--- title: "The Dealership Risk Assessment: Written Criteria, Not a Checklist" url: https://trnsfrm.tech/blog/dealership-written-risk-assessment description: "The Safeguards Rule requires a written risk assessment with criteria for evaluating risks." lang: en --- Back to blog (https://trnsfrm.tech/blog) Image: The Dealership Risk Assessment: Written Criteria, Not a Checklist (https://trnsfrm.tech/blog-covers/cmmc.jpg) By Jeff Dennis (https://www.linkedin.com/in/jefferydennis), Founder & CEO November 15, 2026 # The Dealership Risk Assessment: Written Criteria, Not a Checklist Auto Dealerships (https://trnsfrm.tech/blog?category=Auto+Dealerships)#ftc-safeguards #dealerships #risk-assessment The FTC Safeguards Rule requires dealerships to base their information security program on a written risk assessment. Many stores have something they call a risk assessment. Often it is a checklist: a list of controls with yes or no answers. A checklist can be a useful input, but it is not what the rule describes. This post explains what the written risk assessment must contain, how it differs from a checklist, and how to make each one easier than the last. ## What the rule requires Section 16 CFR 314.4(b) says the information security program must be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in unauthorized disclosure, misuse, alteration, destruction, or other compromise, and assesses the sufficiency of the safeguards in place to control those risks. Section 314.4(b)(1) then says the risk assessment shall be written and shall include: 1. Criteria for the evaluation and categorization of identified security risks or threats 2. Criteria for the assessment of the confidentiality, integrity, and availability of information systems and customer information, including the adequacy of existing controls in the context of the identified risks or threats 3. Requirements describing how identified risks will be mitigated or accepted based on the risk assessment, and how the information security program will address the risks Section 314.4(b)(2) requires periodic additional risk assessments that reexamine the risks and reassess the safeguards. Section 314.6 exempts institutions maintaining customer information on fewer than 5,000 consumers from the written requirement in (b)(1), though the underlying risk assessment in (b) still applies. Most dealerships hold far more than that. ## Why a checklist is not enough Notice the word "criteria" appears twice. The rule asks you to define how you will evaluate and categorize risks, and how you will judge whether controls are adequate. A checklist answers whether controls exist. It does not explain how you decided which risks matter most, how likely or damaging each one is, or why a control is or is not sufficient. The third element, how risks will be mitigated or accepted, also requires decisions. A checklist with a "no" next to MFA on lender portals does not say what the store will do about it, who decided, or whether the risk is being accepted for now. ## A practical structure Here is a layout that satisfies the rule and is usable by a store. ### Part 1: Scope and inventory List the customer information the store holds and the systems that hold it. This draws on the inventory required by 314.4(c)(2). Include the DMS, CRM, F&I systems, lender portals, email, file shares, backups, paper deal jackets, and service systems. Note which vendors have access. ### Part 2: Criteria Write down your scales. For example: - **Likelihood:** low, medium, or high, with a sentence defining each, such as "high means this has happened to us or to stores like ours in recent years, or the weakness is easy to exploit." - **Impact:** low, medium, or high, defined in terms of customer harm, operational disruption, and regulatory exposure. - **Risk level:** a simple matrix combining the two. - **Control adequacy:** a definition of what makes a control adequate, partially adequate, or inadequate. Write the criteria once and reuse them. They are the backbone of every future assessment. ### Part 3: Risks List the reasonably foreseeable risks, both internal and external. Examples for a dealership: - Phishing leading to email account compromise and access to customer data - Ransomware disabling the DMS - An employee taking customer data when leaving for a competitor - A vendor with remote access being compromised - Deal jackets left unsecured in offices - Lender portal credentials shared among F&I staff - Customer information emailed unencrypted to outside parties - Lost or stolen laptops or phones For each, record the systems and information affected, the existing controls, an assessment of control adequacy using your criteria, and the resulting risk level. ### Part 4: Decisions For each risk, record the decision: - **Mitigate:** what will be done, who owns it, and a realistic target based on priority and resources - **Accept:** why, who accepted it, and when it will be revisited This part is what connects the assessment to the rest of the program. It drives the safeguards in 314.4(c) and the topics the Qualified Individual reports on under 314.4(i). ### Part 5: Sign off The Qualified Individual signs the assessment. Many stores also have the dealer principal acknowledge it. ## Making the next one easier The first written risk assessment takes the most work. Later ones should be faster if you set them up well: - **Keep the criteria stable.** Change them only when there is a good reason, so results are comparable over time. - **Keep the risk list living.** Add risks when something new happens, such as a new vendor or a new type of attack in the industry. - **Track decisions to completion.** Each reassessment should start by reviewing what happened to last time's decisions. - **Gather evidence throughout the year.** Vulnerability scan results, penetration test findings, incident records, and training completion all feed the next assessment. - **Reassess after significant changes.** A new DMS, an acquisition, or a security event are good reasons to revisit the assessment rather than waiting. ## Who should be involved The Qualified Individual leads, but the assessment is better when department heads contribute. The F&I director knows how credit applications actually move. The office manager knows where paper is stored. The service manager knows what the shop collects. IT knows the technical controls. Interview each one for twenty or thirty minutes and you will find risks a checklist never would. ## Getting started If your current assessment is a checklist, keep it. Use it as an input to Part 3. Then write your criteria, list your risks in business terms, and record a decision for each. That turns a checklist into a written risk assessment the rule recognizes and the store can use. Our FTC Safeguards Rule overview (https://trnsfrm.tech/frameworks/ftc-safeguards) lists every element of the rule, and our automotive page (https://trnsfrm.tech/industries/automotive) describes how we support dealerships. If you want help building or updating your written risk assessment, book a time (https://trnsfrm.tech/book) with us. ## Related articles Auto Dealerships ### Writing a Dealership WISP That Matches How the Store Runs The FTC Safeguards Rule requires a written information security program. How to build one that describes your actual systems, people, and vendors instead of a downloaded template. Read article https://trnsfrm.tech/blog/dealership-written-information-security-program Auto Dealerships ### The F&I Office: Deal Jackets, Credit Applications, and the Printer Credit applications, licenses, and deal jackets all pass through F&I. How the FTC Safeguards Rule applies to paper, screens, printers, email, and retention. Read article https://trnsfrm.tech/blog/dealership-fi-office-customer-data Auto Dealerships ### DMS Vendor Access: Who Can Get Into Your Dealer Management System Your DMS holds more customer data than any other system in the store. How to list every vendor and integration that can reach it, cut what you do not need, and review it. Read article https://trnsfrm.tech/blog/dealership-dms-vendor-access Call Now: +18777776855 ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "name": "TRNSFRM", "legalName": "Bitboyz LLC", "alternateName": [ "TRNSFRM Technology", "Bitboyz", "Bitboyz LLC", "Bitboyz LLC DBA TRNSFRM" ], "url": "https://trnsfrm.tech", "logo": "https://trnsfrm.tech/wp-content/uploads/2021/11/trnsfrm-logo.svg", "image": "https://trnsfrm.tech/og-image.png", "description": "Cybersecurity, compliance, and managed IT services for manufacturers, construction, automotive, and healthcare organizations.", "foundingDate": "2008", "telephone": "+1-877-777-6855", "email": "info@trnsfrm.tech", "founder": { "@type": "Person", "name": "Jeff Dennis", "jobTitle": "Founder & CEO", "url": "https://trnsfrm.tech/", "sameAs": [ "https://www.linkedin.com/in/jefferydennis" ] }, "areaServed": [ { "@type": "Country", "name": "United States" }, { "@type": "City", "name": "Cleveland", "containedInPlace": { "@type": "State", "name": "Ohio" } }, { "@type": "City", "name": "Columbus", "containedInPlace": { "@type": "State", "name": "Ohio" } } ], "address": [ { "@type": "PostalAddress", "streetAddress": "10143 Royalton Rd Suite J", "addressLocality": "North Royalton", "addressRegion": "OH", "postalCode": "44133", "addressCountry": "US" }, { "@type": "PostalAddress", "addressLocality": "Columbus", "addressRegion": "OH", "addressCountry": "US" } ], "contactPoint": { "@type": "ContactPoint", "contactType": "customer service", "telephone": "+1-877-777-6855", "email": "info@trnsfrm.tech", "areaServed": "US", "availableLanguage": "English" }, "knowsAbout": [ "CMMC", "NIST 800-171", "ISO 27001", "HIPAA", "FTC Safeguards", "ITAR", "Managed IT", "vCISO", "vCIO", "Cybersecurity", "Microsoft GCC High" ], "makesOffer": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Cybersecurity", "url": "https://trnsfrm.tech/cybersecurity", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Governance & Compliance", "url": "https://trnsfrm.tech/governance", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed IT", "url": "https://trnsfrm.tech/managed-it", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "vCISO", "url": "https://trnsfrm.tech/vciso", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Integration & Implementation", "url": "https://trnsfrm.tech/services/ai", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Microsoft GCC / GCC High", "url": "https://trnsfrm.tech/services/microsoft-gcc", "provider": { "@type": "Organization", "name": "TRNSFRM" } } } ], "aggregateRating": { "@type": "AggregateRating", "ratingValue": "5.0", "reviewCount": "177", "bestRating": "5", "worstRating": "1" }, "sameAs": [ "https://www.linkedin.com/company/trnsfrmtech", "https://www.linkedin.com/in/jefferydennis", "https://clutch.co/profile/trnsfrm", "https://maps.google.com/?cid=0x8830ed5d3a6900c5:0xe344c24d13357f96", "https://www.goodfirms.co/company/trnsfrm", "https://www.bestitmsps.com/company/trnsfrm/" ] }, { "@context": "https://schema.org", "@type": "WebSite", "name": "TRNSFRM", "url": "https://trnsfrm.tech", "publisher": { "@type": "Organization", "name": "TRNSFRM" }, "potentialAction": { "@type": "SearchAction", "target": "https://trnsfrm.tech/blog?q={search_term_string}", "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "ProfessionalService", "name": "TRNSFRM", "legalName": "Bitboyz LLC", "alternateName": [ "TRNSFRM Technology", "Bitboyz", "Bitboyz LLC", "Bitboyz LLC DBA TRNSFRM" ], "url": "https://trnsfrm.tech", "image": "https://trnsfrm.tech/og-image.png", "telephone": "+1-877-777-6855", "email": "info@trnsfrm.tech", "address": { "@type": "PostalAddress", "streetAddress": "10143 Royalton Rd Suite J", "addressLocality": "North Royalton", "addressRegion": "OH", "postalCode": "44133", "addressCountry": "US" }, "areaServed": [ { "@type": "Country", "name": "United States" }, { "@type": "City", "name": "Cleveland", "containedInPlace": { "@type": "State", "name": "Ohio" } }, { "@type": "City", "name": "Columbus", "containedInPlace": { "@type": "State", "name": "Ohio" } } ], "priceRange": "$$", "sameAs": [ "https://www.linkedin.com/company/trnsfrmtech", "https://www.linkedin.com/in/jefferydennis", "https://clutch.co/profile/trnsfrm", "https://maps.google.com/?cid=0x8830ed5d3a6900c5:0xe344c24d13357f96", "https://www.goodfirms.co/company/trnsfrm", "https://www.bestitmsps.com/company/trnsfrm/" ] }, { "@context": "https://schema.org", "@graph": [ { "@type": "BlogPosting", "headline": "The Dealership Risk Assessment: Written Criteria, Not a Checklist", "description": "The Safeguards Rule requires a written risk assessment with criteria for evaluating risks. What that looks like for a dealership and how it drives the rest of the program.", "author": { "@type": "Person", "name": "Jeff Dennis", "jobTitle": "Founder & CEO", "url": "https://www.linkedin.com/in/jefferydennis", "sameAs": [ "https://www.linkedin.com/in/jefferydennis" ], "worksFor": { "@type": "Organization", "name": "TRNSFRM", "url": "https://trnsfrm.tech" } }, "datePublished": "2026-11-15T00:16:53.089+00:00", "publisher": { "@type": "Organization", "name": "TRNSFRM", "url": "https://trnsfrm.tech" }, "image": "https://trnsfrm.tech/blog-covers/cmmc.jpg" }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://trnsfrm.tech/" }, { "@type": "ListItem", "position": 2, "name": "Blog", "item": "https://trnsfrm.tech/blog" }, { "@type": "ListItem", "position": 3, "name": "The Dealership Risk Assessment: Written Criteria, Not a Checklist", "item": "https://trnsfrm.tech/blog/dealership-written-risk-assessment" } ] } ] } ] ```