Dealers that offer financing or leasing hold some of the most sensitive customer data there is: Social Security numbers, credit applications, and bank details. We deliver the risk assessment, written program, and security testing the Safeguards Rule requires, with a clear report for your compliance file.
Dealerships that arrange financing or leasing for customers are financial institutions under the FTC Safeguards Rule.
Your dealership needs a Written Information Security Program based on a written risk assessment, overseen by a Qualified Individual who reports in writing to ownership at least once a year.
16 CFR § 314.4(a), (b), (i)Unless you monitor your systems continuously, the rule requires an annual penetration test and vulnerability assessments at least every six months, plus after any material change to your operations.
16 CFR § 314.4(d)(2)Multi-factor authentication for anyone accessing your systems, encryption of customer information, and notice to the FTC within 30 days of discovering a breach affecting 500 or more customers.
16 CFR § 314.4(c)(3), (c)(5), (j)Dealers holding information on fewer than 5,000 consumers are exempt from the written risk assessment, the penetration testing schedule, the written incident response plan, and the annual report. Most franchise dealers exceed that threshold. We confirm which case applies to you on the first call.
We confirm which parts of the rule apply to your dealership and map your systems and vendors.
We review how customer data flows through sales, F&I, and service, and document the risks.
Controlled testing of your internet-facing and internal systems, scheduled around business hours.
You receive the test report, the WISP, and a prioritized plan, and we review it with your team.
Starting prices for a typical small office. Your written quote sets the final price after the free call.
If your dealership arranges financing or leasing for customers, it is treated as a financial institution under the rule and must comply. We confirm your situation on the free call.
At least once a year, plus vulnerability assessments at least every six months and after any material change, unless you continuously monitor your systems. Dealers with fewer than 5,000 consumers are exempt from this testing schedule.
No. The rule makes the dealership responsible for its own program and for overseeing its service providers. Your DMS is one system among many: email, remote access, Wi-Fi, and staff devices also hold customer data.
An owner, a manager, an employee, or an outside provider. The dealership remains responsible, and the Qualified Individual must report in writing to ownership at least once a year.
If unencrypted information about 500 or more customers is involved, you must notify the FTC as soon as possible and no later than 30 days after discovery. A tested incident response plan makes that deadline manageable.
No. Testing is scheduled with you in advance, can run outside business hours, and uses controlled techniques designed not to interrupt your systems.
This page is general information about regulatory requirements, not legal advice.