Learn what the rule requires
For owners who want to understand the rule before deciding anything.
- Free 30-minute owner briefing
- Plain-English guide to every requirement
- Paid gap assessment with a checklist your team works through
FTC Safeguards Rule compliance
Get your dealership's Safeguards Rule program built, documented, and working.
ROI Compliance helps car dealerships and other covered businesses meet the FTC Safeguards Rule in plain English. Build the program yourself with an expert guiding each step, or hand the Qualified Individual role to us.
Led by a former Qualified Individual for a franchise dealership. Online nationwide, on-site in the Carolinas.
Three ways to get compliant with the Safeguards Rule
Every dealership is different. Pick how involved you want to be. You can move up a level any time.
Guided implementation
For dealerships that want someone in-house to run the program, with an expert showing them how.
- One-on-one sessions on your schedule
- Templates for every section of your WISP
- A checklist and evidence list for each step
Outsourced Qualified Individual
For dealerships that want an expert to oversee the program and report to ownership.
- ROI Compliance serves as your QI
- Risk assessment, WISP, and vendor tracking
- Annual on-site visit with staff training
What the Safeguards Rule asks of your dealership
If your dealership arranges financing or leases, the FTC treats it as a financial institution. That means you need a written information security program, called a WISP, and one person in charge of it, called the Qualified Individual.
- A Qualified Individual to oversee the program
- A written risk assessment
- Safeguards like MFA, encryption, and access controls
- Security awareness training for staff
- Oversight of vendors with access to customer data
- A written incident response plan
- Testing and monitoring of your systems
- An annual written report to ownership
Guided implementation: learn it, build it, keep it
Most dealers don't need to outsource everything. They need a clear order of steps and someone to answer questions. Guided implementation gives your in-house person exactly that, one piece at a time.
- Gap assessmentA review of your store against every requirement, with a written report of gaps ranked by risk. Then you decide how to continue.
- One step at a timeMFA and individual logins, physical security, email, vendors, and more, in the order that reduces the most risk first.
- Document as you goEach session ends with a WISP section template, a checklist, and a list of records to keep.
- Book the next step when you're readyNo fixed class schedule to fall behind on. Sessions fit your calendar until your program is in place.
Who ROI Compliance works with
The Safeguards Rule covers more than car dealers. If you collect customer financial information, it may apply to you.
- Franchise and independent car dealerships
- Buy-here pay-here dealers
- RV, powersports, and marine dealers that arrange financing
- Finance companies and lenders
- Tax preparers and accounting firms
- Mortgage brokers
Why ROI Compliance
- Hands-on experience as the Qualified Individual for a Ford franchise dealership
- Plain English, practical steps, no jargon
- No long-term contracts
- Built for busy owners and managers, not IT departments
- Online nationwide, on-site in the Carolinas
Safeguards Rule questions dealers ask
Does the FTC Safeguards Rule apply to car dealerships?
Yes, for most dealers. A dealership that arranges financing or leases for customers is a financial institution under the Safeguards Rule (16 CFR Part 314) and must have a written information security program overseen by a Qualified Individual.
Can someone at our dealership be the Qualified Individual?
Yes. The Qualified Individual can be an employee or an outside provider. The rule does not require a specific degree or certification, but the person must be able to oversee the program. Guided implementation is built to help an in-house Qualified Individual do the job.
Does our IT company or DMS provider make us compliant?
No. Your vendors secure their own systems, but the dealership is responsible for its own information security program, including the risk assessment, written policies, staff training, vendor oversight, and the annual report to leadership.
Do we have to sign a long-term contract?
No. Guided implementation sessions are booked when you are ready, and Qualified Individual plans do not require long-term contracts.
Is ROI Compliance a law firm?
No. ROI Compliance provides compliance consulting and training, not legal advice. ROI Compliance is not affiliated with the FTC or any government agency.
Not sure what the rule asks of your dealership?
Join the free 30-minute owner briefing. You'll learn what the rule requires, what your vendors don't cover, and get your questions answered.