Program oversight
- ROI Compliance named as your Qualified Individual
- Your WISP and Safeguards Rule documentation kept current
- Annual written report to ownership
Done for you
An outsourced Qualified Individual for your dealership's Safeguards Rule program
ROI Compliance serves as your Qualified Individual. We oversee the program, keep the paperwork current, track your vendors, train your staff, and report to ownership every year, so you can get back to selling cars.
Experience serving as the Qualified Individual for a Ford franchise dealership · No long-term contracts
What's included in a QI plan
A QI plan covers the oversight work the Safeguards Rule assigns to the Qualified Individual.
Risk and remediation
- Written risk assessment
- Prioritized remediation recommendations
- Verifying and documenting completed fixes
Vendors
- Tracking every vendor with access to customer information
- Tracking each vendor's verification status
Training
- One on-site visit a year with a staff security training session
- New-hire training materials
- Training completion records
Incidents
- Incident coordination when something goes wrong
- Guidance on FTC breach notification
Billed separately
- Vendor security assessments: questionnaires, follow-up, and verifying documentation, per vendor
- Additional on-site visits and training sessions
- Incident time beyond what the plan includes, hourly
What stays with the dealership
The Safeguards Rule is clear that outsourcing the Qualified Individual doesn't outsource responsibility. When you use an outside QI, the dealership must:
- Keep responsibility for compliance
- Name a senior person at the store to oversee the QI
- Require the QI's firm to maintain its own security program
Remediation is the dealership's job. ROI Compliance finds the risks, recommends the fixes, and verifies and documents them once they're done. Your team and your IT provider carry out the fixes.
How getting started works
- Intro callWe talk through your store's size, locations, and vendors so the plan can be scoped and priced.
- ProposalYou get a plan scope and price for your dealership. No long-term contract.
- OnboardingDesignation of ROI Compliance as QI, data and vendor inventory, and the risk assessment.
- Ongoing oversightRemediation tracking, vendor tracking, training, and the annual report to ownership.
Qualified Individual FAQ
What is a Qualified Individual under the FTC Safeguards Rule?
The Qualified Individual is the one person designated to oversee, implement, and enforce a business's information security program under the FTC Safeguards Rule (16 CFR 314.4(a)). The QI also reports in writing to the board or a senior officer at least once a year.
Can a car dealership outsource its Qualified Individual?
Yes. The rule allows the Qualified Individual to be a service provider. If you outsource the role, the dealership keeps responsibility for compliance, must designate a senior member of its staff to oversee the provider, and must require the provider to maintain an information security program.
Does an outsourced QI fix our security problems?
No. ROI Compliance assesses risk, recommends fixes, and verifies and documents them once they're done. The dealership owns remediation and carries it out, usually with its IT provider.
Do QI plans require a long-term contract?
No. ROI Compliance QI plans do not require long-term contracts.
How much does an outsourced Qualified Individual cost?
Pricing depends on the size of the dealership, the number of locations and vendors, and how much of the program is already in place. Contact ROI Compliance for a quote after a short intro call.
Hand off the Qualified Individual role
Schedule a short intro call. We'll talk about what the rule requires and whether a QI plan is the right fit for your dealership.