Written Information Security Program

This is a starting written information security program generated from the answers you gave. It is not legal advice, not an audit or assessment of your systems, and it does not by itself make your dealership compliant with the FTC Safeguards Rule or any other law. The Rule requires you to actually carry out the safeguards described here, not only to have them on paper. Read every section, correct anything that does not match how your dealership works, complete the gap list, and have your Qualified Individual and owner adopt it by signing. If you are unsure whether the Rule applies to you, or how a state law applies, ask a qualified attorney.

1. Purpose, scope and why this applies

Example Auto Credit LLC extends in-house (buy here, pay here) credit and arranges financing with outside lenders. Lending, arranging financing and long-term leasing are financial activities, so the dealership is a "financial institution" under the Gramm-Leach-Bliley Act and must keep a written information security program under the FTC Safeguards Rule (16 CFR 314.1(b), 314.2(h); FTC auto dealer FAQs A-3 and B-10).

This program protects customer information: any record, on paper or electronic, containing nonpublic personal information about a customer (16 CFR 314.2(d)). At this dealership that includes:

• Credit applications, whether approved or not, and the documents that support them (pay stubs, proof of residence, bank statements, ID copies).
• Deal jackets, retail installment contracts, lease agreements and payment histories.
• Social Security numbers, dates of birth, driver's license numbers, income and bank account details.
• Credit reports and lender decisions.
• Any list that shows who financed or leased with us (FTC auto dealer FAQ A-4).

Plain name and address lists collected from every buyer, service records and aggregate sales reports are not customer information on their own, but they become covered when combined with financing information. Because the Rule also covers systems connected to systems that hold customer information (16 CFR 314.2(j)), these safeguards apply to the whole dealership network.

The program has administrative, technical and physical safeguards suited to a dealership of 6 staff at 1 location (16 CFR 314.3(a)). It continues to protect customer information for as long as we keep it, even after the loan is paid off or sold (FTC auto dealer FAQ B-10).

Size and the 5,000-consumer line (16 CFR 314.6)

Example Auto Credit LLC maintains customer information concerning fewer than 5,000 consumers (estimated 1,800). Under 16 CFR 314.6, four parts of the Rule do not apply at this size: the written form of the risk assessment (314.4(b)(1)), penetration testing and six-monthly vulnerability assessments (314.4(d)(2)), the written incident response plan (314.4(h)) and the Qualified Individual's annual written report (314.4(i)). Every other element still applies, including the risk assessment itself, multi-factor authentication, encryption, training, vendor oversight, and notifying the FTC of a breach affecting 500 or more consumers (314.4(j)). This program still includes short versions of the four exempt parts, marked as good practice.

Recount once a year at the annual review. A dealership that passes 5,000 consumers must start the four parts listed in 16 CFR 314.6.

2. Qualified Individual (16 CFR 314.4(a))

Example Auto Credit LLC designates Jordan Lee (Office Manager) as its Qualified Individual: the person responsible for overseeing, implementing and enforcing this program.

The Qualified Individual:

• Keeps this program current and runs the checks in Section 5.
• Approves in writing any exception to multi-factor authentication or encryption, with the equivalent control used instead.
• Approves new systems and vendors before they get customer information (Section 4, change management).
• Makes sure every staff member is trained and signs Attachment C.
• Leads the response to any security event (Section 9) and the FTC notice decision (Section 10).
• Reports in writing at least once a year to Alex Rivera (Owner), the senior officer responsible for the program (Section 11).

3. Written risk assessment (16 CFR 314.4(b))

Under 16 CFR 314.6, the requirement that the risk assessment be written (314.4(b)(1)) does not apply to a dealership that maintains customer information concerning fewer than 5,000 consumers. Example Auto Credit LLC includes it anyway as good practice and will treat it as required if it reaches that number.

This is Example Auto Credit LLC's risk assessment. It identifies reasonably foreseeable internal and external risks to the security, confidentiality and integrity of customer information that could lead to unauthorized disclosure, misuse, alteration, destruction or other compromise, and assesses whether current safeguards control them (314.4(b)).

Criteria for rating risks (314.4(b)(1)(i))

Each risk is rated for likelihood (how often it happens to dealerships like ours) and impact (harm to customers and the dealership if it happens), each Low, Medium or High. The overall rating is the higher of the two.

Criteria for confidentiality, integrity and availability (314.4(b)(1)(ii))

For each system in Attachment A we ask: could someone see customer information who should not (confidentiality); could records be changed or deleted without us knowing (integrity); and could we lose access to deals, contracts or payment records (availability). Existing controls are judged adequate only if they work today, not if they are planned.

How risks are mitigated or accepted (314.4(b)(1)(iii))

High risks are fixed within 30 days, Medium within 90 days. The Qualified Individual may accept a Low risk in writing with the reason. The fixes are tracked in the gap list (Attachment D) and the safeguards in Sections 4 to 7.

Risks, current controls and decisions

Reassessment (314.4(b)(2))

The Qualified Individual re-does this risk assessment at least once a year and after any security event, a new DMS or major vendor, a new location, or a big change in how deals are financed.

Sample skips Sections 4 to 9 here: safeguards 314.4(c)(1)-(8), testing, training, vendor oversight, keeping it current and the incident response plan, all written around the dealer's own systems.

10. FTC breach notice procedure (16 CFR 314.4(j))

This applies to every covered dealership, whatever its size. The 314.6 exception does not cover it.

What counts as a notification event

A notification event is the acquisition of unencrypted customer information without the authorization of the person it is about (16 CFR 314.2(m)). Encrypted information counts as unencrypted if the encryption key was also accessed. Unauthorized access is presumed to be acquisition unless we have reliable evidence that it did not, or could not reasonably have, happened.

Steps and deadline

• Day 0 is the first day anyone at the dealership (an employee, officer or agent, other than the person who caused it) knows of the event. That is the date of discovery (314.4(j)(2)).
• Within 1 day: the Qualified Individual starts the Section 9 plan and opens the event log.
• Within 7 days: decide whether it is a notification event and count the consumers affected or potentially affected. Count every consumer, not only current customers.
• If it involves the information of at least 500 consumers: notify the FTC as soon as possible, and no later than 30 days after discovery (314.4(j)(1)), using the FTC's online form: ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act/safeguards-rule-form. If facts are still missing, file what is known and update the report later.
• Example: an event discovered on November 9, 2026 must be reported to the FTC by December 9, 2026.
• The FTC may make reports public. If a law enforcement official has given a written determination that public notice would impede a criminal investigation or damage national security, say so on the form and give the FTC a way to contact that official. The official may ask for an initial delay of up to 30 days, extendable by up to 60 more days in writing.

What the FTC notice must include (314.4(j)(1)(i)-(vi))

Other notices to consider at the same time

• Texas: the Texas Attorney General through its online form within 30 days of determining a breach that affects at least 250 Texas residents, and the affected people without unreasonable delay and within 60 days (Tex. Bus. & Com. Code 521.053). Check the current statute at the time.
• Residents of other states: their own state's breach law may apply.
• Lenders and finance sources whose applications or contracts were involved, as your agreements with them require.
• Your cyber insurance carrier before hiring outside help, if you have a policy; many require it.
• The FBI at ic3.gov for cyber crime, and local police for theft.

Attachment D: Gap list and schedule

These items come from your answers. The program only protects customers when the safeguards are actually in place, so finish each item and write the date.

The full program also includes the annual report template (Section 11), adoption page, data inventory, vendor oversight list, staff training sign-off sheet and the 314.4 element map.

Starting program from Stratum Tech Group. Review and adopt it before use. Not legal advice, not an audit, and not by itself compliance.