“Many [plan sponsors] are purchasing cyber liability insurance coverage to supplement their data security measures…. [M]any policies vest the decision to retain legal counsel in the insurer, rather than the policyholder…. Plan sponsors should also identify the plan’s service providers who have access to PII and PHI and ensure that the plan’s cyber liability policy covers those providers, or that those providers have their own cyber liability policies.” Spencer Fane