Your dealership runs fast every day. Customer data moves through emails, credit applications, and service systems from morning to night. One unexpected click or cyber incident can bring that all to a halt.
When something goes wrong, time matters. A written plan gives your team control when the unexpected happens.
The FTC Safeguards Rule requires every dealership to have a written Incident Response Plan that explains how to handle a data breach or cybersecurity event. The goal is to help you act quickly, contain the problem, and recover with confidence.
What It Means
A written incident response plan is your dealership’s playbook for what to do when data or systems are compromised. It tells your team exactly how to respond and who is responsible for each step.
Your plan should include:
- Defined Roles and Responsibilities: Assign who leads the response, who contacts vendors, who handles communication, and who documents actions.
- Containment Procedures: Clear instructions on how to stop the incident from spreading, such as disconnecting devices or disabling accounts.
- Communication Steps: Who to notify inside the dealership, which vendors to contact, and when to alert legal counsel, insurance, or the FTC.
- Investigation Guidelines: How to record what happened, what systems were affected, and what customer data might be involved.
- Recovery and Prevention: What to do once systems are restored and how to prevent similar problems in the future.
Your plan should be written, easy to access, and reviewed regularly by your Qualified Individual. Every person listed in the plan should know their role and how to find it when needed.
Why It Matters
When a cyber event happens, panic is natural. Employees may be unsure who to tell or what to do. That delay can make the problem worse.
A written plan prevents confusion. It gives your dealership a clear process to follow so that everyone acts fast, communicates clearly, and meets legal obligations.
The FTC expects every dealership to be able to show that it can respond to incidents in an organized, documented way. Having a written plan proves that you are prepared.
It also protects your reputation. Customers, lenders, and manufacturers trust dealerships that respond with professionalism and honesty. A clear, coordinated plan shows that your business takes their information seriously.
A good plan also supports your insurance coverage. Most cyber insurance providers require a written incident response plan before they will approve or renew a policy.
Example from a Dealership
A phishing email reached the finance department at a dealership. An employee clicked a link that installed malicious software on several computers.
Because the dealership had a written incident response plan, the team knew what to do. They disconnected affected devices, called their IT partner, and began documenting what happened. The Qualified Individual filled out the incident log and confirmed that no customer data had been accessed.
The entire situation was resolved within hours, and the dealership included the documentation in its annual compliance report. The FTC’s expectations were met, and customer trust remained strong.
How to Create a Strong Incident Response Plan
You do not need a long or technical document. The best plans are clear, short, and easy to follow.
Here are the key steps to create one that fits your dealership:
- Identify Your Response Team: Decide who leads and who supports each task. Include after-hours contact information for leadership, IT, and insurance.
- Outline Each Step: Create a checklist that starts with detecting an incident and ends with completing documentation.
- List Key Contacts: Include your IT provider, insurance carrier, attorney, and FTC reporting instructions.
- Write Notification Templates: Prepare a short message for customers or partners in case you ever need to alert them.
- Document and Test: Keep records of every incident or test and make sure the plan is reviewed and updated at least once a year.
Testing the plan once a year helps ensure that everyone understands their role and can respond quickly if something actually happens.
Keep an Offline Copy of Your Plan
If a cyberattack locks down your network, you may not be able to access your incident response plan. That is why it is critical to keep at least one offline copy that can be reached when systems are unavailable.
What to store offline
- A printed copy of your full incident response plan.
- A one-page checklist that lists the first steps to take when a breach is discovered.
- A contact list for your Qualified Individual, IT partner, legal counsel, insurance, and key vendors.
- Copies of your most recent risk assessment and important compliance records.
- A short message template for notifying customers or regulators.
Where to keep offline copies
- One printed copy in a locked safe or cabinet at the dealership.
- A second copy at an offsite location, such as a secure storage box or office.
- Optionally, a third encrypted copy on a USB drive stored with your legal counsel or MSSP.
How to protect offline copies
- Limit who has access. Only your Qualified Individual, a senior manager, and one backup person should have the key or password.
- Label each copy with a date so it is clear which version is current.
- When you update the plan, replace the offline copy immediately and destroy the old version securely.
How to test your offline process
At least once a year, simulate an incident and practice retrieving the offline copy. Confirm that the contact numbers, roles, and instructions are all current. Testing makes sure the plan works in a real situation, not just on paper.
Example
A dealership’s network was locked by ransomware, and all files became inaccessible. The Qualified Individual retrieved the printed binder from the safe, used the contact list to reach the IT partner, and followed the step-by-step response checklist.
Because the dealership kept that offline copy, they were able to respond immediately while the IT team worked to recover systems. That quick action prevented data loss and helped prove compliance.
Why Many Dealerships Miss This Step
Many dealerships assume their IT company will “handle it” if something happens. While IT support is essential, the FTC expects dealerships to maintain ownership of their response process.
The dealership—not the vendor—is responsible for demonstrating compliance. The Qualified Individual should ensure that the plan, including offline copies, is up to date and that employees know their roles.
Having a plan on your network is not enough. The FTC and cyber insurance providers both recommend maintaining an offline version so that you are never locked out of your own procedures during an emergency.
The Bottom Line
An incident response plan turns chaos into clarity. It prevents confusion, protects customers, and shows regulators that your dealership is organized and accountable.
A written plan is more than a compliance requirement—it is your playbook for getting back to normal quickly and limiting damage when an incident occurs.
If your dealership needs help creating or reviewing your plan, Safer Dealer can connect you with cybersecurity and compliance experts who understand dealership operations and FTC requirements.
Preparation gives you control. A written, tested, and accessible plan—kept both online and offline—ensures that your dealership is ready for anything.