FTC Safeguards Rule
What an Ohio auto dealership must have in writing — and how CIT ships it under one per-endpoint contract.
Dealerships that extend or arrange credit are 'financial institutions' under the Gramm-Leach-Bliley Act. The Safeguards Rule requires a written Information Security Program — not a binder of policies, but a program that runs. CIT wraps every required element into the same per-endpoint contract as the helpdesk and the SIEM.
Qualified Individual
Designate a single qualified individual to oversee the program. CIT's Security Engineer serves as — or backs — the Qualified Individual, with a named primary on the contract.
Risk assessment
Identify foreseeable internal and external risks to customer information and assess the sufficiency of existing safeguards. CIT runs a documented annual risk assessment and re-runs it on material change.
Safeguards to control risk
Implement technical and administrative safeguards: access controls, authentication, encryption of customer data in transit and at rest, and secure disposal. These map to the eight operational layers already on the endpoint.
Monitor and test
Regularly test and monitor the effectiveness of safeguards. CIT's 24/7 endpoint monitoring, SIEM correlation, and quarterly security review satisfy the testing requirement on a continuous cadence.
Oversee service providers
Select service providers capable of maintaining safeguards and require them by contract to do so. CIT maintains a vendor inventory with contractual safeguard clauses and review dates.
Evaluate and adjust
Evaluate and adjust the program in light of testing, monitoring, and material changes to operations. The annual report drives the adjustment cycle.
Written report to the board
The Qualified Individual writes a report — at least annually — to the board, controlling partner, or owner. CIT drafts and delivers the report on the dealership's cadence.
Incident response plan
Maintain a written incident response plan that has been exercised — not just drafted. CIT's Premium tier includes an incident-response retainer and an annual tabletop exercise.
Technical safeguards
MFA for customer-data systems, encryption, secure development practices, and disposal of customer data within two years of last use. CIT enforces MDM, EDR, and patch policy to meet the technical bar.
Every element above ships inside the per-endpoint contract — the same helpdesk, SIEM, EDR, and patch cadence the dealership already pays for. No separate compliance retainer, no binder that lives in a drawer. The annual report is the output of the program that runs all year.
Talk to an engineer about your programNot legal advice — pair this guide with counsel familiar with the rule and Ohio breach-notification statutes.