Auto dealer IT
IT for the showroom, the F&I office and the service lane.
A dealership that arranges financing is treated as a financial institution under federal rules, and its finance office holds some of the most complete personal records in town. This page explains what the rule expects and where a dealership’s network usually leaks.
Sample data · “Your Business”
Quick answer
Does the FTC Safeguards Rule apply to car dealers?
Yes, for most. The FTC says dealers who finance or help arrange financing for consumers are financial institutions under the Safeguards Rule, as are dealers who lease vehicles for longer than 90 days. They must maintain a written information security program that protects customer information such as credit applications.
The rule, in plain words
What a dealer is expected to have.
- A Qualified Individual who oversees the program. This can be an employee or someone at a service provider, and the dealership stays responsible.
- A written risk assessment of where customer information lives and what threatens it.
- Access controls, including multi-factor sign-in or something reasonably equivalent, so only people who need customer information can reach it.
- Encryption of customer information, both stored and in transit.
- Secure disposal of customer information once there is no business need to keep it.
- Training for staff, and testing and monitoring of the safeguards.
- Oversight of service providers: choose capable ones, put safeguards in the contract and review them periodically.
- A written incident response plan, and written reports to ownership at least annually.
- Notice to the FTC when unencrypted information of at least 500 consumers is acquired without authorization, as soon as possible and no later than 30 days after discovery.
Source: the FTC’s Safeguards Rule guidance and its frequently asked questions for automobile dealers. The rule relieves businesses holding information on fewer than 5,000 consumers of certain provisions. Ask your attorney or your dealer association what applies to your store.
Where dealerships leak
Five places to look this week.
Showroom guest Wi-Fi
Customers in the lounge should be on a network that cannot see anything else: not the desks, not the printers, not the DMS. Guest and business traffic belong on separate network segments, with a firewall between them.
DMS access
The dealer management system holds deals, credit applications and service history. Every user needs their own login with a second sign-in step, rights matched to the job, and removal the day they leave. Shared logins at a sales desk defeat all of it.
Vendor remote access
DMS, CRM, phone and equipment vendors often have a standing way into the network. List every one. Allow access for a specific job, require multi-factor sign-in, and turn it off afterward.
The finance office
Credit applications, driver’s licenses and insurance cards. Lock screens when stepping away, scan straight into the deal file instead of to email, shred paper copies on a schedule and wipe copier drives before a lease return.
Service-lane devices
Tablets, kiosks and diagnostic computers move around and get handed to customers. Manage them centrally, keep them updated, limit what each can reach and be able to lock a lost one remotely.
Email in the sales department
Fake lender notices and changed payoff or wire instructions arrive by email. Verify any payment change by calling a number you already had.
Questions for any provider
Ask these before you sign.
- 01
Can you show me my network on one page?
A simple diagram of what is connected to what, including the guest network and every vendor connection. If nobody can draw it, nobody is managing it.
- 02
Who can get in from outside, and how?
A list of remote access paths, who uses each and whether a second sign-in step is required.
- 03
What happens when a salesperson quits?
A written offboarding checklist covering the DMS, email, lender portals and the CRM, with a record of when each was closed.
- 04
Has a restore been tested?
A date and a result, not a promise.
What it costs
One plan, in writing.
Managed IT is $175 per user, per month with a 5-user minimum. Hardware and larger network projects are quoted separately before work starts.
The same single plan every client gets. Microsoft 365 licenses billed separately at Microsoft’s price.
- Unlimited remote help desk (phone & email)
- 24/7 monitoring and alerting
- Patch management
- Microsoft 365 administration and support
- Multi-factor sign-in setup
- Backup monitoring and management
- Advanced security monitoring
- Network & firewall management
- Security awareness training
- Onboarding and same-day offboarding
- Quarterly on-site visits
- Vendor management
Priced in writing before any work starts.
- IT and security assessment with plain-English findings
- Help drafting a written information security program
- Written risk assessment and incident response plan
- Network redesign and guest Wi-Fi separation projects
- vCIO strategy sessions
This page is general information, not legal advice. We put security controls in place and document them; we do not certify anyone or make an organization compliant. Ask your attorney or your regulator what applies to you.
Questions
Dealership IT questions, plainly answered.
We are a small independent lot. Does the rule still apply?
The FTC says dealers who finance or facilitate financing for consumers are financial institutions under the rule, and it draws no line between franchise and independent stores. Businesses holding information on fewer than 5,000 consumers are relieved of certain provisions. Ask your attorney which apply to you.
What counts as customer information at a dealership?
The FTC’s dealer guidance points to records with nonpublic personal information about a customer, such as financing or lease applications and lists of customers who financed or leased. Treat anything from the finance office as covered.
Is our DMS vendor responsible for security?
For their own systems, yes. The dealership is still responsible for who has logins, how they sign in, the network the DMS is reached from and overseeing the vendor.
How much does IT cost for a dealership?
$175 per user, per month with a 5-user minimum, covering the help desk, 24/7 monitoring, security, Microsoft 365 administration, backups and quarterly on-site visits. Microsoft 365 licenses are billed separately at Microsoft’s price.
Do you support Saturdays?
Support requests are handled Monday to Friday, 8am to 6pm Central. Managed IT also includes 24/7 monitoring and after-hours emergency support for problems that cannot wait.
Does working with you make the dealership compliant?
No provider can promise that. We put safeguards in place, help document them and tell you plainly what is still open. The responsibility under the rule stays with the dealership.
Contact
Request an IT assessment.
A hands-on review of your computers, network, security and backups, quoted up front, with findings in plain English.