The FTC Safeguards Qualified Individual: What the Role Actually Involves

The FTC Safeguards Rule requires every covered financial institution to name one person responsible for its information security program. The rule calls that person the Qualified Individual. The rule's own definitions list an automobile dealership that leases vehicles on a nonoperating basis for longer than 90 days as a financial institution for that leasing business, and dealers that extend or arrange consumer financing are generally treated as covered too. Coverage depends on what your store actually does, not what it calls itself, so confirm it with your counsel before anything else.

Many stores named someone when the amended requirements took effect in June 2023, wrote a name down, and moved on. This post is about what the role actually involves, because the rule describes a job, not a title.

What the rule requires

Under 16 CFR 314.4(a), the dealership must designate a Qualified Individual responsible for "overseeing and implementing" the information security program and enforcing it. The person can be:

• An employee of the dealership
• An employee of an affiliate, such as a dealer group's central office
• An employee of a service provider, such as an outside IT or security firm

The FTC's guidance is clear that the rule does not require a particular degree or title. What matters is that the person has the knowledge and authority to do the work.

If you outsource it, the responsibility stays with you

If you use a service provider or affiliate as your Qualified Individual, the rule adds three conditions. The dealership keeps responsibility for complying with the rule. The dealership must designate a senior member of its own staff to direct and oversee the Qualified Individual. And the service provider or affiliate must maintain its own information security program that protects the dealership.

In plain terms: you can hire someone to do the work, but you cannot hire away the accountability. Somebody inside the store, usually the dealer principal, general manager, or controller, needs to be watching.

What the Qualified Individual actually does

The rule does not list the Qualified Individual's duties in one place. They come from the elements of the program the person oversees. Under 314.4, the program must include:

• A written risk assessment with criteria for evaluating risks and how each will be addressed, reassessed periodically
• Access controls limiting who can reach customer information to those who need it
• An inventory of the data, personnel, devices, systems, and facilities involved
• Encryption of customer information in transit over external networks and at rest, or compensating controls the Qualified Individual reviews and approves
• Multifactor authentication for any individual accessing any information system, unless the Qualified Individual approves an equivalent control in writing
• Secure disposal of customer information no later than two years after it was last used to serve the customer, with stated exceptions
• Change management procedures
• Monitoring and logging of authorized user activity
• Testing, either continuous monitoring or annual penetration testing plus vulnerability assessments at least every six months and after material changes
• Training for staff and qualified security personnel
• Service provider oversight: selecting capable providers, requiring safeguards by contract, and assessing them periodically
• A written incident response plan
• Reporting to the FTC within 30 days of discovering a notification event involving 500 or more consumers

Notice how many of those require a judgment call from the Qualified Individual specifically. Approving compensating controls for encryption. Approving MFA alternatives in writing. Deciding what testing approach fits. Those approvals need to be documented with the reasoning, because they are the decisions someone will ask about later.

The annual report to the owner

Section 314.4(i) requires the Qualified Individual to report in writing, at least annually, to the board of directors or equivalent governing body. If there is no board, the report goes to a senior officer responsible for the information security program. The report must cover the overall status of the program and compliance with the rule, plus material matters such as risk assessment results, risk management decisions, service provider arrangements, testing results, security events and how management responded, and recommendations for changes.

For a dealership, that usually means the dealer principal reads it. Read it closely. It is the document that tells you whether the program is real. If the report is a page of generic language with no findings, no open items, and no decisions for you to make, the program probably is not working.

Smaller stores: what changes and what does not

Under 314.6, institutions that maintain customer information on fewer than 5,000 consumers are exempt from a few specific requirements: the written risk assessment, the continuous monitoring or testing schedule, the written incident response plan, and the annual report. They still need a Qualified Individual and the other safeguards. Most stores with a working F&I office reach that number faster than owners expect, so count before assuming you are under it.

Signs your Qualified Individual setup needs attention

• The named person left the company or changed roles and nobody updated the designation
• Nobody can produce the last written risk assessment
• MFA exceptions exist but no one approved them in writing
• The DMS, CRM, and credit platforms have never been reviewed as service providers
• No one has seen an annual report, or it looks the same every year
• The outside provider acting as Qualified Individual has never been asked about its own security program

None of these require a crisis to fix. They require someone with time and authority to own the program.

Picking the right person

There is no perfect answer between internal and external. An internal Qualified Individual knows the store, the people, and the systems, but may not have security depth or time. An external one brings experience across many environments but needs a strong internal partner to get anything done. Many dealerships end up with a hybrid: an outside firm in the role, with the controller or GM as the designated senior overseer who meets with them regularly.

Whatever you choose, write it down: who the Qualified Individual is, who oversees them if they are external, and when the role was last reviewed.

How we help

TRNSFRM works with Ohio dealerships on FTC Safeguards programs, including serving as or supporting the Qualified Individual. Our FTC Safeguards overview and automotive page explain the approach. The FTC's own guide, FTC Safeguards Rule: What Your Business Needs to Know, is worth reading in full.

If you want a quick read on where your program stands, start with the free compliance checklist, or book a free 45-minute Compliance Gap Audit.