Dealership software vendor security review

What to check before you decide

Ask for documents. A recent independent security report such as a SOC 2 audit, a summary of penetration testing, the information security policy, the incident response plan and a list of subprocessors are typical.

Check the dates, the scope and any exceptions noted. A report that covers a different product does not help.

Check the controls that matter most: multi-factor authentication for all users and administrators, encryption of data in transit and at rest, role-based access, logging, backup and recovery, and how the vendor handles vulnerabilities.

Dealerships that arrange financing are subject to the FTC Safeguards Rule, which requires oversight of service providers. Keep the review in your records. Ask how fast the vendor will notify you of an incident, what it will tell you and who in the store receives the notice.

Think about continuity. The 2024 attack on CDK Global showed that a vendor outage can stop a store. Ask what the vendor does if its own provider fails, what you can still do, and how recovery is tested.

Record the result with a date, the reviewer and any conditions, and schedule the next review at renewal or after a major change.

Repeat a lighter version of the review each year and after any incident reported by the vendor or the news, noting changes in ownership, hosting, subprocessors and certifications, because the vendor you reviewed two years ago may not be the vendor you depend on today, and the Safeguards Rule expects ongoing oversight.

Put the review date and the reviewer's name on the file, and keep the vendor's documents with it. If an incident happens later, the record shows what you checked and when, which matters to a regulator, an insurer and your own board.