PRAG updates guidance on cybercrime protection as 43 pension organisations report breaches to ICO over past two years

The Pensions Research Accountants Group (PRAG) has published updated guidance to help trustees protect their schemes from cybercrime.
The guidance has been put together by PRAG's Cybercrime and Fraud Working Party and updates previous guidance published in 2018, to reflect what it says are considerable developments and increase in cybercrime since then.
PRAG cybercrime and fraud working party chairman Jim Gee said: "Cybercrime is one of the problems of our age, with pensions organisations reporting 43 cybercrime breaches to the Information Commissioners Office (ICO) since July 2018.
"Its prevalence had been growing significantly in the years before Covid-19 - together with fraud it represented 42% of all crime in 2019. However, it has surged since the lockdown as organised criminals have redirected resources from drug manufacture and distribution. This is the case in the pensions sector as much as any other."
Gee said the guidance describes the rapidly evolving nature of cybercrime and legal/regulatory expectations, and then focuses on the three main action areas which are key to schemes being properly protected. These are:
- understanding the nature of the scheme's vulnerability to cybercrime
- ensuring the scheme is resilient to cybercrime
- ensuring that, if attacked, the scheme remains able to fulfil key functions.
The guidance also recommends that schemes should consider obtaining independent verification that these actions are being followed - just like an independent audit of financial accounts.
Gee added: "Every trustee should read and act on this advice. Pension schemes need holistic, all round protection to reduce the impact that an attack would have (and to be assured that their suppliers also have the required protection). The key is to be as secure as possible but to plan for a cybercrime attack happening and to be ready to manage and mitigate any damage."
Shona Harvie, chair of the PRAG executive, added: "This updated guidance will help trustees respond to the increasing and developing threat of cybercrime within the pensions industry. I would like to thank Jim Gee and the other members of the working group for pulling this important guidance together so quickly."
Harvie said the PRAG guidance is aimed at trustees and can be used in conjunction with the soon to be published Pensions Administration Standards Association (PASA) guidance for pensions administrators.
The guidance is available to PRAG members on its website: www.prag.org.uk
More on Admin / Technology
Mercer urges government and HMRC to clarify GMP equalisation guidance
The government must work with HM Revenue and Customs (HMRC) and the wider industry to clarify GMP equalisation uncertainties, Mercer says.
LGPS funds see increase in claims over historic transfers
Around two-thirds (77%) of Local Government Pension Scheme (LGPS) funds have received a claim relating to historic transfers over the past 12 months, according to Eversheds.
DWP urged to give pension funds a stronger steer on dashboard data
Schemes need more certainty over the data they will have to provide for dashboards, as the minister is expected to take a heavier stance in 2021, experts say.
Pension scheme cyber risk - the key challenges and who is responsible
The Institute and Faculty of Actuaries' Patrick Kelliher and Vanessa Jaeger look at the key cyber risks faced by pension schemes, who is responsible for managing these risks, and how these risks may be managed.
Partner Insight: What is the cost of getting future-fit when it comes to pension technology?
The UK pensions sector is in dire need of a technology revolution – and there are plenty of forces at play to push and pull the industry into the 21st century.