IT challenges dealerships face
Dealerships collect Social Security numbers, credit applications and driver’s license data every day, run on dealer management systems that have to be available from open to close, and operate across sales, F&I, service, parts and the back office. Attackers know it — dealerships have become a frequent ransomware target.
- FTC Safeguards Rule obligations — Dealers that arrange financing are financial institutions under the rule and must maintain a written information security program.
- DMS and OEM connectivity — Your dealer management system, OEM portals and lender platforms have to stay reachable all day.
- Busy, shared workstations — Sales desks, F&I offices and service writers sharing devices in fast-moving environments.
- Long hours and weekends — Showrooms open evenings and weekends when traditional IT support isn’t.
How we support dealerships
- Compliance
FTC Safeguards Rule support
MFA, encryption, access controls, monitoring, vulnerability scanning and written policies that support your information security program and qualified individual.
MFA · encryption · WISP - Network
Showroom and service drive networks
Reliable, segmented networks for sales, F&I, service, guest Wi-Fi and cameras, with firewalls monitored 24×7.
Firewalls · Wi-Fi · VLANs - Systems
DMS and OEM application support
We keep workstations, printers and connectivity working for your DMS, OEM portals and lender platforms, and work with your vendors when issues cross over.
Vendor coordination - Security
Ransomware protection
Managed detection and response, email security and phishing training that stop the attacks dealerships see most.
MxDR · email security - Backup
Backup and recovery
Backups of servers, files and Microsoft 365 with tested recovery so an incident doesn’t close the store.
Backup · DR - Support
Help when the store is open
A service desk staffed 5 AM–6 PM on weekdays and the same local team is on call 24×7 for emergencies, including weekends.
24×7 emergencies
Meeting the FTC Safeguards Rule
The FTC Safeguards Rule requires covered dealerships to designate a qualified individual, assess risk, and put safeguards such as MFA, encryption, access controls, monitoring and staff training in place — and to report to the board. As your IT partner we implement and document the technical safeguards, run vulnerability scans, and give your qualified individual the reporting they need. Our own operations are SOC 2 Type II attested, which matters when you have to oversee your service providers.
DMS, OEM systems and the Safeguards Rule in practice
A typical dealership runs on a dealer management system such as CDK, Reynolds and Reynolds, Tekion or Dealertrack, plus OEM portals and diagnostic tools in the service bays, a CRM, F&I menu software, credit bureau and lender connections, key management systems and phones tied to the BDC. Many of these vendors require specific network settings or dedicated connections, and diagnostic laptops often have to reach the OEM directly.
The June 2024 cyberattack on CDK Global showed how much depends on one system: thousands of dealers across the country worked on paper for days. Planning for that matters — offline procedures for sales and service, copies of key reports and a clear picture of which systems still work when the DMS is unreachable.
The FTC Safeguards Rule sets the baseline for customer data. Since May 13, 2024, it also requires covered dealers to notify the FTC within 30 days of discovering a breach of unencrypted information involving 500 or more customers. We separate the service drive, showroom guest Wi-Fi and back office from each other, enforce MFA, monitor every device with managed XDR and keep the evidence your qualified individual needs. Read how we support a dealership day to day in our car dealership case study.
Why Dealerships choose CAL IT Group
- Response
A real engineer in under a minute
96%LIVE of calls answered by an engineer in under 60 seconds, and a 20-minute engineer response on every ticket — numbers we publish live on our homepage, because we’re proud of them.
Live metrics · fully transparent - Security
SOC 2 Type II attested
Our own operations are independently audited across all five Trust Services Criteria, and our full security stack with 24×7 NOC & SOC monitoring is included in Managed Care.
24×7 NOC & SOC - Local
Your team, in Huntington Beach
Over 10 years in business, grown 100% organically, with a 100% local team that learns your dealership, your applications and your people — with on-site support included.
No call center - Pricing
One all-inclusive per-user price
Help desk, monitoring, security and backups in one predictable monthly price, published on our website — no surprise invoices.
See your price
Related services: security and compliance, managed XDR and vulnerability management.