DMS Vendor Access: Who Can Get Into Your Dealer Management System

Your dealer management system holds more customer information than any other system in the store: names, addresses, Social Security numbers, credit applications, deal history, and often bank details. Most dealers think about who on staff can log in. Fewer have a clear picture of every outside party that can reach the DMS.

That second list is usually longer than expected. It includes the DMS provider's own support staff, CRM and desking integrations, F&I menu tools, digital retailing platforms, accounting connections, marketing and data-mining vendors, OEM reporting feeds, and the occasional consultant who was given a login years ago. Each one is a path to your customers' data.

Why the Safeguards Rule cares

For dealers covered by the FTC Safeguards Rule, two requirements apply directly:

• Access controls, under 16 CFR 314.4(c)(1), which require you to implement and periodically review controls so that only authorized users can access customer information, and only the information they need.
• Service provider oversight, under 314.4(f), which requires you to select providers capable of maintaining appropriate safeguards, require them by contract to do so, and periodically assess them based on the risk they present.

The rule also requires MFA for any individual accessing any information system, under 314.4(c)(5), unless your Qualified Individual approves an equivalent control in writing. That includes vendor staff. And under 314.4(c)(8), you need to monitor and log the activity of authorized users, which includes vendors.

The CIS Controls cover the same ground in Control 15, service provider management, and Control 6, access control management.

Step 1: Build the list

Start by asking your DMS provider for a report of every integration, API connection, and third-party account with access to your system. Your provider should be able to tell you this. Then compare it against what your managers think is connected.

For each connection, record:

• The vendor name and what the tool does
• Who at the dealership requested it and who owns the relationship now
• What data it can read or write
• How it connects: an API key, a named user account, a shared login, a remote support tool
• Whether there is a current contract with security terms
• When it was last reviewed

Expect to find tools nobody uses anymore, accounts belonging to vendors you stopped paying, and integrations with far broader access than the tool requires. That is normal. It is also exactly what the review is meant to catch.

Step 2: Cut what you do not need

Remove access for:

• Vendors you no longer use
• Integrations that were set up for a trial or a pilot and never removed
• Individual vendor staff who have changed roles or left
• Any shared logins

For the connections you keep, ask whether each one needs the access it has. A marketing tool may need contact information and service history. It probably does not need Social Security numbers or credit application data. Ask the DMS provider whether data access can be scoped by field or by function.

Step 3: Tighten how vendors get in

Remote support is a common weak spot. A vendor support technician who can connect to any workstation in the store at any time, with no notice, is a risk regardless of how trustworthy the vendor is. Better practice is:

• Support sessions are initiated or approved by your staff, not opened unattended.
• Vendor accounts are individual, not shared, and use MFA.
• Vendor access is limited to the systems they support.
• Sessions are logged, and someone reviews the logs.

Where a vendor insists on persistent access, ask why, document the answer, and have your Qualified Individual decide whether to accept it.

Step 4: Put it in the contract

The Safeguards Rule requires that your contracts require service providers to maintain appropriate safeguards. For DMS-connected vendors, useful terms include:

• A commitment to maintain an information security program
• Notification to you if they have a security event affecting your data, within a defined time
• Limits on what they do with your customer data
• Return or deletion of your data when the relationship ends
• Your right to request evidence of their security practices

If a vendor will not commit to any of this in writing, that tells you something about the risk.

Step 5: Review on a schedule

Access drifts. New tools get connected, staff change, vendors are acquired. Set a regular review, at least annually and whenever you add or remove a significant vendor. Pull the integration report again, compare it to your list, and remove what does not belong. Record the date and who did it. That record is evidence for your Qualified Individual's annual report to the dealer principal or board under 314.4(i).

When a vendor has an incident

Vendors get breached. When one of yours does, you need to know quickly what data they had and how they connected. The list you built in Step 1 answers both questions. If the incident may involve the information of 500 or more consumers, your own FTC notification obligation may apply. Our post on how the FTC 30-day clock works for dealers walks through it.

How we help

TRNSFRM works with Ohio dealerships on access reviews, vendor oversight, and the rest of the Safeguards program, including serving as or supporting the Qualified Individual. See our FTC Safeguards overview and automotive page. Start with the free compliance checklist, or book a free 45-minute Compliance Gap Audit.