Don’t look now, but it’s time for the Federal Trade Commission to start enforcing a new set of Safeguards Rule cybersecurity requirements for dealerships, auto lenders and dealership service providers, starting June 9. All those entities fall under the umbrella of “financial institutions” that must follow the Rule.
The Rule is so dense and experts so scarce that the FTC opted to push the deadline back six months. As we previously reported, dealerships couldn’t secure enough experts to ensure they complied to meet the original deadline. A key change is that the updated Rule adds a requirement for what it calls a “qualified individual” at each dealership, whether on-staff or for-hire, who protects online data.
“The cybersecurity field is short of people,” Mark Dante, a national cybersecurity expert for CDK Global in Hoffman Estates, IL, told Wards in an earlier interview. “You can’t snap your fingers. It takes time to train them,” he says. Candidates “also need experience – on-the-job training.”
The good news is that a CDK Global study found that 85% of dealerships take cybersecurity seriously, calling it a “priority.” That’s vital because non-compliance can result in penalties up to $46,517 per violation, according to Dante.
The updated regulations require new cybersecurity measures, like constant monitoring of consumer data, even in real-time during online interactions, and the use of multi-factor authentication, to make sure consumers are who they say they are.
So, has the postponement make the industry any readier than it was six months ago? Probably, Robert Ebin, senior manager of legal affairs for dealership vendor KPA in Westminster, CO, tells Wards.
“As with so many things, the honest answer is, ‘It depends.’ For dealers who were already being diligent in trying to meet the initial alert six months ago, this time was welcome,” Ebin says.
“I do think it has helped a little bit,” he says. “I think a lot more dealers have hired someone, and auto lenders have had people in place.”
However, it’s safe to assume at least some of the dealers who were postponing getting ready for the new Safeguards Rule six months ago still haven’t acted, he says. As the song goes, they have a long way to go and a short time to get there.
