Sometimes it takes an epiphany moment to understand the gravity of a threat.
That was certainly the case for a dealer who called me recently. He was enjoying a relaxing family vacation when he got a call from a bank representative asking about a questionable charge on his credit card. But after providing more and more confidential information to straighten things out, the dealer started to get suspicious.
His instinct was right. As it turns out, the shady charge was just a pretext to get him to willingly divulge his passwords, security question responses, and PINs in an effort to gain deeper access to his finances. Fortunately, he recognized the ruse early enough to get off the phone with the scammers and enlist the help of his actual bank, which helped lock down his accounts.
The entire episode was a wake-up call.
This dealer thought he understood the risk of a data breach, at least in the general sense. But it wasn’t until he personally became the victim of a well-orchestrated scam that he really saw the full picture. If the bad actors were willing to work this hard just to get his information, there’s no telling what they would do to unlock the treasure trove of customer data in his dealership.
It’s time to see data security as the imperative that it is – and to build a culture of compliance that reflects that reality. Customers want it. Regulators demand it. Here’s how dealers can deliver it.
The Problem: A Data Breach Is Only a Matter of Time
“We haven’t gotten hit, so everything must be OK.”
This is one approach to data security that dealers can take. The lack of a major incident, after all, would certainly seem to imply that whatever mitigation and prevention efforts are in place are working. But there’s one word missing from that sentence: Yet.
It doesn’t take a doom-and-gloom outlook to acknowledge that a data breach is eventually coming. It just takes awareness of the reality of the current security climate. The latest major DMS attack to rattle the industry, for example, is just that – the latest. It isn’t the first and it won’t be the last.
Even well-prepared dealerships can fall victim to a breach. And the damage can be far-reaching, encompassing:
- Regulator fines
- Customer lawsuits
- Reputational damage
That’s why resting on the laurels of a so-far, so-good record won’t cut it anymore.
The Remedy: A Comprehensive Compliance Framework
Staying one step ahead in the ever-growing threat landscape requires a thorough privacy and safeguards program. And building and maintaining such a program in your dealership – one that covers detection, response, recovery, remediation, and revision – involves several key steps:
- Establish a safeguards team to implement, oversee, and enforce your program.
- Conduct (and document) initial and periodic risk assessments.
- Based on that assessment, write a comprehensive information security program.
- Train your team on the required privacy and safeguards topics.
- Conduct regular phishing tests to uncover your program’s vulnerabilities.
- Vet all vendors with access to customer data and make sure they understand your program’s requirements.
- Monitor, limit, and actively manage access to customer information.
- Evaluate your IT capabilities to ensure that you can implement things like multi-factor authentication, encryption, and continuous monitoring.
- Build an incident response plan to assist in responding, reporting, and remediating a security breach.
- Write an annual report to detail responsibilities and requirements under your program.
This final step – the annual report – may seem like just one more regulatory requirement. But it can actually serve as a valuable tool for organizational improvement and risk management.
The Annual Report: Accountability, Compliance, and Insight
The annual report represents the culmination of your dealership’s privacy and safeguards compliance efforts. As such, it should ideally include…
- Risk assessment findings.
- A risk management overview.
- Service provider performance.
- Security events and responses.
- Recommended changes.
In other words, a well-documented annual report should provide a comprehensive snapshot of the efforts your dealership is taking to mitigate the risks of a data breach for you and your customers. In doing so, it can also provide several other benefits:
- Accountability at the highest level of your dealership. When leadership reviews security practices regularly, information security is transformed into a boardroom issue, rather than simply an IT concern.
- A clear snapshot of your information security program for regulators. In the event of an audit or investigation, a well-documented annual report demonstrates your commitment to compliance.
- Valuable insight into whether additional resources or support are needed. If the annual report identifies significant risks, leadership will have the information it needs to make an informed decision about allocating funds to address these vulnerabilities – well before they result in a breach or a compliance violation.
Turn Compliance into Your Competitive Advantage
It’s an unavoidable reality for dealerships: A data breach is a matter of when, not if. And given the regulatory, monetary, and reputational risks that a breach entails, it’s a threat that demands the aggressive, proactive approach of a comprehensive compliance program.
The good news is that developing and implementing this type of program doesn’t have to be just a defensive move. By clearly demonstrating that your dealership takes data security seriously, you can develop a culture of compliance that represents not just the fulfillment of a regulatory requirement, but a real customer benefit as well.
Related Stories:
