{"id":81126,"date":"2023-04-21T12:00:00","date_gmt":"2023-04-21T16:00:00","guid":{"rendered":"https:\/\/jumpcloud.com\/?p=81126"},"modified":"2023-05-25T12:48:51","modified_gmt":"2023-05-25T16:48:51","slug":"new-ftc-rules-for-car-dealers","status":"publish","type":"post","link":"https:\/\/jumpcloud.com\/blog\/new-ftc-rules-for-car-dealers","title":{"rendered":"What New FTC Rules for Car Dealers Mean for MSPs"},"content":{"rendered":"\n
There is a looming deadline that MSPs need to be aware of when it comes to their clients in the Car Dealers space. This includes Car Dealerships along with their counterparts in boats, RVs, and motorcycles. The FTC (Federal Trade Commission) has found that car dealers deal with a lot of personal customer data. This makes dealers a highly desirable target for cybercriminals.<\/p>\n\n\n\n
So, on June 9th, 2023, all car dealers in the US will need to comply with new FTC Safeguard Rules<\/a>. <\/p>\n\n\n\n The National Automobile Dealers Association has a great document on the revised safeguard rules<\/a> for their member organizations. These are the key security measures the dealership will be required to secure in order to prove compliance: <\/p>\n\n\n\n The dealer needs to appoint a qualified individual to oversee this process. This designation can be outsourced to an MSP but the dealer will still be required to designate an in-house senior employee to supervise the program.<\/p>\n\n\n\n The risk assessment needs to take into account all potential risks around customer information. It should review and assess if customer information can be accessed by bad players and how that customer information could be misused, altered, or destroyed. Compliance measures must be reviewed and assessed regularly.<\/p>\n\n\n\n This process includes, but is not limited to, the following actions:<\/p>\n\n\n\n As with any cybersecurity program, it\u2019s vitally important that the staff are trained to be aware of any potential risks and understand what to do if they feel that something isn\u2019t right. The MSP should either do this training (if qualified) or recommend a provider\/service to do staff training.<\/p>\n\n\n\n The MSP should carefully select and recommend service providers and ensure that they have rigorous cybersecurity practices in place. <\/p>\n\n\n\n Keep your dealership clients\u2019 security program documentation up to date. It should continue to evolve as time goes on, as staff changes within the dealership, and as the information technology landscape grows and develops.<\/p>\n\n\n\n This is a written disaster avoidance and recovery plan that defines what a security event is and what must happen in case of a security event. The MSP should have a repository of all such forms and plans to be customized for each client. <\/p>\n\n\n\n The dealership\u2019s designated qualified person is responsible for ensuring security initiatives are followed. This person is required to report to the Board of Directors at least annually.<\/p>\n\n\n\n The FTC states, in no uncertain terms, that dealerships must monitor their service providers. That includes you.<\/strong> They may ask you about your upstream activities, if you are fully utilizing MFA, your data encryption policies, and anything else applicable. Hopefully your security plan is already written and discussed with the dealership, but be ready for the questions to come in as the dealership ramps up their cooperation with these new security measures.<\/p>\n\n\n\n Further, and perhaps more importantly, this is a huge<\/em> opportunity for MSPs to speak to car dealers. You are well placed to help them prepare their written incident plans, conduct staff training, and ensure that they are aware of the requirements. <\/p>\n\n\n\n If you are a JumpCloud partner you can help your car dealers right away by enforcing Multi-Factor Authentication (MFA), deploying cross-platform patch management, ensuring all devices are fully encrypted and much more.<\/p>\n\n\n\n If you\u2019re not currently a JumpCloud partner yet, check out JumpCloud for MSPs<\/a> or drop us a line<\/a> and we will help you get started.<\/p>\n","protected":false},"excerpt":{"rendered":" All US car (and boats, RVs, and motorcycles) dealers will need to comply with new FTC Safeguard Rules. Here\u2019s how rules will affect your MSP.<\/p>\n","protected":false},"author":172,"featured_media":81130,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_oasis_is_in_workflow":0,"_oasis_original":0,"_oasis_task_priority":"","inline_featured_image":false,"footnotes":""},"categories":[2782],"tags":[],"collection":[2775],"platform":[],"funnel_stage":[3015],"coauthors":[2736],"acf":[],"yoast_head":"\nWhat Are the New FTC Rules?<\/h2>\n\n\n\n
1. Designate a qualified individual to implement and supervise your information security program. <\/h3>\n\n\n\n
2. Conduct a risk assessment. <\/h3>\n\n\n\n
3. Design and implement safeguards to control the risks identified. <\/h3>\n\n\n\n
\n
4. Train dealership staff. <\/h3>\n\n\n\n
6 Monitor dealership service providers. <\/h3>\n\n\n\n
7. Keep the information security program current. <\/h3>\n\n\n\n
8. Create a written incident response plan. <\/h3>\n\n\n\n
9 Require the Qualified Individual to report to the dealership\u2019s Board of Directors.<\/h3>\n\n\n\n
How Do The New Rules Affect My MSP?<\/h2>\n\n\n\n
How JumpCloud Can Help<\/h2>\n\n\n\n