What this covers
The FTC Safeguards Rule requires dealerships and other financial institutions to maintain a written information security program. We are not a law firm. We provide the IT infrastructure, security practices, and documentation that support that program.
What we actually do
- Access controls limiting who can reach customer financial data
- Encryption of sensitive data at rest and in transit
- Continuous monitoring and logging of access to F&I systems
- Multi-factor authentication on systems holding customer data
- Incident response planning and documented procedures
- Staff security awareness training
- Risk assessments and gap tracking to support your qualified individual
What we don't claim
We do not claim to provide your full written information security program on our own. That requires policy and designated personnel decisions your dealership makes. We provide and document the technology controls that support it.
Who the rule covers
The Safeguards Rule applies to non-bank financial institutions under the Gramm-Leach-Bliley Act. For our clients, that most often means franchised and independent auto dealerships that arrange financing or leasing, along with mortgage brokers, tax preparers, and other firms that handle customers' financial information. The amended rule's main requirements took effect in June 2023.
The technical requirements, and how we meet them
| Rule requirement | What we put in place |
|---|---|
| Access controls | Unique logins, least-privilege access to DMS and F&I systems, and prompt offboarding |
| Data inventory | A documented map of where customer financial data lives: DMS, F&I menus, credit apps, email, scanners |
| Encryption | Full-disk encryption on every device, encrypted email options, and encryption in transit |
| Multi-factor authentication | MFA enforced for anyone accessing customer information, including remote and vendor access |
| Monitoring and logging | Centralized logs of user activity on systems holding customer data, monitored 24/7 |
| Secure disposal | Documented device retirement and data destruction |
| Change management | Tracked, approved changes to systems and network configuration |
| Testing | Annual penetration testing and vulnerability scans at least every six months |
| Vendor oversight | Review of the security of service providers with access to your data |
| Incident response | A written incident response plan, tested and kept current |
What your dealership still owns
The rule requires a Qualified Individual to oversee your information security program, a written risk assessment, staff training, and an annual written report to your board or owner. We supply the evidence for each: assessment findings, test results, training records, and an incident log, organized so your Qualified Individual can sign off with confidence. Dealerships that maintain information on fewer than 5,000 consumers are exempt from some of the documentation requirements, and we'll tell you honestly whether that applies to you.
Built for how dealerships actually run
Showrooms, service drives, and F&I offices each need a different level of access. We segment the network so guest Wi-Fi, service-bay equipment, and F&I systems can't see each other, lock down shared desk logins, and keep the DMS reachable when the internet blinks. We support dealerships across Sarasota, Venice, Bradenton, and Port Charlotte, including multi-rooftop groups under a single agreement.