FTC SAFEGUARDS CHECKLIST
Twelve items, mapped to 16 CFR 314.4, in the order an examiner or an auditor works through them. Most dealership checklists stop at the network: MFA, encryption at rest, a written program. This one keeps going and follows the customer document out of the store, because that is where the rule says "in transit" and where most dealerships cannot show what happened.
The FTC Safeguards Rule, 16 CFR Part 314, treats a dealership that extends credit or arranges financing as a financial institution. The amended rule has applied in full since June 9, 2023, and the breach notification requirement since May 13, 2024. The FTC publishes its own Safeguards Rule FAQ for automobile dealers, and that page is the authority; read it first. This checklist does not compete with it. It turns the rule's elements into twelve things you can check on a Tuesday afternoon, and it spends more time than any other dealer checklist on the one element that names the path a document takes.
A note on scope: the rule covers customer information, which in a store means the credit application, the driver's license image, the pay stub, the signed contract, the deal jacket, and the lender package, in every form they take, including the photo on a salesperson's phone and the attachment in a lender's inbox.
1. Qualified individual, 314.4(a). One named person owns the information security program. Can be an employee, an affiliate, or a service provider; if it is a provider, the dealership still owns compliance and must oversee them. What an examiner asks for: the name, and the date they were designated.
2. Written risk assessment, 314.4(b). Written, with criteria for evaluating risks and how the program addresses them, and periodically reassessed. What an examiner asks for: the document, its date, and whether the document flow in Block 3 appears in it. In most stores it does not.
3. Inventory of data and systems, 314.4(c)(2). Where customer information is collected, stored, and transmitted, and which systems hold it. The DMS and the CRM make the list. The copier that scans deal jackets to email, the phones that photograph licenses, and the lenders' inboxes usually do not, and all three transmit customer information. What an examiner asks for: the inventory, with the transmit column filled in.
4. Access controls, 314.4(c)(1). Only authorized users see customer information, and only what they need. Applies to the DMS, the F&I platform, shared drives, and to any document once it has left the store. What an examiner asks for: the access review, and who can open a credit application after it was sent.
5. Multi-factor authentication, 314.4(c)(5). Required for any individual accessing any information system that holds customer information. If you run a customer portal for deal documents, the customer is one of those individuals. What an examiner asks for: which systems enforce MFA, and the exceptions the qualified individual approved.
6. Encryption at rest, 314.4(c)(3). Customer information encrypted where it sits: DMS, file servers, laptops, backups. What an examiner asks for: the configuration evidence per system.
8. Secure disposal, 314.4(c)(6). Dispose of customer information no later than two years after its last use for the customer relationship, unless retention is required or disposal is infeasible. A deal jacket that was emailed to three lenders exists in at least four mailboxes, and the two-year clock runs on each copy you cannot see. What an examiner asks for: the retention schedule, and how it reaches copies outside the DMS.
9. Logging and monitoring, 314.4(c)(8). Log authorized activity and detect unauthorized access or use. For a document, the question is who received it, when, and whether anyone else did. What an examiner asks for: the log entry for a specific document that left the store last week.
7. Encryption in transit, 314.4(c)(3). Listed out of order on purpose, because it is the item this checklist exists for and the next section walks it in full. Customer information must be encrypted in transit over external networks. Standard email is encrypted hop by hop and fails open; a text message or a messaging app stores the image on every device it touches; a portal upload creates a second copy. What an examiner asks for: proof, per document, that it was encrypted from the moment it left the store to the moment the intended recipient opened it.
10. Service providers, 314.4(f). Choose providers capable of maintaining safeguards, require it by contract, and assess them periodically. Every vendor that transmits deal documents is a service provider under the rule: the DMS, the F&I platform, the e-contracting vendor, the lender portal, the copier vendor's scan-to-email relay. What an examiner asks for: the contract language and the last assessment, per provider.
11. Incident response and breach notification, 314.4(h), 314.4(j), 314.5. A written incident response plan, and FTC notification no later than 30 days after discovering a notification event involving unencrypted customer information of 500 or more consumers. Encrypted information, with the key not compromised, is outside the definition. That sentence is why item 7 matters more than any other item on this list: the state of the document in transit decides whether a lost laptop or a compromised lender mailbox is a reportable event. What an examiner asks for: the plan, and the evidence you would use to show a given document was encrypted.
12. Training and the annual report, 314.4(e), 314.4(i). Staff trained on the program, security personnel kept current, and a written report at least annually to the board or a senior officer on the program's status and compliance. What an examiner asks for: the training record and the last report. If the report does not mention how documents leave the store, add a section before the next one.
Dealership checklists written by network vendors stop at the firewall because that is what network vendors can see. The rule does not stop there. Here are the five paths a customer document takes out of a typical store, and what "encrypted in transit" has to mean for each.
The F&I scan to email. The deal jacket is scanned at the copier and sent to a lender or to the office. The copier holds a mail credential, sends over whatever the mail server negotiates, and the document lands as an attachment that persists in the lender's inbox. Encrypted in transit means the scan is encrypted before it leaves the device and stays encrypted until the named recipient opens it, with a record of that open.
The license photo. A salesperson photographs the driver's license and texts it to the desk. The image now lives in the phone's camera roll, the messaging app, the carrier's path, and the desk's phone. Encrypted in transit means the capture goes straight into an encrypted delivery and never sits in a camera roll.
The emailed credit application. Sent to three lenders to shop the deal. Three inboxes, three retention clocks, three places a breach can start. Encrypted in transit means one delivery per lender, bound to that lender, with no copy left in anyone's mail.
The portal upload. The customer uploads a pay stub to a portal. The store now has a second system holding customer information, a second login to protect with MFA, and a second copy to dispose of. Encrypted in transit means the document moves once, to the person who needs it, and the transport is not also a storage system.
The lender package. The signed contract and supporting documents go to the funding lender. Encrypted in transit means the package arrives as one delivery with delivery evidence, not as a chain of attachments the lender forwards internally.
The short test for all five: can you name the person who opened a specific document, and can you show that nobody else could have? If the answer is "check the mail server," the item is open.
A portal is the answer most dealerships are sold, and it moves the problem rather than solving it. The document now exists in two places, the store and the portal. The customer has to create an account and get through MFA under 314.4(c)(5) in the middle of a purchase, so adoption is poor and the store falls back to email and text for the customers who will not log in. The portal is one more system on the inventory in item 3, one more set of logs in item 9, and one more retention clock in item 8.
The alternative is transport rather than storage. Secure Digital Transport moves the document once, from the sender to a named recipient, encrypted from pickup to open, with no account on the recipient's side, no portal, no attachment, and nothing left behind to inventory or dispose of. Brinks does not ask the bank to open an account at the armored car company; it picks the money up and delivers it, and it can prove where it went. That is the model the rule's outcomes describe, and the dealer guide maps it element by element.
1. When your product sends a customer document outside the store, is it encrypted before it leaves, and until the recipient opens it?
2. Does the recipient need to create an account or log in to a portal to receive it?
3. Where does a copy of the document persist after delivery, and for how long?
4. Can you produce, for a specific document, who opened it and when?
5. Can you show that nobody other than the intended recipient could have opened it?
6. Does the sending device or system hold a mailbox credential, and who can read mail sent with it?
7. What happens to the document if the delivery notification is forwarded?
8. Does the product appear on our data and systems inventory as a system that transmits customer information?
9. Does our contract with you contain the Safeguards language 314.4(f) requires, and when was your last assessment?
10. If one of your mailboxes or servers is compromised, which of our documents would be unencrypted in it?
11. Can a salesperson capture a license image directly into an encrypted delivery, without a photo in the camera roll?
12. What would you give our qualified individual to put in the annual report about documents in motion?
A vendor who can answer all twelve in writing is a service provider under item 10. A vendor who cannot is an open item under item 7.
SecureMyDealer is the dealership product built on this transport for customer documents, deal jackets, and lender packages. It exists so that items 7, 9, and 11 can be answered per document rather than per system.
Yes. This page is a 12-item checklist mapped to 16 CFR 314.4: program and people, systems, and documents in motion. The FTC's own automobile dealer FAQ on ftc.gov is the authority; this checklist is the working document that follows the customer document out of the store.
A written information security program with a designated qualified individual, a written risk assessment, access controls, an inventory of customer information and systems, encryption of customer information in transit and at rest, multi-factor authentication for access to systems holding customer information, secure disposal, change management, logging and monitoring, staff training, service provider oversight, an incident response plan, an annual report to the board or a senior officer, and FTC notification within 30 days of a breach involving unencrypted information of 500 or more consumers.
Yes. Section 314.4(c)(3) requires encryption of customer information in transit over external networks and at rest. A credit application emailed to a lender, a driver's license photo texted to the desk, or a deal jacket scanned to email is customer information in transit. Where encryption is infeasible the qualified individual must approve effective alternative controls in writing.
No. The rule requires outcomes, not a portal. A portal adds a second copy of the document, a second login the customer must create and secure with MFA, and a second system to inventory, log, and dispose from. Transport that moves the document once, to a named recipient, with no account and no copy left behind, meets the same requirements with less to secure.
Since May 13, 2024, a dealer must notify the FTC no later than 30 days after discovering a notification event in which unencrypted customer information of at least 500 consumers was acquired without authorization. Information that was encrypted, with the key not compromised, is outside the definition, which is why item 7 on the checklist carries the most weight.
This checklist summarizes public regulations for educational purposes. It is not legal or compliance advice; confirm obligations with your counsel and your qualified individual.