Auto Dealership IT Guide: FTC Safeguards Rule and DMS

Dealership IT has two jobs that set it apart from ordinary small-business IT. The first is meeting the FTC Safeguards Rule, which the FTC says applies to most dealers that finance or lease vehicles and which requires specific controls such as multi-factor authentication and encryption. The second is staying able to sell and service cars when the dealer management system is unavailable, as thousands of dealers learned in June 2024. This guide covers both, plus network separation, a checklist, and questions for any IT provider.

The systems a dealership runs

Area	Examples	IT question to settle
Dealer management system (DMS), the core platform for deals, inventory, repair orders, parts, and accounting	CDK Global, Reynolds and Reynolds, Dealertrack, Tekion	What does the vendor require of your network, and what is your plan if it is down for days?
Finance and insurance (F&I)	Credit application and lender portals, credit bureau access, e-contracting	Who has logins, is multi-factor authentication on, and are they removed at departure?
CRM and business development	Lead management, phones, texting tools	Are logins individual, and what customer data is stored?
Service department	Advisor desks, technician tablets, manufacturer diagnostic laptops and tools, shop equipment	Are these on their own network segment, and who updates them?
Office	Email (Microsoft 365 or Google Workspace), accounting, HR, scanned deal documents	Where are deal jackets stored, and are they encrypted and backed up?
Facilities	Cameras, door access, customer lounge Wi-Fi, payment terminals	Is guest Wi-Fi fully separate from business systems?

Does the FTC Safeguards Rule apply to your dealership?

Probably. The FTC’s Safeguards Rule FAQ for automobile dealers, published in June 2025, explains that a dealer is a “financial institution” under the Gramm-Leach-Bliley Act if it finances or facilitates financing of vehicles for consumers, or leases vehicles for longer than 90 days. That describes most franchised dealers and many independent lots that arrange loans through outside lenders.

The rule protects “customer information”: nonpublic personal information obtained in connection with a finance or lease transaction, such as a credit application with a Social Security number and income. The FAQ notes that a name and address alone, with nothing indicating a financing relationship, is not customer information, and neither are ordinary service records for a vehicle.

This section is IT guidance, not legal advice. Your attorney or compliance vendor should confirm how the rule applies to your store.

What the rule requires, in IT terms

The FTC’s main guide, FTC Safeguards Rule: What Your Business Needs to Know, lists the elements of the required written information security program. Translated:

Requirement	What it means at a dealership
Designate a Qualified Individual	One named person oversees the program. The dealer FAQ says this can be an employee, someone at an affiliate, or a service provider, but responsibility stays with the dealership
Written risk assessment	A documented look at where customer information lives and what could go wrong
Access controls	Each person sees only what their job needs. Access is reviewed and removed at departure
Data and system inventory	A list of systems, devices, and vendors that hold customer information
Encryption	Customer information encrypted at rest and in transit, or an approved compensating control
Multi-factor authentication (MFA)	Required for any individual accessing your information systems. MFA means a second proof of identity beyond the password
Secure disposal	Customer information disposed of on a schedule once there is no business need
Change management and activity logging	Changes to systems are evaluated, and user activity is logged so unauthorized access can be detected
Testing	Continuous monitoring, or annual penetration testing plus vulnerability assessments at least every six months
Staff training	Security awareness training for everyone
Service provider oversight	Choose capable providers, put safeguards in the contract, and reassess them periodically
Written incident response plan	Who does what when something goes wrong
Annual written report	The Qualified Individual reports to the board or senior leadership

Breach reporting. The dealer FAQ explains that you must notify the FTC within 30 days of discovering a security event involving the unencrypted information of at least 500 consumers. Information counts as unencrypted if the encryption key was also accessed.

The small-dealer exemption is partial. Under 16 CFR 314.6, a financial institution that maintains customer information on fewer than 5,000 consumers is exempt from four items: the written risk assessment, the continuous monitoring or penetration testing requirement, the written incident response plan, and the annual written report. Everything else, including MFA, encryption, access controls, and the Qualified Individual, still applies.

Our broader post on the FTC Safeguards Rule and small-business IT covers the rule for other industries, and the vulnerability scanning guide explains the testing requirement.

What the June 2024 CDK outage showed

On June 19, 2024, CDK Global, which provides software to thousands of auto dealers in the US and Canada, was hit by back-to-back cyberattacks and shut its systems down. The Associated Press reported that dealers reverted to pen and paper, and that large public dealer groups said they had moved to alternative processes to keep selling cars.

Anderson Economic Group, a Michigan consulting firm, estimated total direct losses to franchised dealers at $1.02 billion for the three weeks from June 19 through July 5, 2024. Its estimate includes lost earnings on roughly 56,200 new vehicle sales, used vehicle and parts and service earnings, extra staffing and IT costs, and added floor plan interest. It excludes consumer harm, reputational damage, and litigation costs. It is one firm’s estimate, not an audited figure.

The lesson for an individual store is not about any one vendor. A cloud DMS can become unavailable for reasons outside your control, so the store needs a way to keep operating.

A DMS downtime plan

1. Paper kits. Keep current blank buyer’s orders, credit applications, repair orders, and parts tickets in a known location, and decide who may use them.
2. A secure place for paper. Completed paper credit applications are customer information. Lock them up and define how they are entered and shredded afterward.
3. Contact lists outside the DMS. Lender, vendor, manufacturer, insurer, and key staff contacts in a form you can reach when systems are down.
4. Know what else depends on the DMS. List every tool that integrates with it (CRM, scheduling, parts ordering, payroll) and whether it works alone.
5. Schedule exports. Where your DMS allows it, export inventory, open repair orders, and receivables on a schedule and store them securely.
6. Rehearse once a year. A one-hour tabletop exercise with managers is enough to find the gaps.
7. Be ready to disconnect. During a vendor incident, the vendor may tell you to disconnect its always-on links to your network. Someone should know where those are.

The IT disaster recovery guide and the incident response plan guide provide templates you can adapt.

How should service bay, office, and customer Wi-Fi be separated?

Segmentation means dividing one physical network into separate zones with firewall rules between them, so a problem in one zone cannot spread to another.

Zone	What belongs there	Rule of thumb
F&I and accounting	Finance office computers, accounting, deal document storage	The most restricted zone. Reachable from other zones only where a specific need exists
Sales floor and office	Sales desks, managers, business development	Can reach the DMS, CRM, and printers
Service and parts	Advisor desks, technician tablets, diagnostic laptops, shop equipment	Own zone. Diagnostic tools often need specific manufacturer sites, so allow those and little else
Facilities	Cameras, door controllers, TVs, vehicle chargers	No access to business zones
Payment terminals	Card readers	Isolated, following your payment processor’s guidance
Customer lounge Wi-Fi	Guest devices	Internet only, with guest devices isolated from one another

DMS vendors publish their own network requirements, so involve the vendor before changing firewall rules. The network segmentation guide explains how this is built with VLANs and a business-grade firewall.

Risks specific to dealerships

• Phished F&I logins. Lender portals and credit bureau access are reached through a browser, so a stolen password is enough unless MFA is on everywhere it is offered.
• Staff turnover. Sales staff change often. Logins for the DMS, CRM, lender portals, and email should be removed the same day.
• Deal jackets as loose files. Scanned deals on an unencrypted shared drive or a copier’s hard drive are customer information.
• Diagnostic laptops that miss updates because they are treated as shop tools, not computers.
• Email fraud aimed at the accounting office: fake payoff instructions, vendor bank changes, and wire requests that appear to come from the dealer principal.

Checklist you can copy

1. A Qualified Individual is named in writing.
2. A system and vendor inventory exists and notes where customer information lives.
3. MFA is on for email, the DMS, the CRM, lender and credit bureau portals, and remote access.
4. Every laptop and any server or storage holding deal documents is encrypted.
5. Access is reviewed at least quarterly, and departures are handled the same day.
6. F&I, service, facilities, payment, and guest networks are separated.
7. Computers, diagnostic laptops, firewalls, and cameras receive updates on a schedule.
8. Vulnerability scans and penetration testing are scheduled if you hold information on 5,000 or more consumers.
9. Staff security training is recorded.
10. Vendor contracts include safeguards language, and vendors are reassessed periodically.
11. A written incident response plan and a DMS downtime kit exist and have been rehearsed.
12. Someone knows the FTC’s 500-consumer, 30-day notification rule and who would file.

Questions to ask any IT provider

• Which Safeguards Rule elements will you handle, which stay with us, and how will the evidence be documented?
• Will you serve as, or support, our Qualified Individual, and what does that involve?
• How will you coordinate network changes with our DMS vendor?
• How do you separate F&I, service, and guest networks, and how is that tested?
• Who performs vulnerability scans and penetration tests, and how often?
• What is your role if our DMS vendor has an outage or we have a security event?
• Is scope and price agreed in writing before work starts?

When you do not need all of this

A small independent lot that sells for cash only, arranges no financing, and leases nothing may fall outside the rule, which your attorney can confirm. A covered dealer with information on fewer than 5,000 consumers is exempt from the four documentation and testing items above. In both cases MFA, encryption, backups, and separated guest Wi-Fi remain sensible basics.

Common questions

Does the Safeguards Rule apply to a small used car lot?

If the lot arranges financing for customers through lenders, or leases vehicles for more than 90 days, the FTC’s dealer FAQ treats it as a financial institution covered by the rule. Size affects which elements apply: dealers with information on fewer than 5,000 consumers are exempt from four items, not from the rule as a whole.

Can our IT provider be the Qualified Individual?

Yes. The FTC says the Qualified Individual can be an employee, an affiliate, or a service provider. If it is a provider, the dealership must still designate a senior person to direct and oversee them, and the dealership remains responsible for compliance.

Is cloud DMS data our responsibility or the vendor’s?

Both. The vendor secures and backs up its hosted system. The dealership is responsible for who can log in, the devices and networks used to reach it, the oversight of that vendor under the Safeguards Rule, and anything stored outside the DMS, such as scanned deals and spreadsheets.

How often is penetration testing required?

For dealers holding information on 5,000 or more consumers, the rule requires either continuous monitoring or, in its absence, annual penetration testing plus vulnerability assessments at least every six months and after material changes. Smaller dealers are exempt from this item, though periodic scanning is still a reasonable practice.

How Coastal Growth Co. can help

We can map where customer information lives, put MFA and encryption in place, separate your networks, and help document the technical parts of a Safeguards program alongside your compliance advisor and DMS vendor. Work is on site or remote, with scope and price agreed first. See networks, security and cameras and managed IT, then reach us through the contact page.