Car Dealer IT Services

What to check before you buy

Security is the second half. Ask for endpoint detection and response with round-the-clock monitoring, not signature-based antivirus.

Ask for multi-factor authentication on email, remote access and every administrative account, with no permanent exceptions for executives. Ask for help with the Safeguards Rule items a dealer must keep: a written risk assessment, an incident response plan and oversight of service providers.

Find out how a new employee and a departing one are added and removed. Find out who in the store is told first about an incident.

Also settle who holds the keys. The dealership, not the provider, should hold the master credentials for its domain registration, DNS, email tenant, firewall and cloud backup accounts.

A provider that holds them alone makes leaving very hard. Ask for the provider's own security attestation.

Check how quickly it will tell you of an incident on its side. Ask for a monthly report showing patch status, backup test results and open tickets by age.

Check that the scope covers every rooftop, plus phones and cameras, not only computers.

Questions to put to every car dealer IT services vendor

• What is the initial and renewal term?
• What are implementation and offboarding fees?
• What data, hardware or OEM dependencies apply?

Other categories dealers compare alongside Dealer IT & managed services: Fraud & cybersecurity, and GPS & payment-assurance tracking.