The Dealership Risk Assessment: Written Criteria, Not a Checklist

The FTC Safeguards Rule requires dealerships to base their information security program on a written risk assessment. Many stores have something they call a risk assessment. Often it is a checklist: a list of controls with yes or no answers. A checklist can be a useful input, but it is not what the rule describes.

This post explains what the written risk assessment must contain, how it differs from a checklist, and how to make each one easier than the last.

What the rule requires

Section 16 CFR 314.4(b) says the information security program must be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in unauthorized disclosure, misuse, alteration, destruction, or other compromise, and assesses the sufficiency of the safeguards in place to control those risks.

Section 314.4(b)(1) then says the risk assessment shall be written and shall include:

1. Criteria for the evaluation and categorization of identified security risks or threats
2. Criteria for the assessment of the confidentiality, integrity, and availability of information systems and customer information, including the adequacy of existing controls in the context of the identified risks or threats
3. Requirements describing how identified risks will be mitigated or accepted based on the risk assessment, and how the information security program will address the risks

Section 314.4(b)(2) requires periodic additional risk assessments that reexamine the risks and reassess the safeguards.

Section 314.6 exempts institutions maintaining customer information on fewer than 5,000 consumers from the written requirement in (b)(1), though the underlying risk assessment in (b) still applies. Most dealerships hold far more than that.

Why a checklist is not enough

Notice the word "criteria" appears twice. The rule asks you to define how you will evaluate and categorize risks, and how you will judge whether controls are adequate. A checklist answers whether controls exist. It does not explain how you decided which risks matter most, how likely or damaging each one is, or why a control is or is not sufficient.

The third element, how risks will be mitigated or accepted, also requires decisions. A checklist with a "no" next to MFA on lender portals does not say what the store will do about it, who decided, or whether the risk is being accepted for now.

A practical structure

Here is a layout that satisfies the rule and is usable by a store.

Part 1: Scope and inventory

List the customer information the store holds and the systems that hold it. This draws on the inventory required by 314.4(c)(2). Include the DMS, CRM, F&I systems, lender portals, email, file shares, backups, paper deal jackets, and service systems. Note which vendors have access.

Part 2: Criteria

Write down your scales. For example:

• Likelihood: low, medium, or high, with a sentence defining each, such as "high means this has happened to us or to stores like ours in recent years, or the weakness is easy to exploit."
• Impact: low, medium, or high, defined in terms of customer harm, operational disruption, and regulatory exposure.
• Risk level: a simple matrix combining the two.
• Control adequacy: a definition of what makes a control adequate, partially adequate, or inadequate.

Write the criteria once and reuse them. They are the backbone of every future assessment.

Part 3: Risks

List the reasonably foreseeable risks, both internal and external. Examples for a dealership:

• Phishing leading to email account compromise and access to customer data
• Ransomware disabling the DMS
• An employee taking customer data when leaving for a competitor
• A vendor with remote access being compromised
• Deal jackets left unsecured in offices
• Lender portal credentials shared among F&I staff
• Customer information emailed unencrypted to outside parties
• Lost or stolen laptops or phones

For each, record the systems and information affected, the existing controls, an assessment of control adequacy using your criteria, and the resulting risk level.

Part 4: Decisions

For each risk, record the decision:

• Mitigate: what will be done, who owns it, and a realistic target based on priority and resources
• Accept: why, who accepted it, and when it will be revisited

This part is what connects the assessment to the rest of the program. It drives the safeguards in 314.4(c) and the topics the Qualified Individual reports on under 314.4(i).

Part 5: Sign off

The Qualified Individual signs the assessment. Many stores also have the dealer principal acknowledge it.

Making the next one easier

The first written risk assessment takes the most work. Later ones should be faster if you set them up well:

• Keep the criteria stable. Change them only when there is a good reason, so results are comparable over time.
• Keep the risk list living. Add risks when something new happens, such as a new vendor or a new type of attack in the industry.
• Track decisions to completion. Each reassessment should start by reviewing what happened to last time's decisions.
• Gather evidence throughout the year. Vulnerability scan results, penetration test findings, incident records, and training completion all feed the next assessment.
• Reassess after significant changes. A new DMS, an acquisition, or a security event are good reasons to revisit the assessment rather than waiting.

Who should be involved

The Qualified Individual leads, but the assessment is better when department heads contribute. The F&I director knows how credit applications actually move. The office manager knows where paper is stored. The service manager knows what the shop collects. IT knows the technical controls. Interview each one for twenty or thirty minutes and you will find risks a checklist never would.

Getting started

If your current assessment is a checklist, keep it. Use it as an input to Part 3. Then write your criteria, list your risks in business terms, and record a decision for each. That turns a checklist into a written risk assessment the rule recognizes and the store can use.

Our FTC Safeguards Rule overview lists every element of the rule, and our automotive page describes how we support dealerships. If you want help building or updating your written risk assessment, book a time with us.