Draft an Incident Response Plan

SEE ALL EPISODES

Security Event

What do you do in the aftermath of a “security event” – anything that results in unauthorized access to or misuse of an IT system and its contents? The answer to that question must be set forth in a written Incident Response Plan, and it must be accomplished before the security event occurs.

Your Incident Response Plan

Your Incident Response Plan should address the following:

• First, when a breach is detected, take whatever steps are necessary to stop the breach and any potential data loss.

• Second, notify appropriate law enforcement and – this is important – your dealership’s attorney. Many states have mandatory consumer notification requirements with time frames for such notification. You can’t afford to get this wrong, so call your lawyer.

• Third, remediate the weaknesses and fix the vulnerabilities that allowed the security event to occur in the first place. Once that’s accomplished, run a full internal penetration test and a complete vulnerability assessment.

• And fourth, notify all affected parties in a timely manner of what happened, what data was compromised, and what you’re doing about it.

NADA has produced an Incident Response Plan template in its Dealer Guide to the FTC Safeguards Rule – it’s an excellent place to start.

Oversee Service Providers

SEE ALL EPISODES

Retaining Service Providers

The Safeguards Rule requires you to oversee your service providers. There are four subparts to this requirement. First, you must take reasonable steps to select – and only retain - service providers that are capable of adequately protecting customer data. There are software-based programs that can manage this task. This will require the cooperation of your service providers. If they won’t cooperate, you must find service providers that will.

Written Contract

Second, you must obligate your service providers by written contract to implement the safeguards necessary to protect customer data. This obligation can be baked into the contract itself, be added as an addendum to an existing contract, or be a free-standing Safeguards Agreement, but it must be in writing.

Periodically Assess

Third, you must “periodically assess” your service providers with respect to this obligation. The same software used to vet service providers can support this effort as well.

Monitor

Fourth, you must monitor your service providers on an ongoing basis to verify they are maintaining adequate safeguards. This does not mean “continuous” oversight, but it must be regular. This last obligation is potentially overwhelming. Fortunately, the software we’ve been referencing probably satisfies both the “assessing” and “monitoring” requirements, and accomplish those tasks inexpensively.

A Blueprint for Safeguards Compliance

Originally published in F&I and Showroom Magazine on August 11, 2022.

"Let’s examine the trades necessary to build a Safeguards Rule compliance program."

"I look at Safeguards Rule compliance from a particular perspective. Let me explain. Boniface Bernhardt Günther was born in 1866 in Baden-Baden, Grand Duchy of Baden (the German states wouldn’t coalesce into a single country until 1872). He studied the building trades in Bern, Switzerland, returning to his hometown in 1888, where he became subject to conscription into the army of the nascent German Empire..."

Read More