1 

UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF ILLINOIS

EASTERN DIVISION

MARTIN J. WALSH, )

Secretary of Labor, United States )

Department of Labor, )

) Case Number: 1:20-cv-02138

Petitioner, )

) Judge Kness

v. )

)

ALIGHT SOLUTIONS, LLC ) 

)

)

Respondent. )

JOINT STATUS REPORT FOR STATUS HEARING WITH MAGISTRATE JUDGE

Petitioner MARTIN J. WALSH, Secretary of Labor, United States Department of Labor 

(“Secretary”), and Respondent Alight Solutions, LLC (“Alight”) file this Joint Status Report as 

ordered by the Court on April 1, 2022. (Dkt. No. 70). The Court ordered the parties to meet and 

confer and to file a status report that addresses the status of the document production and any issues 

with Alight’s production. In addition, the parties are to explain whether the Secretary agrees with 

Alight’s contention that the production for certain items “are complete or will soon be complete.” 

First, for the Sequential No. 1 issue, the parties are in agreement that Alight has produced 

new, unredacted versions of earlier produced documents. Second, Alight identified five categories 

of responses for which it will not identify the responsive documents; and without any guidance on 

the organization of the documents or the identification of the documents, it is impossible for the 

Secretary to ascertain what they are. Alight disagrees that is impossible to determine the 

organization of the documents as multiple declarations set forth when documents were produced 

for specific requests, the dates of those productions, and how the documents were organized. The 

Secretary will continue to review the produced documents and attempt to understand and ascertain 

Case: 1:20-cv-02138 Document #: 78 Filed: 04/22/22 Page 1 of 7 PageID #:922
2

what Alight has produced to date. Third, for another five categories, described in the table below,

Alight believes its production is complete or needs additional information to complete. The 

Secretary identified responsive documents that Alight needs to produce for each request. However, 

the parties have been unable to reach an agreement on those documents. The parties’ current 

position on each disputed category is identified in the below table:

Sequential 

numbering

Request 

Number

Description Alight's Position Secretary's Position

2 2 Alight’s policies 

and procedures 

relating to ERISA 

plans

Alight produced the 

Customer Identity 

Management (CIM) 

template on 3/22/22. The 

CIM is broadly 

standardized, with only 

minor variations permitted 

based on unique client 

scenarios (e.g., the addition 

of a foreign language option 

for certain authenticationrelated activities).

While Alight agreed to 

provide the template CIM, 

the plain language of

Request 2 does not require 

the production of individual 

client CIMs because a CIM 

is not a policy or procedure 

nor is it a: (1) supervisory 

procedure; (2) employee 

manual; (3) compliance and 

procedural manual; (4) 

ethics, compensation, and

conflict of interest policies; 

or (5) policies relating to 

ERISA plan clients.

The DOL needs the CIM for 

the ERISA plan clients, not just 

a template. Further, the same 

CIM will address security 

enhancements necessary to 

fulfill Subpoena Request 32. 

Security enhancements are 

specific to each client.

3 3 procedures relating 

to ERISA plans 

attachments related 

committees meeting 

on cybersecurity 

issues

Produced on 3/8/22. As 

discussed in our meet and 

confer, the targeted number 

of SPRC meetings is four 

each year. The DOL asked 

if any Alight committee 

addressing cybersecurity 

issues existed prior to the 

launch of the SPRC. Alight

confirmed that no Alight

committee addressing 

cybersecurity issues existed 

prior to the launch of the 

Alight initially represented that 

there was only one committee 

that dealt with cybersecurity 

issues. However, it now 

contends that the committee

only came into existence in 

2018 and then stopped having 

any documentation, meaning no 

agendas, no meeting minutes, 

and no documents at all with 

the committee starting in 2021. 

The Secretary remains skeptical 

that there are not any 

Case: 1:20-cv-02138 Document #: 78 Filed: 04/22/22 Page 2 of 7 PageID #:923
3

SPRC. Alight further 

advised that the SPRC has 

transitioned to a more 

informal structure and 

meeting minutes are no 

longer kept. The DOL asked 

if handouts or agendas are 

circulated now that meeting 

minutes are no longer kept.

Alight confirmed that no 

such handouts or agendas 

have been circulated.

Therefore, there are no other 

SPRC materials responsive 

to this Request. (Dkt. No. 

67, at ⁋15; see also Dkt. No. 

25, at 8 (“Respondent 

cannot produce what it does 

not have.”)).

No other minutes are 

required for this Request. In 

its Reply Brief to the Court, 

the DOL clarified Request 

#3 to require “all of this 

Committee’s meeting 

minutes for the entire period 

covered by the Subpoena,” 

which the Secretary stated 

was the “Alight Security 

Privacy Risk Committee.” 

(Dkt. No. 18, at 10). The 

District Court incorporated 

this clarification in its Order 

on October 28, 2021 (Dkt. 

No. 25, at 7). 

Regardless, the Incident 

Management Team and 

Fraud Investigation Team 

are not committees and do 

not have minutes separate 

from specific investigative 

summaries, which are 

already being produced.

documents associated with 

meetings for this committee.

In addition, Alight has 

informed the Secretary that 

additional committees deal with 

these issues. The Secretary 

needs to have the meeting 

minutes, and all related 

documents related to 

cybersecurity issues for the 

following committees: 

Audit Committee;

Incident Management Team;

Fraud Investigation Team;

Anti-Fraud Steering 

Committee

APP Committee;

Executive Committee; and

Data Security Committee

Case: 1:20-cv-02138 Document #: 78 Filed: 04/22/22 Page 3 of 7 PageID #:924
4

10 12 Services offered to 

clients with ERISA 

plans

Request for clarification. 

The DOL clarified in our 

meet and confer that the 

DOL would like to review 

10 sample RFP responses 

provided to plan sponsors of 

ERISA plans from 2021. 

Alight is willing to provide 

10 such sample RFP 

responses from 2021, but 

notes that the names of the 

potential clients will need to 

be redacted as RFPs are 

submitted pursuant to 

nondisclosure agreements. 

If redacted RFPs are 

acceptable, Alight will 

determine how long it will 

take to provide copies of the 

redacted RFPs and will 

provide an estimate. The 

DOL further clarified that 

the DOL is seeking to 

understand whether Alight 

provides any services 

related to cybersecurity or 

services to prevent 

fraudulent activities other 

than the Alight Protection 

Program. Alight can 

confirm that the Alight 

Protection Program is the 

only such available service.

The DOL requests 10 sample 

RFP responses, from 10 current 

clients, that were provided 

between 2015-2020.

15 20 system penetration 

setting

The DOL clarified in our 

meet and confer that the 

DOL believes that Alight 

produced summaries and 

not full reports. Alight 

produced all available 

reports. There are additional 

confidential reports 

generated which provide a 

roadmap to Alight’s security 

system. If Alight produced 

these confidential reports to 

any entity outside of Alight, 

Alight would be unable to 

obtain a SOC 1 or SOC 2 

certification. 

The 2021 report was

produced on 3/22/22.

The Secretary will not accept 

“summaries,” and requests the 

full reports. 

Case: 1:20-cv-02138 Document #: 78 Filed: 04/22/22 Page 4 of 7 PageID #:925
5

21 29 ERISA plan clients’ 

requests to have 

create, implement, 

or have access to 

cybersecurity 

procedures

Client contracts are 

dynamic; drafts are not 

stored. Alight proposes that 

the DOL select 10 Alight 

clients and Alight will pull 

all change orders related to 

cybersecurity with respect 

to those clients.

A sample is not acceptable. The 

DOL requests all letters or 

emails from clients requesting 

changes to cybersecurity 

procedures or requesting access 

to cybersecurity procedures

from 2015 to 2021. The 

Secretary will agree to start 

with the letters and emails from 

clients that had a fraud incident 

from 2015 to 2021; and will 

reserve the right to seek 

additional documents for this 

request.

The Secretary requests that Alight identify all responsive documents by bates stamp 

numbers and confirm it produced all responsive documents in its possession for the following 

Subpoena Requests: 4, 9, 10, 14, 21, 22, and 32. The Secretary will need time to subsequently

review. The Secretary requests that Alight provide a signed declaration attesting that it provided 

all responsive documents to each specific request for these request numbers. 

For the reasons set forth in its brief (Dkt. No. 72), Alight states that it is not required to 

identify all responsive documents by bates stamp. Moreover, Alight states that it has already 

provided signed declarations from both counsel and Alight confirming that these productions are 

complete. (See Dkt. Nos. 67-68).

The Secretary still awaits production for the remaining Subpoena Requests: 6, 7,11,13,18, 

19, 23, 27, 28, 30, 31, and 32 by the Court-ordered deadlines. The Secretary also requires the 

immediate production of a privilege log of all withheld documents. The Secretary expects Alight 

to provide all responsive documents in its possession for the outstanding requests timely. 

While Alight has made every effort to comply with this Court’s Order and has made 

multiple production of thousands of documents over the last few weeks, Alight maintains that it is 

not possible to fully comply with the deadlines set in this Court’s Order. Nevertheless, Alight 

continues to engage additional resources to expedite the production of the remaining documents 

Case: 1:20-cv-02138 Document #: 78 Filed: 04/22/22 Page 5 of 7 PageID #:926
6

as soon as possible. Regarding the Secretary’s request for a privilege log, prior to the filing of the 

proposed discovery order, none of the documents Alight collected were subject to privilege and, 

therefore, Alight did not withhold any documents at that time. The remaining document requests, 

including the ancillary documents and legal settlements request, have contained some privileged 

documents which Alight has withheld. Given the sheer magnitude of data Alight is collecting, 

reviewing, and producing (See Dkt. Nos. 76-77), Alight agrees to produce a privilege log after 

Alight has completed its productions so as to not slow down the production of documents to the 

Secretary. 

Finally, the parties write to inform the Court that oral argument on Alight’s appeal of the 

District Court’s October 28, 2021 order was held on April 21, 2022 in the Seventh Circuit. 

Case: 1:20-cv-02138 Document #: 78 Filed: 04/22/22 Page 6 of 7 PageID #:927
7 

Dated: April 22, 2022 Respectfully,

 

 SEEMA NANDA

 Solicitor of Labor 

 

 CHRISTINE Z. HERI

Regional Solicitor

/s/ Bruce C. Canetti 

BRUCE C. CANETTI

P.O. ADDRESS: Senior Trial Attorney

U.S. Department of Labor IL Reg. #: 6285867 

Office of the Solicitor

230 South Dearborn Street, Ste. 844 Attorneys for MARTIN J. WALSH, 

Chicago, Illinois 60604 Secretary of Labor,

Telephone: (312) 353-3271 U.S. Department of Labor, Plaintiff

Facsimile: (312) 353-5698 

canetti.bruce@dol.gov 

By: /s/ Erin M. Sweeney 

Daniel J. Fazio (6296352) 

DLA Piper LLP (US)

444 West Lake St.

Suite 900 

Chicago, IL 60606 

(312) 368-2190 

daniel.fazio@dlapiper.com 

- and - 

Erin M. Sweeney (admitted pro hac vice) 

DLA Piper LLP (US)

500 Eighth Street, NW 

Washington, DC 20004 

(202) 799-4323 

erin.sweeney@dlapiper.com 

Counsel for Respondent 

Alight Solutions LLC

Case: 1:20-cv-02138 Document #: 78 Filed: 04/22/22 Page 7 of 7 PageID #:928