Board hears pitch for vendor cybersecurity review; attorney warns of possible liability

A caller proposing a cybersecurity review told the Holly Hill Pension Board that FoxPoint Solutions can assess the board's vendors against the Department of Labor's 12 best practices and produce a vendor-by-vendor evaluation.

The presenter said, "There's a company called FoxPoint Solutions and they will actually analyze each of your vendors regarding those 12 best practices and then give you a report," and offered the service for a one-time fee of $7,500. He described the exercise as voluntary for public plans and said private plans under ERISA are more likely to face a legal mandate.

Board members asked whether the assessment guarantees security or provides insurance; the presenter replied it would not guarantee the absence of breaches and that many vendors already carry cybersecurity insurance. Ricky, the board's attorney, cautioned the board about contracting and liability, saying, "I think that going forward with this may potentially increase the board's liabilities since you're not mandated to do it." Ricky also noted the city or plan would have a contract with Foster and Foster, not FoxPoint, limiting direct legal remedies against FoxPoint.

The presenter offered to have FoxPoint call into the board's next meeting so trustees could hear directly from the vendor; some trustees suggested waiting to review the police board's experience and any report they receive before deciding.

Next steps: the board did not vote during the call. Trustees appeared inclined to await the police board's report and share any received materials before determining whether to authorize an assessment or invite FoxPoint to present in a future meeting.