You could face severe penalties if your auto dealership doesn’t comply with the revised FTC rule by June 9th, 2023. So here is a checklist of what you need to knock off your list:
1. Appoint a Qualified Individual to implement and oversee your information security program. Select someone with real-world experience and well-suited to manage your specific environment.
2. Conduct a security risk assessment. Administer an assessment of foreseeable risks and threats, including internal/external factors that could compromise customer confidentiality. Think through all the ways unauthorized access could occur.
3. Implement security safeguards. Design company security measures that identify and control the risks found during your risk assessments, vulnerability scans, and penetration testing. Your safeguards should include the following:
-
- Create access controls to administer who can access your customer’s information.
- Inventory where and how data is gathered, transmitted, and stored.
- Encrypt data at rest and in transit.
- Custom applications should be evaluated for how customer information is stored, accessed, or transmitted.
- Require Multi-Factor Authentication (MFA) to access company applications or customer data.
- Properly dispose of personal information within two years of serving a customer, unless doing so conflicts with state or federal laws.
- Anticipate and manage change to your environment, systems, equipment, technology, and personnel.
- Log user activity and monitor both authorized and unauthorized access.
For more information on the safeguards auto dealers must implement to comply with the revised rule, please visit our latest article FTC Safeguards: What This Means for Auto Dealerships.
4. Enforce continuous monitoring and testing of your systems. Theoretical safeguards are great, but without consistent testing of their effectiveness, your safeguards will inevitably become outdated and ineffective. Ongoing risk assessments are critical and should be complemented with annual vulnerability scans and penetration testing.
5. Provide Security Awareness Training for your entire staff. The security of customer data can be reduced to your weakest link, so make sure to provide your team with ongoing training for your employees, vendors, affiliates, and even service providers to ensure everyone associated with the business is equipped to spot cybersecurity risks and threats.
6. Monitor your third-party partners. While it should be assumed that all vendors or service providers are up-to-date on the appropriate safeguards, it just isn’t the case. Make sure your agreements are clear about your industry’s security standards and once you push forward with their services, make sure they continue to share their ongoing security credentialing.
7. Revisit your information security program. To ensure your security plan is relevant within the ever-changing cybersecurity landscape, your team needs to understand how changes to your processes, network, systems, technology, equipment, and applications will affect your compliance.
8. A written incident response plan is critical. Nobody can predict the future, but we can plan for it. Businesses need a set of thoughtful response and recovery protocols for when they have a security event. Your plan should cover the following:
-
- The objectives and goals of your plan
- The internal processes that were initiated in response to a security issue
- Detailed roles, responsibilities, and who has authority to make decisions
- Communication guidelines for how you share information internally as well as with the public
- Comprehensive next steps in repairing identified weaknesses in your systems and processes
- A process for documenting and reporting both the security event itself as well as your organization’s associated response activities
- After an incident, a detailed synopsis of what happened and a summary of how your company has updated its information security program and incident response plan from what occurred
9. Restructure your org chart so that your Qualified Individual reports directly to your Board of Directors. In addition, your Qualified Individual must provide at least one compliance report per year to your organization’s board of directors or senior officer responsible for your information security program.
https://meriplex.com/wp-content/uploads/2023/09/IT-Services-Indianapolis.png
1125
2000
Greg Allen
/wp-content/uploads/2021/10/Meriplex-Logo-Full-Color.png
Greg Allen2023-09-13 08:31:002023-09-07 21:03:11The Importance of Reliable IT Services for Indianapolis Businesses
