Your F&I office handles Social Security numbers and credit applications every day. If your dealership arranges financing or leasing, the FTC treats that information as covered by the Safeguards Rule, and your store as a financial institution under it. And when your DMS goes down, deals stop and the service drive backs up.
Security & compliance gaps: plus the IT issues that create them
Not ready? Try the 10-min score · 14-Day IT Health Check
The rule asks for a real, written program, not a binder on a shelf. Here's what it requires and how we help:
Someone has to run and supervise your security program. It can be an employee or an outside provider like us. If it's us, the rule still requires you to name a senior person at the dealership to oversee that work, and we report to them in writing at least once a year.
Your program has to be written down and fit your size and the data you hold. It starts with a written risk assessment and a current list of where customer information lives: DMS, CRM, F&I systems, shared drives, paper.
Anyone accessing customer information on your systems needs multi-factor authentication. We roll it out across email, the DMS and remote access.
Customer information has to be encrypted on your systems and in transit, unless your Qualified Individual approves an effective alternative.
You're responsible for picking service providers that can protect your data, putting security expectations in the contract, and checking on them over time. We help you keep that review on a schedule.
You need a written plan for what happens when something goes wrong: who decides, who calls whom, how you fix it. A notification event, meaning unauthorized acquisition of unencrypted information about 500 or more consumers, must be reported to the FTC as soon as possible and no later than 30 days after discovery.
We support single stores and multi-rooftop groups from Cleveland and Columbus.
Full compliance programs (risk assessment, policies, controls, and ongoing monitoring) built for auto dealers.
PII and PCI safeguards for DMS, CRM, F&I, and customer-facing systems.
24/7 monitoring, help desk, and infrastructure management across all rooftops.
Multi-site network security with segmentation, firewalls, and intrusion detection.
Documentation, evidence packages, and audit readiness programs for FTC and state regulators.
Dealership-specific phishing simulations and security training for all staff.
Every control we test ties back to a specific clause of 16 CFR Part 314. You get a defensible, audit-ready picture of where your dealership stands, and exactly what to fix first.
§ 314.4(j) Breach notification: a notification event involving 500 or more consumers must be reported to the FTC within 30 days of discovery.
Reference: 16 CFR Part 314: Standards for Safeguarding Customer Information. This assessment is provided as a readiness tool and is not a substitute for legal advice from your dealership's counsel.
Book a free consultation. We'll assess your current IT and security posture and show you a clear path forward.
Financial services compliance
Cybersecurity framework
Real client outcomes across industries.
Help desk, infrastructure, and monitoring.
Score your readiness in 10 minutes.
2026 buying guide for regulated industries.