What security questions should dealerships ask software vendors?

Verify controls, not slogans

Request current, appropriately scoped evidence and note exceptions. A certification or report can be useful, but it does not prove every product, integration or operational process is covered.

Map dealership exposure

Identify personal, financial, credit, employee and vehicle data; privileged integrations; administrative users; remote access; endpoints; and business processes that depend on availability.

Prepare for disruption

Document notification, escalation, restoration priorities, alternate workflows, backups, recovery testing and evidence the dealer will receive after an incident.

What good evidence looks like

Useful evidence is current, names the product and scope, and can be read by someone other than the vendor. A recent independent assessment report with its scope statement and any exceptions tells you far more than a badge on a website.

Ask for the date, what was and was not covered, and whether the service you are buying was in scope. If a report covers a parent company but not your product, treat the control as unverified.

Questions about your own exposure

Before sending a questionnaire, list what the vendor would hold or reach: customer identities, credit or financial data, employee records, vehicle and deal data, and any privileged connection into your other systems. The more of these the vendor touches, the more detailed the review should be. A scheduling widget and a system with direct access to your DMS should not receive the same questionnaire.

Common mistakes in vendor security review

Reviewing only at purchase is the main gap; access, staff and subprocessors change over the contract term, so schedule a recheck at renewal. Another is accepting yes-or-no answers without evidence.

A third is forgetting the offboarding side: confirm how access is revoked, how data is deleted and how the dealer receives proof. Finally, record who at the dealership owns each vendor relationship so that a question about an incident has a named recipient.

Sample questions to include

Do you enforce multi-factor authentication for staff and customers? How is data encrypted in transit and at rest?

How do you log and review access to customer data? What is your process for patching known vulnerabilities?

How quickly will you notify us of an incident? Which subprocessors handle our data?

Tailor the list to the data involved.

Keeping the answers useful

Store responses in a vendor file with the date and reviewer. Note follow-up items and deadlines.

Repeat the review at renewal and when the vendor announces a significant change. Over time the file shows whether the vendor's answers are improving, staying the same or drifting, which supports decisions about continuing the relationship.