SPARK Plans Data Security Certification for Recordkeepers

The SPARK Institute has unveiled its plan to establish uniform data-management standards for the defined contribution (DC) retirement plan market through its newly created Data Security Oversight Board.

Mike Volo, senior partner at Cammack Retirement Group in Wellesley, Massachusetts, who will participate in the board, tells PLANSPONSOR, “I believe data security is a bigger challenge now. Heightened security threats are seen in the media every day, and technology is evolving so quickly and is sophisticated and complex. It is difficult for recordkeepers and advisers vetting recordkeepers to keep up with the newest threats.”

Tim Rouse, executive director of the SPARK Institute in Simsbury, Connecticut, adds, “There is a proliferation of modems for getting into data; even phones are a new source.”

SPARK’s Data Security Oversight Board will collaborate to establish uniform criteria for recordkeepers aimed at providing a baseline level of security across the retirement industry. Common Criteria Certification, as it is known, ensures that services purchased by organizations perform and are secure at the desired level of performance, the Institute says. It has emerged as a standard by which all industries can evaluate the security of IT and data systems.

Rouse says the concept for the board came about because recordkeeper members of SPARK have very intense cyber security protection, and the consultant community has a duty to make sure plan sponsors know the depth to which participant data is being protected. But, recordkeepers don’t want to constantly explain their data protection strategies because that itself becomes a data security weakness.