Applicability and threshold check
Whether you're a covered financial institution and whether the 5,000-consumer exemption trims your duties.
The Problem
Your Dealership Holds Lender-Grade Data Without Lender-Grade Security
It shows up when a lender, a manufacturer audit, or a cyber insurer asks for your written security program and the honest answer is a shared login.
Logins
Managers share one login to the lender portal.
Logins
Named accounts with MFA on the DMS, CRM, email, and lender portals.
Paper
Deal jackets with Social Security numbers sit in an open cabinet.
Paper
Locked storage, access rules, and disposal schedules for paper customer files.
Vendors
The DMS vendor's remote access goes unreviewed for years.
Vendors
A service provider review with contract terms and access checks for each vendor.
Breach plan
Nobody knows when the FTC must hear about a breach.
Breach plan
A written incident plan with the FTC 30-day notice step for 500+ consumers.
Your F&I office runs credit applications all day. Deal jackets with Social Security numbers sit in an open cabinet, and two managers share one login to the lender portal. Your DMS vendor has remote access nobody reviews. The website's credit app emails PDFs to a sales inbox. Then your cyber insurer asks for your Qualified Individual, your risk assessment, and proof of MFA. You have an old policy binder with a former manager's name on it.
We start by checking how the rule applies to you, including the 5,000-consumer threshold. Then we map every place customer data lives: DMS, CRM, lender portals, email, paper, and the website. Next we work through each required element, from a Qualified Individual and a written risk assessment to MFA, encryption, vendor oversight, training, and an incident plan. You end up with a program the store runs, not a binder nobody opens.
Built for dealership systems
DMS, F&I menus, lender portals, CRM, and deal jackets covered, not only office laptops.
Qualified Individual set up
One accountable person named, with written duties, a backup, and a yearly board report template.
MFA for everyone with access
Every user who reaches customer data signs in with MFA, including managers and vendors.
Our FTC Safeguards Rule Compliance Process
From Applicability Check to a Working Security Program in Five Clear Steps
You confirm which duties apply, approve each document, and test each new safeguard with staff before it reaches the sales floor.
We ask what financing, leasing, or tax work you do and roughly how many consumers' records you keep. You get a fixed quote and an early read on which parts of the rule apply.
What's Included
What You Get With FTC Safeguards Rule Requirements Covered
Each project covers an applicability check, a data map, a written risk assessment, the required safeguards, vendor oversight, training, and an incident plan.
Compare Options
DeveloperLook vs DMS Vendor Add-On vs Local IT Provider
Your DMS vendor and local IT provider both cover pieces of the rule well. Here is where each fits when you need the whole program.
| Feature | DeveloperLookBest fit | DMS vendor add-on | Local IT provider |
|---|---|---|---|
| Applicability check | Done first, in writing | Rarely included | Not usually |
| Systems covered | DMS, CRM, portals, paper, website | Their own system | Devices and network |
| Risk assessment | Written to the rule's criteria | For their platform only | Technical risks they see |
| MFA and encryption | Set up across every system | Inside their product | Strong on managed devices |
| Vendor oversight | Reviews each provider | Not their role | Sometimes, on request |
| Qualified Individual | Named, briefed, with report template | Not included | Sometimes acts as one |
| Cost | Fixed price from $950 | Often a monthly add-on | Inside monthly fees |
| Ongoing monitoring | Handover plus yearly checklist | Strong for their product | Strong for day-to-day IT |
DeveloperLook
DMS vendor add-on
- Applicability check
- DeveloperLook: Done first, in writingDMS vendor add-on: Rarely included
- Systems covered
- DeveloperLook: DMS, CRM, portals, paper, websiteDMS vendor add-on: Their own system
- Risk assessment
- DeveloperLook: Written to the rule's criteriaDMS vendor add-on: For their platform only
- MFA and encryption
- DeveloperLook: Set up across every systemDMS vendor add-on: Inside their product
- Vendor oversight
- DeveloperLook: Reviews each providerDMS vendor add-on: Not their role
- Qualified Individual
- DeveloperLook: Named, briefed, with report templateDMS vendor add-on: Not included
- Cost
- DeveloperLook: Fixed price from $950DMS vendor add-on: Often a monthly add-on
- Ongoing monitoring
- DeveloperLook: Handover plus yearly checklistDMS vendor add-on: Strong for their product
Projects We've Built
Automotive and Finance Websites We Have Built
Automotive sites and finance platforms we designed and built. They show our build work for businesses that handle customer data, not Safeguards Rule projects.
Carsova Automotive Website Design
- Automotive
- Dashboard
- Website
Voltz Automotive Website Design
- Automotive
- Booking System
- Dashboard
Armada AG Fiduciary and Consulting Services Website
- Finance
- Business
- Website
Oasic Finance SaaS Web Design & Development
- Finance
- SaaS Platform
- Dashboard
What Our Clients Say
What Clients Say After Launch
Feedback from teams we have built platforms, apps, and websites for.
We had a pretty specific idea of what we wanted our website to become, but I wasn’t sure how easily we could explain all of it to a development team. There were quite a few moving parts, and we were working toward a deadline, so I expected a few things to get lost along the way. That never really happened. They understood what we were trying to achieve, kept us updated throughout the process, and got everything ready within the agreed timeline. The final site feels much easier to navigate, works beautifully on mobile, and is noticeably smoother for our customers. It was a huge relief seeing the original idea actually turn into the website we had in mind.
The mobile experience is probably my favourite part of the new site. We had spent a lot of time making sure the desktop version looked right, and the team kept pushing us to think about how everything would actually feel on a phone too. They were right. The navigation is clean, the interactions feel natural, and everything we’ve tested so far works exactly as it should. They also went through the links, forms, integrations, and other details more than once before launch, which I really appreciated. And even after going live, we could still reach out when something came up. The whole process felt friendly, organised, and surprisingly straightforward.
What I appreciate most is that the website is actually easy for us to manage now. We can update content ourselves instead of sending a developer a message every time we need to change something small. They also paid attention to the technical SEO side, which mattered to us because we didn’t want a new website to create problems for the traffic we already had. I’ve probably asked more questions than I should have since launch, but every question has been handled patiently and without any fuss. The team is easy to work with, they explain things clearly, and when we need something changed, they focus on getting it done rather than making the process complicated.
1,250+
Projects shipped
10+
Years of experience
Top 3%
Upwork Top Rated Plus
5 stars
Average review score
1,250+
Projects shipped
10+
Years of experience
Top 3%
Upwork Top Rated Plus
5 stars
Average review score
Want results like these?
Tell us what you are building. You get a reply within 24 hours on business days, then a written estimate.
Work Culture
Why Dealers and Finance Firms Trust Us With the Safeguards Rule
A security program only works if the sales floor can live with it. These habits put the rule's requirements in place without slowing deals.
Built around the deal flow
MFA and access changes are tested with F&I and sales first. Deals keep moving, and nobody meets a new login screen during a customer's signing.
Honest about the exemption
If you keep records on fewer than 5,000 consumers, some duties drop away. We'll tell you before we quote, so you don't pay for parts you don't need.
Evidence over promises
Every safeguard in your program is checked in the system itself. When a lender or insurer asks, you can show the setting, not just the policy.
No legal advice in disguise
We put the rule's security requirements in place and write the program. Questions about state law, contracts, or regulator letters go to your lawyer.
One program, every rooftop
Multi-store groups get one program with store-level checklists. Each location follows the same rules without keeping its own separate binder or policy set.
Fixed price per group
You get a fixed quote based on rooftops, offices, and systems. Extra stores are priced before work starts on them.
Overview
What does FTC Safeguards Rule compliance require from auto dealers?
DeveloperLook delivers FTC Safeguards Rule compliance for auto dealers, lenders, and other non-bank financial businesses. We check applicability, map customer data, write the risk assessment and program, and set up MFA, encryption, vendor reviews, training, and the FTC breach notice steps. Projects start at $950 and take 2 to 8 weeks.
DEVELOPERLOOK
Project facts · FTC Safeguards Rule Compliance
- Service
- FTC Safeguards Rule compliance (applicability check, risk assessment, safeguards, written program)
- Typical timeline
- 2 to 3 weeks for the assessment, 5 to 8 weeks with safeguards
- Platforms
- CDK Global, Reynolds and Reynolds, DealerSocket, RouteOne, Microsoft 365, Google Workspace
- Built with
- Microsoft Entra ID, Cisco Duo, Intune, Tenable Nessus, KnowBe4
- Experience
- 10+ years of development experience and 1,250+ shipped projects
- Post-launch support
- 30 days of questions and program updates
- Communication
- Calls in US, UK, and AU business hours
- Starting price
- From $950 USD, fixed scope after a free call
Reviewed 27 Oct 2026 by Saimul Islam
Good fit
Franchise and independent auto dealers
Your store arranges financing and leases, and you need the FTC Safeguards Rule auto dealers must follow turned into settings, not a binder.
Dealer groups with several rooftops
Your manufacturer audit asked how each store meets the FTC safeguard rule for auto dealers, and every location answered differently.
Mortgage brokers and finance companies
You're a non-bank lender or broker, and a bank partner wants proof of your FTC safeguards compliance before renewing.
Tax and accounting practices
Your practice prepares returns, so the FTC Safeguards Rule CPA firms must follow when they handle tax clients now needs MFA, testing, and vendor reviews.
Owners starting from a checklist
You downloaded an FTC Safeguards Rule checklist and want someone to check each line in your systems instead of ticking boxes.
Not a fit
Only need the written plan
You're a small tax office that only needs the written plan. Our Written Information Security Plan page covers that faster and for less.
Bank or insured credit union
You're a bank or a federally insured credit union. Your own regulator's safeguards guidelines apply instead of the FTC rule.
Need an ongoing security lead
You want someone to act as your Qualified Individual every month. Our vCISO Services page covers that ongoing role.
Need legal advice
You need advice on a regulator letter, state privacy law, or customer contracts. A lawyer should handle that, and we'll share our documents with them.
Not sure we're the right fit?
Book a free call or message us. We'll tell you honestly whether we're the right team.
Pricing
Transparent Starting Prices for FTC Safeguards Rule Compliance
These are starting points in USD. Your final price depends on rooftops or offices, systems holding customer data, and the safeguards to fix, and you get a fixed proposal after a free call.
For Agencies
White-Label Safeguards Rule Work for Dealer IT Providers and Consultants
You own the client relationship. We supply applicability checks, risk assessments, and safeguard setup under your brand, so your dealer and finance clients get a program that fits the rule.
How the partnership works
White label: your client only ever sees your brand
Your clientSees only your brand
You, the agencyOwn the relationship
DeveloperLookBehind your brand
Share the client brief
Send rooftops, DMS and CRM vendors, financing activity, and any audit requests.
- Client needs
- You share the details
- Details received
We assess and build
We run the assessment and set up safeguards alongside your team.
- Scope and plan
- Proposal to resell
- Your quoteYOUR LOGO
Report and hand off
We hand over the program and board report template under your brand.
- Done by our team
- Your brand on it
- Handed to your clientDone
- Your client
- You, the agency
- DeveloperLook
Share the client brief
Send rooftops, DMS and CRM vendors, financing activity, and any audit requests.
- Client needs
- You share the details
- Details received
We assess and build
We run the assessment and set up safeguards alongside your team.
- Scope and plan
- Proposal to resell
- Your quoteYOUR LOGO
Report and hand off
We hand over the program and board report template under your brand.
- Done by our team
- Your brand on it
- Handed to your clientDone
Partner with DeveloperLookDelivered under your brand
The Right Technology for Your Project
Technology Stack
We secure the dealer, finance, and office systems that hold customer information, and add the identity and testing tools the rule calls for.
- CDK Global
- Reynolds and Reynolds
- DealerSocket
- RouteOne
- Microsoft Entra ID
- Cisco Duo
- Okta
- 1Password
- Microsoft 365
- Google Workspace
- Microsoft Intune
- BitLocker
- Tenable Nessus
Burp Suite- KnowBe4
OWASP
01 / 04
Related Services
Dealers and lenders often add an MFA rollout, an outside security lead, small business security basics, or a dealer CRM.
Cybersecurity Services
DeveloperLook provides cybersecurity services for businesses without a security team. We assess identity, email, devices, cloud, and web apps, fix the gaps you approve, and recheck every fix, so you get a cybersecurity service provider that does the work.
Written Information Security Plan (WISP)
DeveloperLook writes a WISP (written information security plan) for tax preparers, CPA firms, and small offices that hold client data. We map your data, write the plan to IRS and FTC rules, and check that every safeguard in it is switched on.
MFA Implementation Services
DeveloperLook delivers MFA implementation services for companies that need a second factor on email, VPN, admin consoles, and in-house apps. We follow MFA best practices: methods matched to risk, staged enrollment, and help desk resets that resist social engineering.This page
FTC Safeguards Rule Compliance
Pairs with the 6 services around it
vCISO Services
DeveloperLook provides vCISO services for SaaS and service companies that need a security leader without a full-time hire. Our virtual CISO service gives you a named lead on published monthly hours who owns your roadmap, policies, and questionnaires.
Dealership Cyber Security
DeveloperLook provides car dealership cyber security for franchise and independent dealers. We clean up DMS and CRM users, protect desk and service PCs, add MFA, and write a DMS downtime playbook, so your store can keep selling when systems go down.
Cybersecurity for Accounting Firms
DeveloperLook provides cybersecurity for accounting firms, tax practices, and bookkeepers. We check the IRS Security Six on every computer, put MFA on tax software and portal logins, and move client files out of email. It's cyber security for accountants, timed around filing season.FAQ
Frequently Asked Questions
Straight answers on cost, who the rule covers, what it requires, and when it started.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
Compliance work with us starts at $950 for an applicability check, data inventory, risk assessment, and gap list. The written program with MFA, encryption, vendor reviews, training, and an incident plan starts at $2,950. Dealer groups with testing and reporting start at $6,300. You get a fixed quote after a free call.
Most single stores take 5 to 8 weeks from first call to a working program. The gap assessment alone takes 2 to 3 weeks. MFA rollouts drive the timing, because we test them with sales and F&I staff before switching them on. Dealer groups take longer.
It's the regulation under the Gramm-Leach-Bliley Act that tells non-bank financial institutions how to protect customer information. It requires a written information security program with specific elements, from a Qualified Individual to MFA, encryption, testing, and an incident response plan. It's codified at 16 CFR Part 314.
It applies to non-bank financial institutions under the FTC's jurisdiction. That includes most auto dealers that finance or lease vehicles, mortgage brokers, payday lenders, finance companies, and tax preparation firms, including CPA practices that prepare returns. Banks and federally insured credit unions follow their own regulators instead. Below 5,000 consumers, a few duties fall away.
Its goal is to protect the security, confidentiality, and integrity of customer information. In plain terms, it pushes businesses to know where customer data is, limit who can reach it, and protect it in storage and transit. It also expects a fast response when something goes wrong. It sets a process, not a specific product.
Yes, most are. The FTC says the rule covers most auto dealers that finance or lease vehicles, since that makes them financial institutions under the Gramm-Leach-Bliley Act. That brings in the F&I office, credit applications, the DMS, and lender portals. A cash-only dealer that doesn't arrange financing or leases may fall outside it.
The FTC issued the original rule in 2002, and it took effect in May 2003. Major amendments followed in 2021, with the last of the new requirements taking effect on June 9, 2023. A breach notification amendment took effect on May 13, 2024, adding the 30-day FTC notice for events involving 500 or more consumers.
The rule requires a Qualified Individual, a written risk assessment, and safeguards based on it. Those include access controls, a data inventory, encryption, secure development, MFA, disposal within 2 years of last use, change management, and activity monitoring. You must also test or monitor, train staff, oversee vendors, keep an incident plan, and report to the board yearly.
A useful checklist follows the rule's elements and names your dealership systems. It should cover the DMS, CRM, lender portals, F&I menus, website credit apps, email, and paper deal jackets. For each one, check MFA, encryption, who has access, how long records are kept, and which vendor can reach them. Then verify each line in the system itself.
Yes, for most covered businesses. The Qualified Individual reports to the board in writing at least once a year, and testing continues through monitoring or yearly pen tests with scans every 6 months. You get 30 days of questions and program updates after handover, plus a yearly review checklist.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
Free 30-min callGoogle Meet
Book a call
Book a free 30-minute call
In 30 minutes on Google Meet we walk you through how we would build it, how long it takes and what it costs. Then you get a written estimate.
Calendar not showing? Book on cal.com or send a brief.