The ICO’s actionable insights and lessons learnt from cyber attacks – key takeaways for pension schemes

1

Multi-factor authentication (MFA)

The ICO slides make the following comments: 

• MFA mitigates common attack methods such as phishing and password spraying. 

• Article 25 – Data Protection by design and by default.

• ICO guidance states it should be implemented wherever it is possible to do so. 

MFA is a security process that requires users to provide two or more forms of verification before gaining access to an account, system or application. 

MFA is an easy win for all schemes. MFA can help trustees maintain the security of the mass amounts of sensitive personal and financial data they manage in a cheap and easy way. 

As well as using this for trustee email accounts, schemes can use MFA where scheme administration platforms or trustee portals are accessed remotely as it helps protect against unauthorised access. 

Vulnerability scanning

The ICO slides make the following comments: 

• Vulnerability scanning is an automated or semi-automated process used to identify security weaknesses.
• Penetration testing provides a deeper understanding of the security posture by actively testing defences and identifying weaknesses. 

Trustees should ask questions to determine whether their administrators are carrying out vulnerability scanning and penetration testing. 

While the ICO does not mandate penetration testing be carried out, organisations must identify risks and ensure appropriate technical and organisational measures are in place to mitigate against them. As penetration testing is invasive and costly, schemes will need to consider whether this is proportionate for them to carry out themselves. 

We would, however, expect scheme administrators to be conducting regular penetration testing given the volume of scheme data that they process.

Patch management

The ICO slides make the following comments: 

• Continuous monitoring and timely remediation of vulnerabilities. 

• Critical or high-risk vulnerabilities (based on CVSS score) should be prioritised. 

• How is patching approached by your organisation?

Trustees should ask questions to determine whether their administrators have a clear patching policy and that critical vulnerabilities are addressed promptly. 

If professional trustees hold large amounts of personal scheme data, it may be prudent to introduce patch management.

Monitoring and alerting

The ICO slides make the following comments: 

• Controls in place to detect unusual or suspicious activity. 

• This will likely vary significantly based on the size of the organisation and the data being processed. 

• If resourcing is an issue, focus on critical assets. 

Trustees should liaise with their scheme administrators to ensure they have appropriate monitoring in place and that alerts are reviewed and acted upon promptly. 

The importance of this takeaway was highlighted during the Capita breach in 2023 as despite a high security alert being raised within 10 minutes of the breach, Capita failed to effectively respond for 58 hours which allowed the attacker to exploit their system. 

It may be appropriate for professional trustees to establish their own internal monitoring and alerting processes.

Know what you have, know what it holds 

The ICO slides make the following comments: 

• The systematic process of identifying, tracking and managing an organisation’s assets. 

• The ICO have an expectation an Information Asset Register will be in place. 

• Consider obligations under Articles 33 and 34 of the UK GDPR. 

As data controllers, trustees should engage in data and asset mapping so that they know what data they are responsible for and where it is. The ICO refers to this as an Information Asset Register. 

Once a scheme has processes in place to map their data and assets, they can understand their cyber footprint. This means understanding who their suppliers are, who their suppliers’ sub-processors are and what the flow of data and assets actually looks like for their scheme in practice. 

Once this is understood, trustees can make a risk-based decision regarding the extent to which they would like to review their suppliers (both from a processes and a contractual perspective), which is expected by the Pensions Regulator and the ICO.