Auto Dealerships

What keeps you up at night

• The FTC Safeguards Rule’s written program, testing and annual board report
• DMS vendors and lenders asking for proof of security
• Multiple rooftops on different networks and different standards
• Staff turnover and shared logins

What we do for organizations like yours

• A qualified individual and written information security program
• Annual penetration testing and ongoing vulnerability scanning (Vonahi vPenTest and VulScan)
• Multifactor authentication, encryption and access reviews
• Security awareness training for sales, F&I and service staff
• The annual report to your board or owner, with evidence in Compliance Scorecard
• Fully managed IT across every rooftop

Rules you have to meet

The FTC Safeguards Rule (16 CFR Part 314) requires a written program, a qualified individual, risk assessment, access controls, encryption, multifactor authentication, testing, training, vendor oversight, an incident response plan and an annual written report.

Penetration Testing ›  ·  Compliance ›  ·  Awareness Training ›

Our response commitments

Priority	Example	Guaranteed response	Target response
! Critical	Server down or the whole office cannot work	1 hour	15 minutes
! High	A department or key system is impaired	2 hours	1 hour
! Medium	One user cannot work normally	4 hours	2 hours
! Low	Minor issue with a workaround	8 hours	4 hours
! Scheduled	New user setup, new computer install, proactive maintenance	Scheduled	Scheduled

Response times apply during client support hours, Monday to Friday, 7 a.m. to 5 p.m. Central. Critical issues outside those hours are covered under your agreement.

Frequently asked questions

Does the FTC Safeguards Rule apply to car dealerships?

Yes. Dealerships that arrange financing or leasing for customers are financial institutions under the Gramm-Leach-Bliley Act, so the FTC Safeguards Rule applies.

Does the Safeguards Rule require penetration testing?

Yes. Unless you run continuous monitoring, the rule requires annual penetration testing and vulnerability assessments at least every six months.

What is a qualified individual?

The person responsible for overseeing your information security program. It can be an employee or a service provider such as Pinnacle.

Do we need to report to the board?

Yes. The qualified individual must report in writing at least annually to the board or senior officer.