What the Safeguards Rule actually asks a car dealership for

It usually arrives from a lender. Somewhere in a packet there is a page asking whether your store has a written information security program and who is responsible for it, and by Tuesday afternoon that page is on the desk under two deal jackets.

The short answer: if your store arranges financing or leasing, the Federal Trade Commission counts it as a financial institution. The Safeguards Rule then wants one written program, one named person, a short list of controls, and a report once a year — and most of the controls you are already running.

Customer information means what is in the deal jacket

Not the vehicle — the person. The credit application, the copy of the license, the pay stubs somebody brought in on a Saturday, the last four digits of an account. If you took it in order to get somebody financed, the rule is talking about it.

Paper counts too. A jacket in the cabinet behind the desk holds the same information as the file on the drive, and the rule treats them the same way. The same goes for what the service drive collects at write-up, and for what sits in the mailbox of whoever handles the finance work.

Most of it is already running

More than owners expect. Everybody signs in under their own name, because the desk has to know who pulled which credit report. The file room locks. Old jackets get shredded rather than thrown out, and somebody sits your people down once a year and talks about the message that looks almost right.

So the gap is rarely the security itself. It is the writing down, and then four specific things that turn up in nearly every store we walk into:

• The document itself: one program that describes what your store actually does today, kept current, with a name on the front of it.
• A second step at sign-in on the lender portals and the deal system — not only on email, which is where most stores stopped.
• Encrypting what is stored, not just what is sent. The back-office drive and the copy of it are usually the ones nobody reached.
• A written plan for the morning something goes wrong, and one written report a year to whoever governs the store.

The document is the part people get wrong, usually by buying one. Buy it off a website and you have described somebody else’s store, when what the rule asks for is an accurate account of what you run today. Twelve honest pages beat sixty borrowed ones.

We find the second step missing more often than anything else on that list. Somebody turned it on for email in the year everybody did, and nobody went back for the lender portals — where you keep the credit applications.

You are probably fine on what leaves the building; somebody else usually handles that part for you. What sits still is the other half — the drive in the back office, and the copy of it that goes off site every night. Ask whoever set those up which of the two is covered, and ask in writing.

The report is one page a year, from the named person to whoever governs the store — an owner, a dealer principal, a board if there is one. Almost nobody writes it. A store holding information on fewer than five thousand customers is excused from four requirements, this one among them; count everybody you have ever financed, though, not last year’s.

The first three moves

First, name the person, on paper, with a date beside it. It does not have to be somebody technical — in most stores it is the general manager, working alongside whoever looks after the systems. Second, sit down with everybody who signs in to a lender portal and turn the second step on for all of them.

Third, write down every place customer information lives: the drive, the cabinet behind the desk, the tablet on the service drive, the copy that goes off site. That page is the start of the program. Most stores are further along than the owner fears, and a review is ninety minutes on site — the written report is yours either way.