Why dealership Safeguards programs break down, and how to close the gaps

In short: Most Safeguards failures are not about technology. They are about a program that was written once and never run. Here are the six gaps we see most, each with the fix and the evidence an examiner would ask for.

The Safeguards Rule has been fully mandatory for dealers since June 9, 2023, and most dealers that finance or arrange financing are financial institutions under it. Three years in, the stores that struggle share the same handful of gaps. None of them is exotic.

Gap 1: The Qualified Individual is a name on a form

The rule requires one person accountable for the program. In many stores it is the GM or the controller, appointed in 2023 and given nothing else: no task calendar, no backup, no time. The fix: write the appointment down, give the role a monthly checklist (risk review, training status, vendor renewals, incident plan check) and name a backup. The evidence: the appointment letter, the calendar and the completed checklists.

Gap 2: The risk assessment was done once

The rule calls for a written risk assessment that is reassessed periodically. A 2023 assessment that still lists a DMS you replaced in 2025 is a finding. The fix: reassess annually and after any system change, and keep the versions. The evidence: dated versions showing what changed and why.

Gap 3: Shared logins on the sales floor

Access controls are a named requirement. Five sales managers on one DMS login means no one knows who saw what, and no MFA can be enforced. The fix: one login per person, access by role, MFA on every system that touches customer information, and a quarterly access review. The evidence: the user list by system, the review dates and the MFA settings.

Gap 4: Training that happened last year

Security awareness training must reach all staff and stay current. Sales consultant turnover ran 66 percent in 2024 according to the NADA Dealership Workforce Study, so last year's session does not cover this year's floor. The fix: assign training at hire, by role, and log every completion with a time stamp. The evidence: the log, by person, with dates.

Gap 5: Vendors with no contract language

The rule requires you to choose service providers that can protect customer information, to require safeguards by contract, and to reassess them. Most stores have the vendors and not the register. The fix: list every vendor that touches customer data, confirm each contract has security language, and set a review date. A vendor incident, like the one dealers worked through in October 2026, is the moment that register gets read. The evidence: the register, the contract clauses and the review dates.

Gap 6: Evidence lives everywhere

Training certificates in email, vendor contracts in a cabinet, the risk assessment on one laptop, the incident plan nobody can find. When a lender, insurer or examiner asks for the program, the answer is a week of phone calls. Since May 13, 2024, a breach involving 500 or more consumers' unencrypted information must be reported to the FTC within 30 days, and the report is posted publicly, so the incident plan has to be findable on the worst day. The fix: one file, kept current as a byproduct of running the program. A good standard: produce the whole file within 48 hours of being asked. The evidence: the file itself.

A gap check you can run this week

For each of the six, ask one question: if an examiner asked tomorrow, could I hand over dated proof? Every "no" is a gap with an owner, a cost and a fix. The Safeguards checklist walks through all ten requirements, and the free gap assessment scores your store against them from your own answers, with the findings in writing whether or not you ever become a customer.

This explainer is general information, not legal advice. Talk to your counsel about how the rule applies to your store.

Sources: FTC, Standards for Safeguarding Customer Information, 16 CFR Part 314; FTC, "FTC Safeguards Rule: What Your Business Needs to Know"; NADA Dealership Workforce Study 2024.

About the author

Written by the DealSafe team. DealSafe is the dealer compliance program founded by Dallas Tyrrell and run on the founder's own rooftops at Tyrrell Auto Centers, Wyoming's oldest dealership group. Questions and corrections: support@dealsafe.com.

See also

FTC Safeguards Rule program for dealers · FTC Safeguards Rule Checklist for Auto Dealers · Enforcement Watch · All guides and news