IT Services for Car Dealerships and Dealer Groups
A dealership collects the most sensitive information a consumer ever hands a retailer: credit applications, driver's licenses, Social Security numbers and bank details, most of it inside the dealer management system and the F&I office. The FTC Safeguards Rule treats dealers as financial institutions and expects a named person, a written program and proof. The 2024 ransomware attack on a major dealer management system provider showed the other risk: deals written on paper for roughly two weeks. NetSys provides IT services for car dealerships that cover both, the rule and the rooftop.
The short answer
NetSys provides IT services for car dealerships and multi-rooftop groups: help desk and 24/7 monitoring for sales, service and parts, networks standardized across rooftops with segmentation between customer Wi-Fi, service bays and the business systems, dealer management system access protected with named logins and multifactor authentication, managed endpoint detection and email defense against the fake-lender and altered-payoff lures aimed at F&I and accounting, encrypted email for anything carrying customer financial information, and immutable backups with restores performed and timed. For the FTC Safeguards Rule we implement and document the required controls and support your Qualified Individual with the risk assessment, testing and annual reporting evidence. Where a dealership prefers it, we can act in that role through a service provider arrangement while a senior person at the store retains oversight, as the rule allows. Agreements run month to month.
Sound familiar?
- F&I and accounting sharing one login to the dealer management system
- Customer Wi-Fi, service bay tablets and the business office on the same network
- A Safeguards Rule program that consists of a signed template and nothing behind it
- Fake lender and altered-payoff emails aimed at the F&I office and the title clerk
- Three rooftops with three different firewall brands and nobody who can log into all of them
- Vendor tools for OEM connections, key management and digital retailing installed with default passwords
What we deliver for dealers
FTC Safeguards Rule, Documented
- Written information security program and a risk assessment tied to your actual systems
- Access controls, encryption and multifactor authentication for anyone reaching customer information
- Continuous monitoring or scheduled penetration testing and vulnerability assessments, as the rule requires
- Service provider oversight, staff training records and the annual written report to ownership
DMS and Business Systems, Kept Up
- Named DMS logins, role-based access and same-day offboarding for sales and F&I turnover
- Immutable backups of accounting, deal files and documents held outside the DMS, with restores timed
- A written plan for operating and recovering if the DMS provider itself goes down
- Vendor coordination with DMS, CRM, OEM and digital retailing providers
Every Rooftop, One Network Standard
- Standardized firewalls, switching and Wi-Fi at each rooftop, monitored from one place
- Segmentation between customer Wi-Fi, service bays, showroom and business office
- Cellular failover so a store can still write deals when the fiber is cut
- Cameras, key cabinets and OEM diagnostic tools placed on their own segments
Fraud and Ransomware Defense
- Managed endpoint detection on every workstation, including F&I and accounting
- Email defense and verification procedures for payoff changes and lender communications
- Encrypted email for credit applications and deal documents
- More than 30 ransomware incidents handled in three years, every one fully recovered
The FTC rules behind dealership IT
A dealer that arranges financing is a financial institution under several FTC rules. We implement and document the technical controls; your Qualified Individual and counsel own the program and decide how each rule applies.
FTC Safeguards Rule notice (16 CFR §314.4(j))
Since May 13, 2024, a dealer must notify the FTC as soon as possible, and no later than 30 days after discovery, when unencrypted customer information about at least 500 consumers is acquired without authorization. Information counts as unencrypted if an unauthorized person also accessed the encryption key.
FTC Privacy Rule (16 CFR Part 313)
Dealers predominantly engaged in selling and servicing, or leasing and servicing, vehicles follow the FTC's privacy rule on customer notices and opt-outs before sharing nonpublic personal information with nonaffiliated third parties. Dealers that extend credit themselves and do not routinely assign the contracts are excluded (§313.1(b)).
Red Flags Rule (16 CFR §681.1)
A dealer that regularly arranges credit and pulls consumer reports for it is a creditor under the rule. If it offers or maintains covered accounts, and the rule names automobile loans as an example, it needs a written identity theft prevention program.
Disposal Rule (16 CFR Part 682)
Credit reports and records derived from them must be disposed of with reasonable measures, such as shredding deal jackets and destroying or erasing electronic media so the information cannot practicably be read or reconstructed. Selling or donating an old F&I computer counts as disposal too.
PCI DSS v4.0.1
Service, parts and sales counters that accept cards validate against version 4.0.1. Encrypted terminals keep the dealer management system and office PCs out of scope; a card number typed into a PC brings them back in.
This is general information, not legal advice. Confirm your obligations with counsel.
Dealer systems we support around
Rooftops run a dealer management system, a CRM, F&I and credit portals and OEM tools. We manage the networks, workstations, named logins and backups around them and work with each provider's support, including when the DMS vendor itself has an outage.
- CDK Global
- Reynolds and Reynolds
- Dealertrack
- Tekion
- VinSolutions
- RouteOne
Product names are their owners’ trademarks. We manage the devices, accounts and access around these applications and work with each vendor’s support. A listing here doesn’t mean we resell an application or partner with its maker.
IT services for a car dealership group with three rooftops and one Safeguards binder
The specific engagements behind this profile are under NDA, so it is written as a generalization rather than a named client. Our published, client-approved outcomes are in case studies.
A family-owned group ran three stores under two franchises. The Safeguards program existed as a template downloaded from a trade association, signed and filed. The F&I offices at all three stores logged into the DMS with a store-level account, the service drive tablets rode on the customer Wi-Fi, and the accounting office had recently paid a payoff to a changed bank account that turned out to belong to a criminal. The general manager had been named Qualified Individual without being told what that meant.
- A risk assessment written from an inventory of every system holding customer information, not from a template
- Named DMS logins with multifactor authentication, roles for F&I, accounting and sales, and an offboarding step tied to payroll
- Networks rebuilt on a common standard at all three rooftops, with customer Wi-Fi, service and business office separated
- Email authentication, filtering for lender lookalikes and a two-person verification rule for any payoff or bank change
- Testing scheduled, training recorded, vendor agreements gathered and the annual report drafted for ownership
The intended result is a Qualified Individual with evidence behind every section of the binder, a changed payoff instruction that triggers a phone call instead of a payment, and one network standard across the stores, so a problem at one is fixed the same way at the others.
Work we have done for auto dealer clients
- Auto dealers
Independent automotive dealership group
IT support across 5 dealerships, management of 95 computers, email security, and software license consolidation.
Client names are withheld. Each card is the scope of a real NetSys engagement, as delivered.
Auto Dealers IT FAQs
Do you provide IT services for car dealerships with a single rooftop?
Yes. A single-point store has the same Safeguards Rule obligations and the same DMS dependence as a group, with fewer people to spread the work across. The agreement covers help desk, monitoring, network, security, backups and the compliance documentation, and it scales when a second rooftop arrives. The general manager gets a dedicated account manager with a cell number rather than a ticket portal.
What does the FTC Safeguards Rule require of an auto dealer?
Because dealers arrange financing, the rule treats them as financial institutions. It requires a designated Qualified Individual, a written risk assessment, access controls, encryption of customer information in transit and at rest, multifactor authentication for anyone accessing that information, monitoring and testing, staff training, oversight of service providers, an incident response plan, an annual report to ownership and, since 2024, notification to the FTC for larger breaches. We implement and document each of those.
Can NetSys be our Qualified Individual?
The rule allows the Qualified Individual to be an employee of a service provider, provided the dealership designates a senior person to direct and oversee that provider and retains responsibility for compliance. We can serve in that arrangement, or we can support a Qualified Individual on your staff with the assessment, testing and reporting evidence. Either way the dealership keeps ownership of the program.
What happens to a dealership when the DMS goes down?
Deals cannot be booked, repair orders cannot be closed and parts cannot be invoiced. The 2024 attack on a major DMS provider left stores on paper for roughly two weeks. A dealership cannot prevent a provider outage, but it can prepare: keep deal and accounting documents backed up outside the DMS, have a paper and spreadsheet procedure ready, and know how to re-enter work when the system returns. We write and rehearse that plan.
How do we protect the F&I office from email fraud?
Criminals impersonate lenders, lienholders and customers to redirect payoffs and funding. The defenses are email authentication so your domain cannot be spoofed, filtering tuned for lookalike lender domains, multifactor authentication on mailboxes, and a rule that any change to bank details is verified by phone with a known contact. Training uses examples from the dealership's own inbox, which lands harder than a generic video.
Is there a long-term contract?
No. Dealer agreements are month to month. Rooftops can be added or removed as the group changes, and the Safeguards documentation stays with the dealership if we part ways. Groups accustomed to multi-year DMS contracts sometimes expect the same from IT, and we do not work that way.
What do IT services for car dealerships include?
They cover every rooftop's network, workstations and phones, named logins to the dealer management system, email defense for F&I and accounting, managed endpoint detection, backups kept outside the DMS with timed restores, and the documentation the FTC Safeguards Rule expects. The DMS provider supports its software; we run everything around it.
Does the FTC Safeguards Rule apply to small dealerships?
Yes, at every size, though a dealership with customer information on fewer than 5,000 consumers is exempt from four provisions: the written risk assessment, continuous monitoring or annual penetration testing, the written incident response plan and the annual report. It still needs a Qualified Individual, multifactor authentication, encryption, training and vendor oversight.
How much do IT services for a car dealership cost?
Dealers pay per user per month under a month-to-month agreement, and we publish no rates. Rooftop count, users and devices across sales, service and parts, DMS and OEM integrations, Safeguards documentation and testing, and on-site visits move the quote. Standardizing networks across stores can be scoped as a separate project.
How often does a dealership need a penetration test?
Under the Safeguards Rule, at least annually unless you run effective continuous monitoring, plus vulnerability assessments at least every six months and after material changes. Dealers with fewer than 5,000 consumers' information are exempt from that specific requirement but must still test their key controls regularly. Our free external penetration test is a starting point.
Do you support dealer groups with rooftops in several states?
Yes. Every rooftop is built to one network standard and monitored from one place, so a store in another state gets the same setup, help desk and Safeguards documentation. On-site work covers New York City, Long Island, Westchester, the Hudson Valley, North Jersey and Fairfield County, CT; elsewhere, visits are arranged in advance and scoped in the proposal.
Guides for auto dealers leaders
- The FTC Safeguards Rule for Auto Dealers
- FTC Safeguards Rule Compliance
- Network Security
- Disaster Recovery Planning
- GLBA compliance for dealers that arrange financing
- Annual penetration testing for the Safeguards Rule
- Written risk assessment and incident plan for a dealership
- Named DMS logins and same-day offboarding for sales staff
Other industries we support
Services behind this work
Scope support around the way your team works.
Tell us which applications, locations and deadlines matter to your auto dealers team. We will discuss support, security, backup and project responsibilities in one clear scope.