Auto Dealer CyberSecure
Starter Kit$149
Professional$249
FTC Safeguards Rule guide
FTC Safeguards Rule written information security program template for auto dealers
If your dealership arranges financing or leasing, the FTC treats you as a financial institution. Here is what the Safeguards Rule asks for in plain English, and an editable WISP that maps to each requirement.
- Plain English
- Editable Word & Excel
- Free self-assessment
Updated October 18, 2026 · Get the free self-assessment
The requirement
What the FTC Safeguards Rule requires, in plain English
The Safeguards Rule (16 CFR Part 314) says a covered business must have a written information security program that protects customer information. For a dealership, that is the credit applications, Social Security numbers, driver's license images, bank details and deal jackets that flow through your DMS, CRM and F&I menu.
The program must name a Qualified Individual to run it and rest on a written risk assessment. It has to include specific safeguards: access controls, an inventory of your data and systems, encryption in transit and at rest, multi-factor authentication, secure disposal, change management and activity logging. You also have to train staff, oversee service providers by contract, and keep the program up to date.
Unless you continuously monitor your systems, the rule calls for an annual penetration test and vulnerability scans at least every six months. The Qualified Individual must report to the owner or board in writing at least once a year, and you need a written incident response plan.
Since May 13, 2024, you must also notify the FTC within 30 days of discovering a breach of unencrypted information involving 500 or more consumers.
Requirement by requirement
Where each requirement is covered in the Auto Dealer CyberSecure kit
Every document is editable Word or Excel. Items marked Pro are in the Professional Edition only.
| Requirement | What it means for you | Kit documents |
|---|---|---|
| Qualified Individual (314.4(a)) | One named person oversees the program, even if it's your IT provider. |
|
| Written risk assessment (314.4(b)) | Find where customer data lives and what could go wrong, in writing. |
|
| Access controls and MFA (314.4(c)) | Least privilege and multi-factor login for anyone reaching customer data. |
|
| Encryption and secure disposal (314.4(c)) | Encrypt data in transit and at rest; dispose of it within the rule's limits. |
|
| Testing and monitoring (314.4(d)) | Annual pen test and scans every six months, or continuous monitoring. |
|
| Staff training (314.4(e)) | Security awareness training for everyone who touches deals. |
|
| Service provider oversight (314.4(f)) | Vet your DMS, CRM and lender portals and bind them by contract. |
|
| Incident response plan (314.4(h)) | A written plan for what you do when something goes wrong. |
|
| Annual report to owner or board (314.4(i)) | The Qualified Individual reports in writing at least yearly. |
|
| FTC breach notice (314.4(j)) | Notify the FTC within 30 days for events involving 500+ consumers. |
|
See a sample page
What the Written Information Security Program (WISP) looks like
Plain-language templates with bracketed fields for your details, policy IDs that stay the same when you upgrade, and a footer reminding you to customize before use.
- Download right after checkout
- Edit in Microsoft Word, Google Docs or any word processor
- One-time price: Starter $149 · Professional $249
What's inside
Every file in each edition
Policy numbers carry over from the Starter Kit to the Professional Edition, so you can start small and upgrade without renumbering.
Starter Kit
$14924 editable files
Policies 15
- AD-CYB-001Information Security Program & Qualified Individual Policy
- AD-CYB-002Risk Assessment & Customer Information Inventory Policy
- AD-CYB-003Access Control & Least Privilege Policy
- AD-CYB-004Multi-Factor Authentication Password Policy
- AD-CYB-005Encryption & Secure Information Exchange Policy
- AD-CYB-006Acceptable Use & Workstation Security Policy
- AD-CYB-007Email Security, Phishing & Impersonation Policy
- AD-CYB-008Personnel Security & Confidentiality Policy
- AD-CYB-009Security Awareness & Training Policy
- AD-CYB-010Physical Security & Clean Desk Policy
- AD-CYB-011Backup, Recovery & Business Continuity Policy
- AD-CYB-012Records Retention & Secure Disposal Policy
- AD-CYB-013Service Provider Oversight Policy
- AD-CYB-014Incident Response & Notification Policy
- AD-CYB-015Remote Work & Mobile Device Policy
Plans, guides & assessments 8
- WordImplementation Guide
- WordStaff Cybersecurity Quick Guide
- WordIncident Response Plan
- WordWritten Information Security Program (WISP)
- WordCustomer Information & Payment Security Notice
- Word30-60-90 Day Action Plan
- Word50-Point Cybersecurity Checklist
- WordCybersecurity Maturity Assessment
Workbook 1
- ExcelAuto Dealer CyberSecure Toolkit
Professional Edition
$24942 editable files
Policies 21
- AD-CYB-001Information Security Program & Qualified Individual Policy
- AD-CYB-002Risk Assessment & Customer Information Inventory Policy
- AD-CYB-003Access Control & Least Privilege Policy
- AD-CYB-004Multi-Factor Authentication Password Policy
- AD-CYB-005Encryption & Secure Information Exchange Policy
- AD-CYB-006Acceptable Use & Workstation Security Policy
- AD-CYB-007Email Security, Phishing & Impersonation Policy
- AD-CYB-008Personnel Security & Confidentiality Policy
- AD-CYB-009Security Awareness & Training Policy
- AD-CYB-010Physical Security & Clean Desk Policy
- AD-CYB-011Backup, Recovery & Business Continuity Policy
- AD-CYB-012Records Retention & Secure Disposal Policy
- AD-CYB-013Service Provider Oversight Policy
- AD-CYB-014Incident Response & Notification Policy
- AD-CYB-015Remote Work & Mobile Device Policy
- AD-CYB-016Identity Theft Red Flags Program Policy
- AD-CYB-017Funding, Payoff & Payment Change Verification Policy
- AD-CYB-018Vulnerability Management & Security Testing Policy
- AD-CYB-019Generative AI, OEM & Third-Party Data Connections Policy
- AD-CYB-020Privacy Notice & Information Sharing Policy
- AD-CYB-021AI Governance Policy
Plans, guides & assessments 10
- WordProfessional Edition Implementation Guide
- WordIncident Response Plan & Playbooks
- WordTabletop Exercise Kit
- Word30-60-90 Day Action Plan
- WordStaff Cybersecurity Quick Guide
- WordWritten Information Security Program (WISP)
- WordCustomer Information & Payment Security Notice
- Word50-Point Cybersecurity Checklist
- WordCybersecurity Maturity Assessment
- Word50-Question Auto Dealer Cybersecurity Self-Assessment
Forms & templates 10
- FORM-01Payoff, Funding & Payment Change Verification Form
- FORM-02Access Request Form
- FORM-03Staff Offboarding Checklist
- FORM-04Software, SaaS & AI Tool Request Form
- FORM-05Security Exception Request
- FORM-06Incident Intake Form
- FORM-07Service Provider Security Questionnaire
- FORM-08Confidentiality Policy Acknowledgment Form
- FORM-09Breach Notification Worksheet
- FORM-10Qualified Individual Annual Report
Workbook 1
- ExcelAuto Dealer CyberSecure Professional Toolkit
Questions
Frequently asked questions
Does the FTC Safeguards Rule apply to car dealers?
If your dealership arranges financing or leasing for customers, the FTC treats it as a financial institution under the rule. Confirm your situation with counsel or your compliance advisor.
What if we have fewer than 5,000 customer records?
Four requirements drop away under 16 CFR 314.6: the written risk assessment criteria, the pen-test and scan schedule, the written incident response plan and the annual written report. You still need a written program, a Qualified Individual and the core safeguards.
Can our IT company be the Qualified Individual?
Yes. The rule lets a service provider or affiliate serve, but the dealership keeps responsibility and must name a senior staff member to direct and oversee that person.
When do we have to tell the FTC about a breach?
As soon as possible and no later than 30 days after discovering an unauthorized acquisition of unencrypted information involving at least 500 consumers.
Is this template legal advice?
No. It is an editable template and plain-English education. Have your attorney review documents that carry legal obligations.
Free download
Free Auto Dealer cybersecurity self-assessment
Answer 50 yes / no / not sure questions across 10 areas. Score your results and get clear next steps for your industry.
- Small Business, Law Office, Real Estate, Healthcare, Accounting & Tax, Insurance Agency, Financial Advisor, Auto Dealer, Mortgage & Title, and Cyber Insurance Readiness editions
- Starred priority questions and a scoring table
- Printable PDF
Your assessment is ready
Thanks. Your download should start automatically. If it doesn't, use the button below.
Download the PDFQuestions about your results? Email info@cybriva.ai.
Ready to put it in writing?
Get the Auto Dealer CyberSecure kit
Start with the Starter Kit or get every policy, form and workbook in the Professional Edition. Policy numbers carry over if you upgrade.
See the full Auto Dealer CyberSecure pageSources
- 16 CFR Part 314, FTC Standards for Safeguarding Customer Information (eCFR)
- FTC Safeguards Rule notification amendment, 88 Fed. Reg. (Nov. 13, 2023)
This guide is plain-English education, current as of October 18, 2026. It is not legal advice, an audit or a compliance determination, and Cybriva is not affiliated with any regulator or standards body named here. Rules change and vary by state; confirm how they apply to you with your attorney or compliance advisor.