It Resides** It’s important to understand that sensitive information and intellectual property doesn’t just reside on a storage device, or on a piece of paper.  It can also be at rest or on the move, and it’s critical for a service provider to understand the various states in which it resides, and to formulate protective measures for each of those states, including:  - In use: Actions such as copying data to a storage device or printing it - In motion: Network communications such as email, web traffic and instant messaging - At rest: Data stored in file shares or on users’ drives or devices   **Kicking the Tires of Your Service Provider’s Internal Security** Once we understand the different states of data, we can formulate & implement specific, protective security measures.  Here is an important (but by no means exhaustive) list of some of the internal measures we believe are critical for all service providers to adopt, and that we’ve taken care to effectively implement throughout our organization.  1. **Application Security:** - Restricting all internal applications by “role-based” security. All systems applications are restricted to authorized users only, as are application data and sub-functions. - Requiring two-factor authentication for application login, necessitating identification of users by means of two separate components. 1. **Network Security:** - Filtering and blocking internet traffic in/out, including solutions that offer “firewall” protections to prevent external network intrusions. - Implementing wireless security that secures wireless access points and strongly encrypts wireless data transmissions. 1. **Physical Security:** - Requiring all employees and contractors to have ID badges to grant access all general office space entrance points. - Within the general office space, further securing additional areas with role-based access via ID badges. - Cameras with recording, at all entrance points. 1. **Email and Messaging:** - Filtering email, to ensure that unwanted and dangerous inbound emails, attachments and links are identified and neutralized. - Completely backing up email, to ensure a complete record of all email communications. - Limiting instant messaging to internal use only. 1. **Telephony, Peripherals, Printing & Faxing:** - Disabling USB storage device read/write and DVD/R writing, to ensure that these vectors for potential attack or data theft can’t be utilized. - Logging and recording all phone calls. - Allowing only authenticated printing and faxing. 1. **Security as Corporate Culture:** - Holding periodic company meetings to educate our employees, and to re-enforce our security culture. In the final analysis, all service providers have to realize that effective security is not a destination – it’s a constant discipline that relies upon continuous evaluation, testing, validation and improvement.  The results are well-worth the effort! [Back](https://blog.rch1.com/blog) [![Retirement Clearinghouse An RLJ Company](https://blog.rch1.com/hs-fs/hubfs/raw_assets/public/Retirement_Clearinghouse_May2022/images/footer_logo.png?width=1000&height=648&name=footer_logo.png "Retirement Clearinghouse An RLJ Company")](https://rch1.com/) 1916 Ayrsley Town Boulevard Suite 200 Charlotte, NC 28273 - [Individuals](https://rch1.com/individuals) - [Plan Sponsors](https://rch1.com/plan-sponsors) - [Auto Portability](https://rch1.com/auto-portability) - [Company](https://rch1.com/company) - [News & Information](https://rch1.com/news) - [Mission](https://rch1.com/company/mission) - [Careers](https://rch1.com/company/careers) - [Contact Us](https://rch1.com/contact-us) - [Logins](https://rch1.com/#) - [Disclosure Central](https://rch1.com/individuals/learning-center/resources-%26-downloads) - [Do Not Sell or Share](https://blog.rch1.com/blog/dont-forget-about-svc-provider-security#decline-cookies) - [My Personal Information](https://blog.rch1.com/blog/dont-forget-about-svc-provider-security#decline-cookies) - - - Individuals should consult their tax advisers or legal counsel for advice and information concerning their particular situation. Retirement Clearinghouse does not give legal, investment, or tax advice. IRA account fees and product information provided by Retirement Clearinghouse, LLC is subject to change without notice at the discretion of the IRA Provider. RCH Shareholder Services is a wholly owned subsidiary of Retirement Clearinghouse, LLC and a registered transfer agent with the U.S. Securities and Exchange Commission. © 2026 Retirement Clearinghouse, LLC. This site is directed at, and made available to, persons in the U.S. and Puerto Rico. [Sitemap](https://rch1.com/sitemap)