Automobile Industry Compliance

Key Points:

• Under the Federal Trade Commission’s Safeguards Rule, auto dealerships must develop, implement, and maintain comprehensive information security programs.
• Staying compliant with changing federal, state, and local requirements can be challenging.
• Sensitive customer data must be protected, and the best solution is often partnering with a third party experienced with automotive dealership security and compliance.

The day-to-day operations in the automotive industry and automotive dealerships differ from most other businesses, but they share the same need for cyber security. Regardless of the type of business or industry, every business needs to ensure the security of its data and take steps to prevent accidental leaks or cyberattacks.

Dealerships rely on relationships, including vendors across the complete supply chain, financial institutions, and marketing agencies. As a result, they handle a wealth of sensitive customer data, such as full names, addresses, driver’s license numbers, social security numbers, and credit card information of sales and service customers.

Dealerships face a greater risk than many businesses due to the extensive network of complementary companies needed for day-to-day operations. Therefore, cyber security is critical for dealerships to protect their assets and to stay in compliance with industry regulations.

Dealership automotive compliance legislation is more strict and complicated than ever. Staying abreast of and ensuring you comply with nearly constantly increasing regulations can be challenging for any organization. However, you can reduce your cyber risk and ensure your dealership remains in compliance.

What Is Automotive Compliance?

Automotive compliance involves adhering to all the laws and regulations about auto dealerships in your area. Rules and regulations govern vehicle buying, selling, financing, advertising, and insurance.

Dealerships are required to report some transactions, and if you fall victim to identity theft and haven’t followed the proper procedures, you could be held liable by law. Customer communications also have numerous regulations, including who you may contact, when and how you can contact them, what can be included in email marketing, and pre-recorded messages.

Automotive dealerships have many regulations to consider, and failing to comply with them can have serious consequences. Therefore, your employees must have training in automotive compliance rules, and you need the proper security in place because, as the dealership owner, you could end up being responsible.

What Actions Should You Take To Ensure Compliance?

The FTC’s Safeguards Rule requires financial institutions, including automotive dealers, to protect customers’ sensitive data by complying with specific security guidelines. These requirements have evolved over the past 20 years, introducing more comprehensive controls and increasing the complexity of dealers’ security compliance processes.

The Safeguards Rule requires your dealership to develop, implement, and maintain a written information security program. The program must include administrative, technical, and physical safeguards to protect customers’ data. Dealerships that fail to comply can face fines for each violation, which can be costly if the issue involves multiple customers’ data.

Sensitive customer data that must be protected includes any nonpublic personal information about any financial institution customer. What must be included in your dealership’s information security program depends on the size and complexity of your dealership, the type of activities you’re involved in, and the type of data and information you collect.

The three main goals of your dealerships information security plan are:

• Ensuring the confidentiality and security of sensitive customer information.
• Protecting your system against threats to the security or integrity of customer data.
• Protecting against unauthorized access to stored data that could substantially harm or inconvenience a customer.

Key Compliance Measures

According to Section 314.4 of the Safeguards Rule, your dealership’s information security program must include nine elements. These elements include:

1) Designate a qualified individual responsible for implementing, supervising, and enforcing your information security program. This Qualified Individual can be an employee, affiliate, or service provider, such as ECW Network & IT Solutions.

2) Base your information security program on a written risk assessment that includes criteria for evaluating risks and threats. The assessment should identify possible internal and external threats to the security, confidentiality, and integrity of sensitive customer data.

3) Design and implement safeguards to control the risks your assessment identified by:

• Periodically reviewing access controls.
• Identify and manage the data, people, devices, systems, and facilities used to achieve your business purposes according to their relative importance to business objectives and your risk strategy.
• Encrypt all customer information held or in transit.
• Adopt secure practices for developing in-house apps.
•  Implement multi-factor authentication for anyone accessing customer data on your system.
• Develop and maintain procedures for securely disposing of customer information and minimizing unnecessary data retention.
• Adopt safeguard procedures for management changes.
• Implement policies, procedures, and controls to maintain a log of authorized users’ activity and detect unauthorized access.

4) Regularly testing and monitoring the effectiveness of your safeguards and continuous monitoring or periodic penetration testing for information systems.

5) Provide staff training so they can enact your information security program.

6) Monitor your service providers.

7) Evaluate and adjust your information security program and keep it current.

8) Establish a written incident response plan to respond and recover from a security event.

9) Requiring your Qualified Individual to report in writing annually to your Board of Directors or governing body. If your dealership doesn’t have a Board or governing body, the report must go to the senior officer responsible for your information security program.

The report should include the following:

• The overall status and compliance with your company’s information security program.
• Specific topics related to the program include risk assessment, risk management, control decisions, and recommendations for changes to the program.

Protect Your Dealership and Customers With ECW Network & IT Solutions

The FTC’s Safeguards Rule isn’t new, but recent amendments include strict requirements for consumer data protection. For example, dealerships must have internal safeguards and identify and assess the risks of vendors and partners who access, process, transfer, or store sensitive consumer data.

Identifying, assessing, and managing these risks can be challenging and costly for organizations. This is especially true for those without formal third-party or vendor risk management programs. However, with new requirements going into effect in December of 2022, now is the perfect time to define and implement formalized vendor risk management programs.

At ECW Network & IT Solutions, we are dealership security and compliance experts. Our experienced professionals will help you implement the safeguards you need to protect your business and assist with your reporting requirements. Contact us today to learn more about how we can help your dealership comply with the latest laws and regulations.