Safeguards Rule - The Road to Compliance
|
(Gramm-Leach-Bliley Act)
Dealerships must keep all customer information secure and confidential to comply with the Gramm-Leach- Bliley Act. They must protect customers’ data from all security threats and unauthorized access. This roadmap walks you through the steps your dealership should take to achieve total compliance with the GLBA. You can also take a free online survey at plantemoran.com to determine where your dealership is at in its compliance formula. For more information contact:
Raj Patel, technology consulting manager at Plante & Moran PLLC
(248) 223-3428
or raj.patel@plantemoran.com
| 1. Formal Risk Assessment |
- Take inventory of and document all customer– information assets and systems
- Prioritize and classify information assets
- Identify/document all threats to customer data, their likelihood and impact
- Evaluate and improve control environment
- Develop/document policies and procedures to secure information and enforce sanctions
|
| 2. Information Security Program |
- Obtain dealership management’s buy-in
- Appoint a security officer or delegate compliance responsibility
- Define and communicate compliance responsibility
- Establish/document a formal training and awareness program for F&I and sales staff
|
| 3. Vendor Relationship Assessment |
- Identify/document all vendors who access, process and store your customer data
- Assess/document how vendors are protecting customer data
- Review and monitor vendor agreements annually for compliance
|
| 4. Technical Security Management |
- Design a secure network topology
- Develop virus standards and controls
- Perform security testing (external and internal penetration tests) at least annually
- Monitor your security environment by recording transactions and reviewing logs
- Develop security-incident response procedures
|
| 5. Annual Audit and Update |
- Develop an audit strategy
- Perform audits on an annual basis
- Report audit findings to dealership management
- Revise vendor management practices as needed
- Test and revise your security compliance program as needed
|
|
Dealer Job Finder
News Channels