Is your dealership ready for the FTC Safeguards Rule?

Smaller institutions don’t need a written risk assessment, a fixed testing schedule, a written incident response plan or an annual written report (16 CFR 314.6). Everything else still applies.

1. Have you named a Qualified Individual to run your information security program?

   Staff, someone at an affiliate or a service provider. 314.4(a)

   Not required when you hold information on fewer than 5,000 consumers.

   YesPartlyNoNot sure

2. Do you have a written risk assessment of where customer information could be exposed?

   It sets criteria for rating risks and checks your safeguards against them. 314.4(b)

   Not required when you hold information on fewer than 5,000 consumers.

   YesPartlyNoNot sure

3. Do staff get security awareness training that’s kept up to date?

   Plus qualified people running security, your own or a provider’s. 314.4(e)

   Not required when you hold information on fewer than 5,000 consumers.

   YesPartlyNoNot sure

4. Do you check that service providers can protect customer information, require it in their contracts and review them periodically?

   Not required when you hold information on fewer than 5,000 consumers.

   YesPartlyNoNot sure

1. Is access to customer information limited to the people who need it, and reviewed periodically?

   Not required when you hold information on fewer than 5,000 consumers.

   YesPartlyNoNot sure

2. Do you keep an inventory of your data, systems, devices and the people who use them?

   Not required when you hold information on fewer than 5,000 consumers.

   YesPartlyNoNot sure

3. Is customer information encrypted when it’s stored and when it travels over outside networks?

   Or protected by other controls your Qualified Individual has reviewed and approved. 314.4(c)(3)

   Not required when you hold information on fewer than 5,000 consumers.

   YesPartlyNoNot sure

4. Do you use secure practices for software built for you, and check the security of outside apps you use?

   Not required when you hold information on fewer than 5,000 consumers.

   YesPartlyNoNot sure

5. Does everyone who logs in to a system with customer information use multi-factor authentication?

   Unless your Qualified Individual approves equivalent controls in writing. 314.4(c)(5)

   Not required when you hold information on fewer than 5,000 consumers.

   YesPartlyNoNot sure

6. Do you securely dispose of customer information within two years of when it was last used?

   Unless you need it for business or legal reasons, or it can’t practically be removed. 314.4(c)(6)

   Not required when you hold information on fewer than 5,000 consumers.

   YesPartlyNoNot sure

7. Do you follow change management procedures for your systems and networks?

   Not required when you hold information on fewer than 5,000 consumers.

   YesPartlyNoNot sure

8. Do you monitor and log what authorized users do, so unauthorized access gets noticed?

   Not required when you hold information on fewer than 5,000 consumers.

   YesPartlyNoNot sure

1. Do you run continuous monitoring, or a penetration test every year and vulnerability assessments at least every six months?

   Not required when you hold information on fewer than 5,000 consumers.

   YesPartlyNoNot sure

2. Do you have a written incident response plan?

   Goals, roles, communications, fixes, records and a review after each incident. 314.4(h)

   Not required when you hold information on fewer than 5,000 consumers.

   YesPartlyNoNot sure

3. Does your Qualified Individual report to your board or a senior officer in writing at least once a year?

   Not required when you hold information on fewer than 5,000 consumers.

   YesPartlyNoNot sure

4. Do you know how to notify the FTC within 30 days of discovering a security event that affects 500 or more consumers?

   Required for every covered dealer, whatever its size, since May 13, 2024. 314.4(j)

   Not required when you hold information on fewer than 5,000 consumers.

   YesPartlyNoNot sure