# Auto dealerships

Showroom, service drive, and lot on one network and one camera system, with the FTC Safeguards Rule controls a dealer is now required to have.

## The problems we hear first

- The FTC Safeguards Rule requires a written security program and a named qualified individual, and nobody has been named.
- The DMS vendor, the OEM, and three software vendors each want their own remote access.
- Keys, the lot, and the parts counter are covered by cameras from three different eras.
- Service advisors lose Wi-Fi halfway down the drive and finish the write-up on paper.

## What we typically deploy

- **Safeguards Rule controls.** MFA, encryption, access reviews, monitoring, and the written information security program and risk assessment the rule requires, with evidence kept for the annual report to ownership.
- **Managed detection & vendor access control.** EDR on every workstation, and controlled, logged remote access for the DMS and OEM vendors instead of standing open connections.
- **Lot, showroom & service cameras.** One camera system covering the lot, key storage, the parts counter, and the service drive, with retention set for claims and lot incidents.
- **Dealership wireless & network.** Coverage across the showroom, service bays, and the lot, with customer Wi-Fi separated from the DMS and payment devices.

## Where clients here usually start

Usually a Safeguards Rule gap review first, since the rule already applies. Lead service: [Managed IT & Cybersecurity](https://lnxinc.com/services/managed-it/).

## Common questions

**What does the FTC Safeguards Rule require from a dealership?** A written information security program, a named qualified individual, a risk assessment, MFA, encryption of customer data, access controls, either continuous monitoring or annual penetration tests with vulnerability scans every six months, staff training, vendor oversight, and notice to the FTC within 30 days of a breach affecting 500 or more consumers. We put the technical controls in place and keep the evidence; your compliance lead or counsel owns the program.

**Can a service provider be our qualified individual?** The rule allows it, as long as a senior employee at the dealership oversees the provider and retains responsibility. Most dealers name someone on their own staff, and we do the technical work and keep the evidence that person reports on. Whether we take the role on ourselves is a conversation about your size and agreement tier.

**Can you handle the cameras and the IT together?** Yes. Separate crews, one contract. Cameras, access control, and the network roll into the same managed agreement, so one team owns the lot and the showroom.

Contact: https://lnxinc.com/contact/ or 833-569-5690.