Automotive Dealerships
Security for auto dealers that finance and lease vehicles
Dealers that arrange financing or lease vehicles are financial institutions under the FTC Safeguards Rule. We help dealerships build the required program, secure the F&I office and the DMS, and keep the evidence ready.
- Federal rule
- FTC Safeguards Rule, 16 CFR Part 314
- Also applies
- Red Flags Rule for dealers acting as creditors
- Sensitive data
- Credit applications and deal jackets
- Breach notice
- FTC notice for qualifying events
At a glance
Auto dealers that finance, help arrange financing for, or lease vehicles are covered by the FTC Safeguards Rule, and dealers that act as creditors also fall under the Red Flags Rule. CyberAccord helps dealerships write the security program, enforce multi-factor authentication and encryption, protect dealer systems and staff devices, and test defenses.
FTC Safeguards Rule, 16 CFR Part 314
The obligations you face
Each point below rests on a primary source. Follow the link to read the rule itself.
Financing and leasing make you a financial institution
The FTC says most dealers that finance or lease vehicles are covered by the Safeguards Rule, including dealers that facilitate financing. The rule requires a Qualified Individual, a written risk assessment, access controls, encryption, multi-factor authentication, staff training and service provider oversight.
SourceFTC: Automobile Dealers and the Safeguards Rule FAQs (opens in a new tab)
Testing and reporting are written into the rule
Unless a dealer has effective continuous monitoring, the rule requires annual penetration testing and vulnerability assessments at least every six months, plus a written incident response plan. Breaches involving unencrypted information of at least 500 consumers must be reported to the FTC within 30 days of discovery.
Source16 CFR 314.4 (FTC Safeguards Rule) (opens in a new tab)
Creditors need an identity theft program
The Red Flags Rule applies to financial institutions and creditors under FTC jurisdiction. A dealer that regularly arranges credit must run a written program to detect, prevent and respond to signs of identity theft in covered accounts, such as vehicle loans.
Sources last reviewed . This page explains obligations in general terms and is not legal advice.
Recommended services
What we recommend
Three services, most relevant first, chosen for the obligations above.
- 1 · Managed Security ServicesManaged SecurityManaged endpoint, email, and cloud security, with a team that monitors alerts and responds to incidents for you.
- 2 · Penetration TestingPenetration TestingManual, senior-led penetration testing of web apps, APIs, mobile apps, and networks, with prioritized findings and a re-test of fixes.
- 3 · Virtual CISOvCISOA part-time, U.S.-based security executive who leads your security program, manages risk, and reports to leadership.
Frameworks that apply
FAQ
Sector questions, answered
Our DMS vendor says it is compliant. Are we covered?
Not fully. The vendor secures its platform; the dealership remains responsible for its own program, who has access, the devices staff use, email, and oversight of every service provider that handles customer information.
Who can be our Qualified Individual?
An employee, someone at an affiliate, or a service provider. If you use a provider, the dealership keeps responsibility, must designate a senior person to oversee the provider, and must require the provider to maintain its own security program.
Are small dealerships exempt?
Partly. Dealers with records on fewer than five thousand consumers are exempt from a few elements, such as the written risk assessment, the incident response plan and the annual report. The rest of the program still applies.
Talk to a security practitioner
Tell us what is driving the need: an audit, a client questionnaire, a contract clause or an insurance renewal. We'll recommend a scoped next step with a fixed quote.