FAQ

Because you have what criminals want—customer financial data. Dealerships collect loan information, credit applications, and IDs, but many still rely on outdated systems or weak passwords. Hackers know that. A single stolen login can give them everything they need.

Yes. If your dealership helps customers with financing or leases, you are considered a financial institution under federal law. The FTC Safeguards Rule applies to every dealership that collects personal financial information, no matter how small.

The FTC can investigate, issue fines, and require proof of compliance. Each violation can reach more than $50,000. Beyond that, a data breach can cause customer lawsuits, insurance issues, and reputational damage that takes years to repair.

Less than a single data breach. Compliance is scalable. With the right MSSP or IT partner, smaller dealerships can implement the required safeguards at a reasonable monthly cost. The investment protects your data, your reputation, and your legal standing. It depends if you use your IT team to help ensure compliance or if you use our Managed IT Services. 

Not necessarily. You must designate a “Qualified Individual,” but that person can be your controller, operations manager, or even a trusted MSSP partner. What matters is that someone is clearly responsible for managing your information security program.

Ask them how they protect your customer data. Every vendor who touches financial information—CRM providers, website companies, DMS vendors—should have documented security policies and certifications. Include data protection requirements in your contracts.

Start with a written risk assessment. You cannot protect what you have not identified. A proper assessment shows where your dealership stores customer information, how it moves, and where it is vulnerable. Once you know that, you can begin closing the gaps.

Phishing. Most data breaches start with an employee clicking a fake email link. The easiest fix is training. When employees know what to look for, they become your first and strongest line of defense.

At least once a year, and after any major system change. Technology, vendors, and threats evolve quickly. Regular testing ensures your protections still work and that leadership can prove ongoing oversight if regulators ever ask.

Because panic does not solve problems. When a cyber event occurs, a written plan tells everyone what to do, who to call, and how to contain it. It keeps your team calm, reduces mistakes, and helps you recover faster.

They provide 24/7 monitoring, advanced security tools, and compliance documentation that most dealerships cannot maintain on their own. An MSSP acts as your technology safety net—watching your systems day and night so you can focus on customers.

contracts, and your annual board report. When everything is written, dated, and stored properly, you can show your compliance at any time.