Managed IT and FTC Safeguards Security for Montana Auto Dealers
Information Systems of Montana (ISM) provides managed IT, 24/7 security monitoring and backup for Montana auto dealerships. If your store arranges financing or leases, the FTC Safeguards Rule treats you as a financial institution. We put the required technical controls in place, document them for your written information security program, and keep your DMS, F&I office and service drive running.
ISM is an associate member of the Montana Automobile Dealers Association, and we are a local Montana team that has protected Montana businesses since 1995.
What the FTC Safeguards Rule requires of dealers
The FTC applies the Safeguards Rule to most auto dealers that finance or lease vehicles. The amended rule took full effect June 9, 2023. Among other things, it requires:
Not sure where your gaps are?
Schedule a free dealership Safeguards Rule review.
-
A written information security program (WISP) and a designated Qualified Individual to run it
-
A written risk assessment
-
Access controls, multi-factor authentication and encryption of customer information
-
Continuous monitoring, or an annual penetration test plus vulnerability assessments every six months
-
Security awareness training for staff
-
Oversight of service providers, including your DMS and other software vendors
-
A written incident response plan and an annual report to ownership or the board
-
Notice to the FTC within 30 days of discovering a breach of unencrypted information involving 500 or more consumers
The risks Montana dealerships face
Dealerships hold Social Security numbers, driver's license images, credit applications and bank details for every financed deal. In June 2024, cyberattacks on CDK Global took dealer management systems offline at thousands of North American stores, and many wrote deals by hand for days. The risks we see most:
-
Ransomware and DMS outages that stop sales, F&I and service at the same time
-
Phishing and fake wire instructions targeting the business office
-
Shared logins in sales, F&I and service that fail the Safeguards Rule's access requirements
-
Customer and guest Wi-Fi in the showroom and service lounge sharing a network with business systems
-
Paper deal jackets and scanned documents stored without encryption
-
Multiple rooftops spread across a big state with no consistent security standard
How ISM protects your dealership
Every managed plan includes the security layers below, built into the price instead of sold as add-ons:
-
24/7 threat monitoring and response from a staffed security operations center, which supports the rule's continuous monitoring option
-
Backup with off-site redundancy and tested restores, plus a written plan for working through a DMS or vendor outage
-
AI-powered email protection against phishing and fake wire instructions
-
Multi-factor authentication and individual logins across sales, F&I, service and the business office
-
Encryption of customer information on devices and in storage
-
Separate, secured networks for customer Wi-Fi, business systems and shop equipment
-
Technical input for your WISP, risk assessment and annual report, plus vendor oversight records
-
Consistent standards across every rooftop you own
Protecting Montana businesses since 1995
11.1-year average client relationship
Best of Montana five years running
Named to the CRN 2026 MSP 500 and the MSP 501
Titans of the Industry nominee two years running
Frequently Asked Questions
If your dealership arranges financing or leases vehicles, almost certainly yes. The FTC treats those dealers as financial institutions under the Gramm-Leach-Bliley Act. The amended Safeguards Rule took full effect June 9, 2023, and requires a written information security program, a Qualified Individual, multi-factor authentication, encryption, monitoring, training, vendor oversight and an incident response plan.
The rule lets you name an employee or use a service provider, but your dealership stays responsible for compliance either way. Many dealers name a senior manager as the Qualified Individual and rely on an IT partner like ISM to run and document the technical controls and supply the facts for the annual report.
The rule requires either continuous monitoring of your systems, or an annual penetration test plus vulnerability assessments at least every six months. ISM's 24/7 monitoring from a staffed security operations center supports the continuous monitoring option, and we can arrange testing when you want it or your insurer asks for it.
You cannot control your vendor's security, but you can control how badly an outage hurts you. We help you plan for working through a DMS or vendor outage, keep your own systems and backups protected, and document vendor oversight as the Safeguards Rule requires. The June 2024 CDK Global attacks showed why that planning matters.
Our security operations center works to contain the threat and we restore systems from backup. If unencrypted information for 500 or more consumers was acquired, you must notify the FTC within 30 days of discovery. Montana law (MCA 30-14-1704) also requires notifying affected Montana residents and the Attorney General's Office of Consumer Protection. We give you and your counsel the technical facts quickly.
Yes. ISM is an associate member of the Montana Automobile Dealers Association and works with dealers statewide, from single-point rural stores to multi-rooftop groups. Most support is delivered remotely, security monitoring runs 24/7, and our local Montana team handles on-site work when it is needed.
Talk to a Local Montana Team
Schedule a free dealership Safeguards Rule review. We will look at your security, backups and compliance gaps and tell you plainly what to fix first.
