What it does
Cybersecurity and IT providers run and protect the dealership's technology. Services include managed IT and help desk, network and endpoint security, 24/7 monitoring, backups, email security, staff training and incident response.
Dealers hold sensitive customer financial data, which makes them targets. The 2024 attack that took a major DMS provider offline for weeks showed how much a store depends on its vendors and how important it is to have a plan for operating without them. Ransomware and email fraud against dealers continue.
The FTC Safeguards Rule requires dealers that arrange financing to keep a written information security program, name a qualified person in charge, use multi-factor authentication and encryption, test systems, oversee vendors and report to the board. Breaches involving 500 or more consumers must be reported to the FTC within 30 days. A good provider helps with all of this and gives you records to prove it.
Who in the store uses it
- Dealer principals and CFOs: own the security program and risk.
- IT managers or the qualified individual: run day-to-day security.
- Controllers: handle vendor oversight and insurance.
- All staff: complete training and follow policies.
What it connects to
- DMS, CRM and every system that holds customer data
- Phone systems and networks at every store
- Email and productivity tools
- Cyber insurance carriers
- Regulatory compliance tools
- Backup and recovery systems
Cybersecurity and IT products in the index
See all 11
What to ask vendors
- What do you monitor, and who responds at 2 a.m.?
- How do you help us meet each part of the Safeguards Rule?
- What reports do we get for the board and auditors?
- How do you test backups and recovery?
- What is our plan if a key vendor such as the DMS goes down?
- How do you train staff on email fraud?
- Do you meet our cyber insurer's requirements?
- What are the cost and contract term per device or user?
Signs it's time to switch
- You can't show a written security program or recent risk assessment.
- Multi-factor authentication isn't on every system.
- Backups have never been tested.
- Nobody knows what to do if the DMS goes offline.
- Your insurer is raising rates or asking questions you can't answer.
Related categories
Something out of date? Suggest an edit and an editor reviews it within 48 hours.