Not always. The FTC Safeguards Rule gives covered dealerships a choice: continuous monitoring of their information systems, or an annual penetration test plus vulnerability assessments at least every six months (16 CFR 314.4(d)(2)). Dealerships that hold information on fewer than 5,000 consumers are exempt from this specific requirement (16 CFR 314.6).
What the rule actually says
Under 314.4(d)(2), monitoring and testing of information systems must include either continuous monitoring or periodic testing. Without effective continuous monitoring, a covered dealership must run:
- An annual penetration test of its information systems, scoped each year from its risk assessment; and
- Vulnerability assessments at least every six months, plus whenever operations change materially or something may materially affect the security program.
Which dealerships it applies to
A dealership that arranges financing or offers leases is generally treated as a financial institution under the Safeguards Rule. If it holds customer information on fewer than 5,000 consumers, section 314.6 exempts it from the testing clause above, along with the written risk assessment, written incident response plan and Qualified Individual report. The broader duty to regularly test or monitor key controls under 314.4(d)(1) still applies.
What a network pen test does not cover
A network penetration test checks your systems. It may not tell you which employees have work passwords in public breach data, or whose direct line and title are listed on data broker sites. The rule’s risk assessment covers reasonably foreseeable internal and external risks (314.4(b)), and staff training has to reflect the risks that assessment identifies (314.4(e)). People-level exposure belongs in that picture.
Questions for your Qualified Individual
- Which option are we using: continuous monitoring, or annual testing plus six-month assessments?
- When was the last test, and what changed since?
- Does our risk assessment include exposed staff credentials and contact details?
This article explains the rule in plain terms. It is not legal advice. Confirm your obligations with your counsel or compliance advisor.
Sources
Digital Risk Inc. (DRI) measures human cyber exposure for dealerships and small businesses: breached credentials, exposed personal data and impersonation risk tied to the people on your team. See how it works for dealerships.