Department

Dealership technology for IT, security and compliance teams

Dealer IT and security teams need inventory, identity, endpoint, vendor, backup, incident and continuity controls spanning cloud and in-store systems.

Dealer IT security is now a legal duty as well as a good practice. Dealerships that arrange financing are subject to the FTC Safeguards Rule, which requires a written information security program, a named qualified individual, written risk assessments, multi-factor authentication for everyone who reaches customer information, encryption, oversight of service providers and an incident response plan. The 2024 ransomware attack on CDK Global disrupted thousands of dealerships for weeks and showed that a store's exposure includes its vendors, not only its own network.

0 direct answers4 related market mapsSeptember 1, 2026 reviewed

Direct answer

Dealership technology for IT, security and compliance teams

So ask vendors and providers for specific evidence. For managed IT, ask for response and resolution targets in writing, immutable backups with documented restore tests, endpoint detection and response with round-the-clock monitoring, and multi-factor authentication on email, remote access and administrative accounts, with no standing exceptions for executives. For software vendors, ask for security attestations, how quickly they tell you about an incident and what you can still do if the vendor is down, particularly for the DMS.

Related searches: dealership cybersecurity software · dealer IT managed services · FTC safeguards dealership technology

What to check before you decide

Keep your own records: an inventory of systems and data, who has access and why, a list of service providers with their security documents and renewal dates, and the written plan for operating without the DMS. Put the dealership, not the provider, in control of master credentials to the domain, email, backup and cloud accounts. Rehearse the continuity plan once a year by running a day without the DMS.

Keep the evidence file the Safeguards Rule expects you to be able to produce. It holds the written information security program, the latest risk assessment, the list of people with access to customer information, the multi-factor authentication settings, service provider reviews, and the incident response plan with the date it was last rehearsed. Store the file somewhere that does not depend on the DMS.

Rehearse once a year by running a day without the DMS. Decide in advance how deals are written, how repair orders are opened and how customers are told.

Note what broke, who did not know the plan and what took longer than expected. Update the written plan the same week.

Dealer-controlled evaluation