Cybersecurity lead
Auto dealerships
Showroom, service drive, and lot on one network and one camera system, with the FTC Safeguards Rule controls a dealer is now required to have.
What usually comes up
The problems we hear first.
- The FTC Safeguards Rule requires a written security program and a named qualified individual, and nobody has been named.
- The DMS vendor, the OEM, and three software vendors each want their own remote access.
- Keys, the lot, and the parts counter are covered by cameras from three different eras.
- Service advisors lose Wi-Fi halfway down the drive and finish the write-up on paper.
What we typically deploy
A stack that fits the building.
We describe capabilities rather than name the specific products in client environments. Happy to walk through the detail under NDA.
Safeguards Rule controls
MFA, encryption, access reviews, monitoring, and the written information security program and risk assessment the rule requires, with evidence kept for the annual report to ownership.
Managed detection & vendor access control
EDR on every workstation, and controlled, logged remote access for the DMS and OEM vendors instead of standing open connections.
Lot, showroom & service cameras
One camera system covering the lot, key storage, the parts counter, and the service drive, with retention set for claims and lot incidents.
Dealership wireless & network
Coverage across the showroom, service bays, and the lot, with customer Wi-Fi separated from the DMS and payment devices.
Where clients here usually start
Usually a Safeguards Rule gap review first, since the rule already applies.
What does the FTC Safeguards Rule require from a dealership?
A written information security program, a named qualified individual, a risk assessment, MFA, encryption of customer data, access controls, either continuous monitoring or annual penetration tests with vulnerability scans every six months, staff training, vendor oversight, and notice to the FTC within 30 days of a breach affecting 500 or more consumers. We put the technical controls in place and keep the evidence; your compliance lead or counsel owns the program.
Can a service provider be our qualified individual?
The rule allows it, as long as a senior employee at the dealership oversees the provider and retains responsibility. Most dealers name someone on their own staff, and we do the technical work and keep the evidence that person reports on. Whether we take the role on ourselves is a conversation about your size and agreement tier.
Can you handle the cameras and the IT together?
Yes. Separate crews, one contract. Cameras, access control, and the network roll into the same managed agreement, so one team owns the lot and the showroom.
Tell us what's in front of you.
A drawing set, a failing switch, an audit deadline, or a hunch that IT costs too much. We'll tell you who picks it up and what it takes.