FTC Regulations for Car Dealerships: What You Need To Know

by techheights | Apr 7, 2023

In 2021, the Federal Trade Commission (FTC) amended the Gramm-Leach-Bliley Act, which is commonly known as the “Safeguards Rule.”  The amendment, which goes into effect on June 9, 2023, creates stricter regulations for car dealership data protection. The rule requires dealerships with over 5,000 customer records to develop, implement, and maintain a security program to protect customer information. If you’re a small dealer, you might wonder how you can contend with these big changes. In this guide, we’ll outline the new regulations and discuss how a managed services provider in Orange County, like TechHeights, can help car dealerships get compliant before the upcoming deadline.

What Are the FTC Regulation Changes for Car Dealerships?

Car dealerships handle a large volume of consumer information, including sensitive data that cybercriminals want to steal. The Safeguards Rule outlines stricter procedures that dealerships must follow to protect their customers’ information and reduce the possibility of a cyberattack. Before the amendment, the FTC allowed dealerships to make their own protections. However, with the rise of cybercrimes, the revised rule provides more concrete guidance for dealerships’ security programs. 

Updates to the Safeguard Rule

The new Safeguards Rule identifies nine key elements that your car dealership’s information security program must include: 

1. Designate a “Qualified Individual” to implement and supervise the dealership’s information security program. This person can be an employee or can work for an IT service provider in Orange County, like TechHeights. 
2. Conduct a risk assessment. Before creating a compliant security program, dealerships must first understand what information they have, where this information is located, and which specific threats could affect the data’s security. 
3. Implement safeguards to control the identified risks. This part of the rule is very detailed and includes specifics on access management, encrypting sensitive information, implementing multi-factor authentication, and securely disposing of information. 
4. Assess vulnerabilities and continuously monitor the effectiveness of these safeguards. 
5. Train your employees. Staff members need regular, specialized training to spot potential risks.
6. Monitor service providers. Your dealership probably works with multiple vendors to run your business as smoothly as possible. But under the new rule, your service provider contracts must include security expectations, including security assessments.
7. Keep your information security program current. Dealerships must adjust digital security programs based on any changes.
8. Write an incident response and recovery plan. The plan must outline procedures, processes, roles and responsibilities in case of a security event. 
9. Require the “Qualified individual” to provide a regular written status report on the company’s security program. 

How Can a Managed Service Provider Help Car Dealerships Stay Compliant?

The changes to the Safeguard Rule are complex and time-consuming. Many of the requirements listed above have detailed specifics, and all of them require most car dealerships to develop new expertise and capabilities — and fast. A managed service provider in Orange County can be a trusted partner in helping you create a culture of cybersecurity awareness. TechHeights helps car dealerships stay compliant in a variety of ways, including: 

• Assessments: We’ll guide you through the process and perform a detailed analysis to determine your current level of compliance.
• Recommendations: After the assessment, we’ll give your dealership specific guidance on how to build and implement a compliant information security program.
• Training: We can provide cybersecurity awareness training to your employees, contractors, and vendors.
• Monitoring: TechHeights offers continuous security monitoring to detect potential cyber security threats and vulnerabilities. 

Our certified experts understand that the new FTC regulations create significant challenges for small car dealerships. Contact TechHeights today for expert help tailored to these new requirements for car dealerships.

Why Is Cybersecurity Important for Small Businesses?

by techheights | Apr 7, 2023

2022 was a turbulent year for cybersecurity. Several large companies, including Twitter and Uber, made headlines after experiencing data breaches. While it’s true that high-profile breaches grab the media spotlight, it doesn’t mean that small businesses are free from cybersecurity concerns, either. In fact, the opposite is true. Small businesses are increasingly becoming attractive targets for hackers.

No matter the size of your company, digital security is an essential part of your business operations. Let’s look at what cybersecurity is and why every small business needs a strong cybersecurity presence.

What Is Cybersecurity? 

Cybersecurity, which is also called Information Technology (IT) security, protects critical systems, networks, and information against digital breaches or cyberattacks. 

Cyberattacks usually try to steal sensitive data, extort money, or damage an organization’s computers. Criminals use several methods to carry out cyberattacks, but the most common for small businesses are email phishing and malware. 

The good news is that you have the power to fight back. A strong cybersecurity strategy protects your valuable assets, empowers your employees, and increases consumer trust in your business. However, cybersecurity isn’t a one-time implementation or training. Instead, effective cybersecurity is an ongoing process for any small business. 

The Importance of Cybersecurity for Small Businesses

As cyber threats increase in size and scope, more enterprises are investing in cybersecurity tools. As they strengthen their security postures, hackers are pivoting toward easier targets: small businesses. Unfortunately, cyber attacks against small businesses are becoming increasingly common. As of 2021, 46% of all data breaches targeted small to medium-sized companies with fewer than 1,000 employees. 

Of course, the financial ramifications of an attack can have a big impact on high-profile enterprises. But one breach can sink a small company, which is why cybersecurity is so important for small businesses. 

Why Do Cybercriminals Target Small Businesses?

Hackers go after small businesses for three main reasons. 

Fewer Resources

Small businesses are responsible for protecting customer data, including personally identifiable information (PII). However, unlike large enterprises, small businesses often don’t have the resources to safeguard this data against evolving cyber threats. Hackers know this, and they also know that small business employees might lack the cybersecurity training to recognize an attack in the making. 

Cybercriminals are becoming more sophisticated in their attack methods. They commonly use various types of social engineering attacks, like email phishing, to target smaller businesses for one simple reason: they work. The average employee of a business with fewer than 100 employees will experience 350% more social engineering attacks than an employee at a bigger company.

The Rapid Growth of Technology and IoT

As the use of technology increases, more small companies rely on IoT devices to optimize their operations. However, as their network of smart devices grows, so do potential threats. Most IoT devices lack built-in security and allow remote access, which creates more security vulnerabilities for small businesses.

Links To Bigger Companies

Small businesses are often digitally linked to larger companies for various purposes. Hackers might not be able to penetrate the defenses of the larger organization, so they go after the small businesses that support them instead. For example, consider the massive Target breach in 2014: hackers accessed the network using login credentials stolen from Target’s HVAC partner. 

How Do I Learn More About Cybersecurity for My Small Business?

If your business uses the internet, you need to create and maintain an effective cybersecurity plan. The good news is that you don’t have to do it alone.  TechHeights offers the best-managed IT services in Orange County. Our experts understand the cybersecurity needs of small businesses and support your business when you need it the most. Contact us today to see how a custom cybersecurity framework can help your small business thrive. 

Facebook Post

While it’s true that high-profile companies grab the media spotlight, it doesn’t mean that small businesses are free from cybersecurity concerns. In fact, the opposite is true. Small businesses are increasingly becoming attractive targets for hackers.

So, why do cybercriminals target small businesses? It comes down to three things:

1. Small businesses have fewer resources
2. They’re using more technology than ever before
3. Small businesses are often linked to bigger enterprises

Check out TechHeights’ latest blog to learn how cybersecurity can help small businesses beat the bad guys.