Dealership technology preparation for Safeguards Rule oversight

What to check before you decide

Then check the required items. You need a written information security program and a named qualified individual who oversees it.

You need a written risk assessment for your actual sites and systems. You need multi-factor authentication for anyone reaching customer information, including employees and vendors.

You need encryption of customer data, access limited to those who need it, and an incident response plan.

Review your service providers. Keep a list with each vendor's security documents, what data it holds and how it will notify you of an incident.

Put security obligations in contracts at renewal. A provider's failure is your exposure.

Handle retention. Customer information must be disposed of securely no later than two years after it was last used, unless there is a documented reason to keep it. Decide the periods for deal jackets, scanned IDs and old CRM records, and record each disposal.

Finally, rehearse and document. Test the response plan with a realistic scenario.

Keep the evidence in one file: the program, the assessment, access lists, settings, provider reviews and test results. Review it every year and after any major change.

Run a short internal review twice a year. Check that access lists match the current staff, that departed employees and vendors have lost access, that multi-factor authentication is on, and that the incident plan names current phone numbers. Record the date and the result in the evidence file.

Remember that the rule covers paper as well as screens, so walk the building and look at the deal jackets in the back office, the credit applications on printers, the scanned IDs on shared drives and the old laptops in a closet, and decide what to secure, move or destroy.