The FTC Safeguards Rule compliance checklist.
Ten checkpoints, one per requirement of 16 CFR 314.4, plus breach notification. Each item shows what "done" actually looks like at a dealership, so you can tell in a few minutes where you stand. Read it below, or get the one-page printable PDF for your Qualified Individual.
The 10-point checklist
-
1. Designate a Qualified Individual 16 CFR 314.4(a)
Done looks like: One named senior person is accountable for the program, in writing.
-
2. Complete a written risk assessment 16 CFR 314.4(b)
Done looks like: A dated document lists the risks to customer data and how you rated them.
-
3. Implement safeguards and controls 16 CFR 314.4(c)
Done looks like: Access controls, encryption of customer data, and multi-factor authentication are in place.
-
4. Test and monitor your controls 16 CFR 314.4(d)
Done looks like: You run continuous monitoring, or annual penetration testing plus vulnerability assessments at least every six months.
-
5. Train every employee 16 CFR 314.4(e)
Done looks like: All staff who touch customer data have current security-awareness training, with records kept.
-
6. Oversee your service providers 16 CFR 314.4(f)
Done looks like: Your DMS, CRM, and finance vendors are vetted and bound by contract to appropriate safeguards.
-
7. Evaluate and adjust the program 16 CFR 314.4(g)
Done looks like: The program is updated when your systems, risks, or the Rule change.
-
8. Keep a written incident response plan 16 CFR 314.4(h)
Done looks like: A written plan names who does what if customer data is compromised.
-
9. Report to leadership annually 16 CFR 314.4(i)
Done looks like: A written report on the program goes to your board or dealer principal every year.
-
10. Be ready to notify on a breach 16 CFR 314.4(j)
Done looks like: You can report a qualifying event (unauthorized acquisition of unencrypted data of 500+ consumers) to the FTC within 30 days.
If you hesitated on any item, that is a gap. A free gap assessment shows you exactly which of these you meet and which need work, and our plain-English guide to the nine requirements explains the why behind each one.
Get the one-page PDF
A clean, printable copy your Qualified Individual can post in the compliance binder and work through with your team. Enter your email and we will send it over. No obligation.
Check your inbox.
The checklist is on its way. You can also download the PDF now. When you are ready to close the gaps, book your free gap assessment.
Rather have us check it for you?
A free gap assessment turns this checklist into a written report: exactly which requirements your dealership meets, which it does not, and what to do first.