FTC Safeguards Rule Compliancy

Unlike the original Safeguards Rule, you are now required to do considerably more to secure your dealership. This includes:

• Required documentation of IT change management procedures
• Required annual penetration testing
• Required biannual vulnerability scanning
• Required employee training on information security
• Required contracts for vendors containing non-public information (NPI)
• Required risk assessments of vendors containing NPI
• Required written incident response plan
• Required annual written report to the Board of Directors
• Appointment of “qualified individual”
• Requirement to undertake written risk assessments and update policies after each assessment
• Implementation of “access controls”
• Undertake a required data and systems inventory
• Data encryption requirement
• Multi-factor authentication for systems containing NPI
• Systems monitoring and logging
• Development of secure data disposal procedures
• Phishing simulations & security awareness