--- title: "The FTC Safeguards Qualified Individual: What the Role Ac..." url: https://trnsfrm.tech/blog/ftc-safeguards-qualified-individual-dealerships description: "The FTC Safeguards Rule requires one person to oversee your information security program. What the Qualified Individual does, who can fill the role, and how…" lang: en --- Back to blog (https://trnsfrm.tech/blog) Image: The FTC Safeguards Qualified Individual: What the Role Actually Involves (https://trnsfrm.tech/blog-covers/cmmc.jpg) By Jeff Dennis (https://www.linkedin.com/in/jefferydennis), Founder & CEO October 24, 2026 # The FTC Safeguards Qualified Individual: What the Role Actually Involves Auto Dealerships (https://trnsfrm.tech/blog?category=Auto+Dealerships)#ftc-safeguards #dealerships #qualified-individual #owner The FTC Safeguards Rule requires every covered financial institution to name one person responsible for its information security program. The rule calls that person the Qualified Individual. The rule's own definitions list an automobile dealership that leases vehicles on a nonoperating basis for longer than 90 days as a financial institution for that leasing business, and dealers that extend or arrange consumer financing are generally treated as covered too. Coverage depends on what your store actually does, not what it calls itself, so confirm it with your counsel before anything else. Many stores named someone when the amended requirements took effect in June 2023, wrote a name down, and moved on. This post is about what the role actually involves, because the rule describes a job, not a title. ## What the rule requires Under 16 CFR 314.4(a) (https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314), the dealership must designate a Qualified Individual responsible for "overseeing and implementing" the information security program and enforcing it. The person can be: - An employee of the dealership - An employee of an affiliate, such as a dealer group's central office - An employee of a service provider, such as an outside IT or security firm The FTC's guidance is clear that the rule does not require a particular degree or title. What matters is that the person has the knowledge and authority to do the work. ## If you outsource it, the responsibility stays with you If you use a service provider or affiliate as your Qualified Individual, the rule adds three conditions. The dealership keeps responsibility for complying with the rule. The dealership must designate a senior member of its own staff to direct and oversee the Qualified Individual. And the service provider or affiliate must maintain its own information security program that protects the dealership. In plain terms: you can hire someone to do the work, but you cannot hire away the accountability. Somebody inside the store, usually the dealer principal, general manager, or controller, needs to be watching. ## What the Qualified Individual actually does The rule does not list the Qualified Individual's duties in one place. They come from the elements of the program the person oversees. Under 314.4, the program must include: - **A written risk assessment** with criteria for evaluating risks and how each will be addressed, reassessed periodically - **Access controls** limiting who can reach customer information to those who need it - **An inventory** of the data, personnel, devices, systems, and facilities involved - **Encryption** of customer information in transit over external networks and at rest, or compensating controls the Qualified Individual reviews and approves - **Multifactor authentication** for any individual accessing any information system, unless the Qualified Individual approves an equivalent control in writing - **Secure disposal** of customer information no later than two years after it was last used to serve the customer, with stated exceptions - **Change management** procedures - **Monitoring and logging** of authorized user activity - **Testing**, either continuous monitoring or annual penetration testing plus vulnerability assessments at least every six months and after material changes - **Training** for staff and qualified security personnel - **Service provider oversight**: selecting capable providers, requiring safeguards by contract, and assessing them periodically - **A written incident response plan** - **Reporting** to the FTC within 30 days of discovering a notification event involving 500 or more consumers Notice how many of those require a judgment call from the Qualified Individual specifically. Approving compensating controls for encryption. Approving MFA alternatives in writing. Deciding what testing approach fits. Those approvals need to be documented with the reasoning, because they are the decisions someone will ask about later. ## The annual report to the owner Section 314.4(i) requires the Qualified Individual to report in writing, at least annually, to the board of directors or equivalent governing body. If there is no board, the report goes to a senior officer responsible for the information security program. The report must cover the overall status of the program and compliance with the rule, plus material matters such as risk assessment results, risk management decisions, service provider arrangements, testing results, security events and how management responded, and recommendations for changes. For a dealership, that usually means the dealer principal reads it. Read it closely. It is the document that tells you whether the program is real. If the report is a page of generic language with no findings, no open items, and no decisions for you to make, the program probably is not working. ## Smaller stores: what changes and what does not Under 314.6, institutions that maintain customer information on fewer than 5,000 consumers are exempt from a few specific requirements: the written risk assessment, the continuous monitoring or testing schedule, the written incident response plan, and the annual report. They still need a Qualified Individual and the other safeguards. Most stores with a working F&I office reach that number faster than owners expect, so count before assuming you are under it. ## Signs your Qualified Individual setup needs attention - The named person left the company or changed roles and nobody updated the designation - Nobody can produce the last written risk assessment - MFA exceptions exist but no one approved them in writing - The DMS, CRM, and credit platforms have never been reviewed as service providers - No one has seen an annual report, or it looks the same every year - The outside provider acting as Qualified Individual has never been asked about its own security program None of these require a crisis to fix. They require someone with time and authority to own the program. ## Picking the right person There is no perfect answer between internal and external. An internal Qualified Individual knows the store, the people, and the systems, but may not have security depth or time. An external one brings experience across many environments but needs a strong internal partner to get anything done. Many dealerships end up with a hybrid: an outside firm in the role, with the controller or GM as the designated senior overseer who meets with them regularly. Whatever you choose, write it down: who the Qualified Individual is, who oversees them if they are external, and when the role was last reviewed. ## How we help TRNSFRM works with Ohio dealerships on FTC Safeguards programs, including serving as or supporting the Qualified Individual. Our FTC Safeguards overview (https://trnsfrm.tech/frameworks/ftc-safeguards) and automotive page (https://trnsfrm.tech/industries/automotive) explain the approach. The FTC's own guide, FTC Safeguards Rule: What Your Business Needs to Know (https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know), is worth reading in full. If you want a quick read on where your program stands, start with the free compliance checklist (https://trnsfrm.tech/compliance-checklist), or book a free 45-minute Compliance Gap Audit (https://trnsfrm.tech/book). ## Keep exploring More from the TRNSFRM team. ### All Blog Posts Browse every cybersecurity and IT article. https://trnsfrm.tech/blog ### Case Studies Real CMMC, NIST, and FTC outcomes. https://trnsfrm.tech/case-studies ### Free Compliance Checklist Score yourself across 47 controls in 10 minutes. https://trnsfrm.tech/compliance-checklist ### Compliance Frameworks CMMC, NIST 800-171, ISO 27001, HIPAA, FTC, ITAR. https://trnsfrm.tech/governance ### Cybersecurity Operations 24/7 MDR, SOC, and threat response. https://trnsfrm.tech/cybersecurity ### IT Resilience Framework Assess, Remediate, Operate, Improve. A continuous lifecycle. https://trnsfrm.tech/it-resilience-framework ### ITAR Compliance Checklist Work through ITAR readiness control by control. https://trnsfrm.tech/frameworks/itar ### MSP Partner Program White-label security and compliance for MSPs. https://trnsfrm.tech/partners/msp ### Choosing a Cybersecurity Firm 2026 buying guide and provider directory. https://trnsfrm.tech/blog/cybersecurity-companies ## More industries we secure Regulated-industry programs built by TRNSFRM. ### Aerospace & Space AS9100, CMMC, ITAR programs for aerospace suppliers. https://trnsfrm.tech/industries/aerospace-space ### Ambulatory Surgery Centers HIPAA-grade IT for ASCs and outpatient surgery. https://trnsfrm.tech/industries/ambulatory-surgery-centers ### Automotive Suppliers TISAX, CMMC, and OEM cyber flow-downs. https://trnsfrm.tech/industries/automotive-suppliers ### Behavioral Health HIPAA + 42 CFR Part 2 for behavioral health providers. https://trnsfrm.tech/industries/behavioral-health ### Defense & DoD Suppliers CMMC 2.0 & NIST 800-171 for the defense industrial base. https://trnsfrm.tech/industries/defense-dod-suppliers ### Dental Practices Real HIPAA compliance for dental groups and DSOs. https://trnsfrm.tech/industries/dental ## Featured cybersecurity insights Deeper reads from the TRNSFRM team. ### Building an Incident Response Plan You'll Actually Use A pragmatic IR playbook, not a shelf binder. https://trnsfrm.tech/blog/building-an-incident-response-plan-you-ll-actually-use ### Cloud Misconfigurations: The #1 Cause of Data Breaches Where teams get cloud wrong — and how to fix it. https://trnsfrm.tech/blog/cloud-misconfigurations-the-1-cause-of-data-breaches ### CMMC 2.0: What Defense Contractors Must Do Now The DIB compliance clock is ticking. https://trnsfrm.tech/blog/cmmc-2-0-compliance-what-defense-contractors-must-do-now ### Deepfake Fraud in the Boardroom: The New CEO Scam Why voice and video attacks now target execs. https://trnsfrm.tech/blog/deepfake-fraud-in-the-boardroom-the-new-ceo-scam ### MFA Bypass Techniques and How to Stop Them Attackers are getting past MFA — here's how. https://trnsfrm.tech/blog/mfa-bypass-techniques-and-how-to-stop-them ### Quantum Computing and the Cryptography Apocalypse Start planning your post-quantum crypto migration. https://trnsfrm.tech/blog/quantum-computing-and-the-cryptography-apocalypse Call Now: +18777776855 ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "name": "TRNSFRM", "legalName": "Bitboyz LLC", "alternateName": [ "TRNSFRM Technology", "Bitboyz", "Bitboyz LLC", "Bitboyz LLC DBA TRNSFRM" ], "url": "https://trnsfrm.tech", "logo": "https://trnsfrm.tech/wp-content/uploads/2021/11/trnsfrm-logo.svg", "image": "https://trnsfrm.tech/og-image.png", "description": "Cybersecurity, compliance, and managed IT services for manufacturers, construction, automotive, and healthcare organizations.", "foundingDate": "2008", "telephone": "+1-877-777-6855", "email": "info@trnsfrm.tech", "founder": { "@type": "Person", "name": "Jeff Dennis", "jobTitle": "Founder & CEO", "url": "https://trnsfrm.tech/", "sameAs": [ "https://www.linkedin.com/in/jefferydennis" ] }, "areaServed": [ { "@type": "Country", "name": "United States" }, { "@type": "City", "name": "Cleveland", "containedInPlace": { "@type": "State", "name": "Ohio" } }, { "@type": "City", "name": "Columbus", "containedInPlace": { "@type": "State", "name": "Ohio" } } ], "address": [ { "@type": "PostalAddress", "streetAddress": "10143 Royalton Rd Suite J", "addressLocality": "North Royalton", "addressRegion": "OH", "postalCode": "44133", "addressCountry": "US" }, { "@type": "PostalAddress", "addressLocality": "Columbus", "addressRegion": "OH", "addressCountry": "US" } ], "contactPoint": { "@type": "ContactPoint", "contactType": "customer service", "telephone": "+1-877-777-6855", "email": "info@trnsfrm.tech", "areaServed": "US", "availableLanguage": "English" }, "knowsAbout": [ "CMMC", "NIST 800-171", "ISO 27001", "HIPAA", "FTC Safeguards", "ITAR", "Managed IT", "vCISO", "vCIO", "Cybersecurity", "Microsoft GCC High" ], "makesOffer": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Cybersecurity", "url": "https://trnsfrm.tech/cybersecurity", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Governance & Compliance", "url": "https://trnsfrm.tech/governance", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed IT", "url": "https://trnsfrm.tech/managed-it", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "vCISO", "url": "https://trnsfrm.tech/vciso", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Integration & Implementation", "url": "https://trnsfrm.tech/services/ai", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Microsoft GCC / GCC High", "url": "https://trnsfrm.tech/services/microsoft-gcc", "provider": { "@type": "Organization", "name": "TRNSFRM" } } } ], "aggregateRating": { "@type": "AggregateRating", "ratingValue": "5.0", "reviewCount": "176", "bestRating": "5", "worstRating": "1" }, "sameAs": [ "https://www.linkedin.com/company/trnsfrmtech", "https://www.linkedin.com/in/jefferydennis", "https://clutch.co/profile/trnsfrm", "https://maps.google.com/?cid=0x8830ed5d3a6900c5:0xe344c24d13357f96", "https://www.goodfirms.co/company/trnsfrm", "https://www.bestitmsps.com/company/trnsfrm/" ] }, { "@context": "https://schema.org", "@type": "WebSite", "name": "TRNSFRM", "url": "https://trnsfrm.tech", "publisher": { "@type": "Organization", "name": "TRNSFRM" }, "potentialAction": { "@type": "SearchAction", "target": "https://trnsfrm.tech/blog?q={search_term_string}", "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "ProfessionalService", "name": "TRNSFRM", "legalName": "Bitboyz LLC", "alternateName": [ "TRNSFRM Technology", "Bitboyz", "Bitboyz LLC", "Bitboyz LLC DBA TRNSFRM" ], "url": "https://trnsfrm.tech", "image": "https://trnsfrm.tech/og-image.png", "telephone": "+1-877-777-6855", "email": "info@trnsfrm.tech", "address": { "@type": "PostalAddress", "streetAddress": "10143 Royalton Rd Suite J", "addressLocality": "North Royalton", "addressRegion": "OH", "postalCode": "44133", "addressCountry": "US" }, "areaServed": [ { "@type": "Country", "name": "United States" }, { "@type": "City", "name": "Cleveland", "containedInPlace": { "@type": "State", "name": "Ohio" } }, { "@type": "City", "name": "Columbus", "containedInPlace": { "@type": "State", "name": "Ohio" } } ], "priceRange": "$$", "sameAs": [ "https://www.linkedin.com/company/trnsfrmtech", "https://www.linkedin.com/in/jefferydennis", "https://clutch.co/profile/trnsfrm", "https://maps.google.com/?cid=0x8830ed5d3a6900c5:0xe344c24d13357f96", "https://www.goodfirms.co/company/trnsfrm", "https://www.bestitmsps.com/company/trnsfrm/" ] }, { "@context": "https://schema.org", "@graph": [ { "@type": "BlogPosting", "headline": "The FTC Safeguards Qualified Individual: What the Role Actually Involves", "description": "The FTC Safeguards Rule requires one person to oversee your information security program. What the Qualified Individual does, who can fill the role, and how dealers should support it.", "author": { "@type": "Person", "name": "Jeff Dennis", "jobTitle": "Founder & CEO", "url": "https://www.linkedin.com/in/jefferydennis", "sameAs": [ "https://www.linkedin.com/in/jefferydennis" ], "worksFor": { "@type": "Organization", "name": "TRNSFRM", "url": "https://trnsfrm.tech" } }, "datePublished": "2026-10-24T14:43:45.749183+00:00", "publisher": { "@type": "Organization", "name": "TRNSFRM", "url": "https://trnsfrm.tech" }, "image": "https://trnsfrm.tech/blog-covers/cmmc.jpg" }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://trnsfrm.tech/" }, { "@type": "ListItem", "position": 2, "name": "Blog", "item": "https://trnsfrm.tech/blog" }, { "@type": "ListItem", "position": 3, "name": "The FTC Safeguards Qualified Individual: What the Role Actually Involves", "item": "https://trnsfrm.tech/blog/ftc-safeguards-qualified-individual-dealerships" } ] } ] } ] ```