Stratum Tech Group · Katy, TX
The written security program the FTC Safeguards Rule asks your dealership to have, filled in for you.
If your lot arranges financing, offers buy here, pay here, or leases for more than 90 days, the FTC treats you as a financial institution under 16 CFR Part 314. Answer about 20 questions about your DMS, F&I process and files. Get your written program, risk assessment, FTC breach notice procedure and a dated gap list as a Word file and a printable page.
One-time price, no subscription. Delivered on screen right after checkout and by email. 14-day refund if it doesn't fit your dealership.
What you get
Written program, 314.4(a) to (j)
Qualified Individual, safeguards (access, inventory, encryption, MFA, disposal, change management, logging), testing, training, vendor oversight and keeping it current, with your DMS, CRM and credit tools named.Written risk assessment
Dealer risks (phished F&I log-ins, shared DMS passwords, open deal jackets, remote access tools, showroom Wi-Fi) rated against what you actually have in place.FTC breach notice procedure
When an event involving 500 or more consumers must go to the FTC (no later than 30 days after discovery), what the notice must say, plus the incident response plan and Texas notice summary.Report, sign-offs and gap list
The annual report template for your board or owner (314.4(i)), staff training sign-off sheet, vendor oversight list, and a gap list with due dates.Small lots: the 5,000-consumer line
Dealers that keep customer information on fewer than 5,000 consumers are exempt from four parts of the Rule (16 CFR 314.6): the written risk assessment, penetration testing and vulnerability scans, the written incident response plan and the annual written report. Everything else still applies, including MFA, encryption, training, vendor oversight and the FTC breach notice. The form asks your count, and your program says exactly which parts are required for you and which are included as good practice.
Price
Dealer WISP Instant
- Full written program mapped to 16 CFR 314.4(a) to (j)
- Risk assessment, incident response plan, FTC notice procedure
- Annual report template, vendor list, training sign-off, gap list
- Word file and printable page, yours to edit
For comparison
What it is not
Not a security audit, not penetration testing, not monitoring, and not legal advice. If you need those, your IT provider or a lawyer can help; the gap list tells you where.How it works
- Answer about 20 questions about your dealership, financing, systems and current safeguards (about 10 minutes).
- Pay $199 through Stripe checkout.
- Your program opens on screen and arrives by email. Download the Word file and fix anything that doesn't match how you work.
- Work through the gap list by its dates, train your staff and have them sign, then the owner and Qualified Individual sign the adoption page.
Questions
Does the Safeguards Rule apply to my dealership?
The FTC's 2025 auto dealer FAQs say dealers who finance, or facilitate financing of, cars for consumers are financial institutions under the Rule, and so are dealers who lease for longer than 90 days (16 CFR 314.2(h)). Arranging a loan counts even if you don't hold the paper. A cash-only lot that never takes credit applications generally is not covered. If you are unsure, ask a lawyer.
Does this make us compliant?
No document can. The Rule requires a written program and also requires you to carry out the safeguards in it. This gives you the written program built around your answers and a dated list of what is still missing.
What happens if a dealer ignores the Rule?
The Rule itself doesn't set a fine. The FTC enforces it through complaints and orders: in 2019 it settled with dealer software provider DealerBuilt over a breach of about 12.5 million consumers' data, under an order requiring a security program and outside assessments every two years. Breaking an FTC order can bring civil penalties of up to $53,088 per violation (16 CFR 1.98). The practical pressure is also lenders, DMS vendors and insurers asking for your program.
Is this legal advice?
No. Stratum Tech Group is an IT company, not a law firm. Have a lawyer review it if you need legal certainty.
Can I edit it?
Yes. The Word file is yours. Review it every year; the program sets your next review date.
What do you do with my answers?
We use them only to build your program. We never ask for customer data and never sell your information. See terms and privacy.