What is the FTC Safeguards Rule for dealerships?

Why dealers are in scope

The obligation follows from arranging credit, not from selling vehicles. A store that facilitates financing or leasing is handling customer financial information and is treated accordingly, whether it is franchised or independent.

The vendor-oversight element is the one that touches procurement

The program has to address service providers: selecting them on their ability to safeguard information, requiring safeguards by contract, and monitoring them. That turns security diligence into a purchasing step rather than an IT afterthought, which is why security questions belong in the RFP.

A document is not a program

Written policy that is not implemented, tested and evidenced does not demonstrate compliance. Keep the risk assessment current, keep records of testing, and be able to show what you do.

What to ask a software vendor

Where data is stored and processed, who can access it, what encryption applies in transit and at rest, how access is authenticated, which subprocessors are involved, what the incident-notification commitment is, and what independent assessment exists. Ask for the answers in the contract, not in a sales deck.

What an information security program contains

The written program has named parts: a designated qualified individual, a risk assessment, safeguards chosen from that assessment, testing and monitoring, staff training, oversight of service providers, an incident response plan and periodic reporting to the dealership's leadership. The details should fit the size and complexity of the store. Keep the documents together so an examiner or an insurer can be shown how the program works.

Where software choices affect compliance

Every system that stores or processes customer financial information is part of the program: the DMS, CRM, digital-retailing tools, document storage and any vendor with remote access. When buying, ask the safeguards questions listed above, put security duties in the contract and record the vendor in a register. The dealer remains responsible for the outcome even where a vendor performs the work.

Common mistakes with the Safeguards Rule

Treating it as an IT-only matter leaves procurement and management out. Writing a policy and never testing it is another.

Failing to keep the risk assessment current after adding vendors is a third. Not knowing who the qualified individual is, or whether they have the time and authority for the role, is a frequent gap.

Review the program at least annually and after significant changes, with qualified advice.