It is late on a Friday afternoon, and someone in accounting receives a message that appears to come from a familiar vendor. The vendor says its banking information has changed and asks the dealership to use the new account for a payment that needs to go out before the weekend. The name looks right, the request sounds plausible, and everybody is trying to finish the day.

Your email security may stop that message before it reaches the employee. If it does not, employee training may help the person recognize that something feels wrong. But the final protection may be a dealership process that says banking changes are never accepted through email alone and must be verified using a known phone number.

That is why cybersecurity cannot live entirely inside the IT department. IT can put strong protections in place, but many important security decisions happen during normal work in accounting, F&I, sales, service, the business development center, human resources, and management.

At an auto dealership, IT should own technical safeguards and support, but it cannot own every decision that creates cyber risk. Leadership, department managers, accounting and F&I, employees, and vendors each have specific responsibilities, while one accountable technology partner should help coordinate the whole environment.

The goal is not to make everyone responsible for everything. That usually creates more confusion, not better security. The goal is to make each person's part clear enough that important changes are communicated, unusual requests are verified, and suspicious activity reaches the right person quickly.

Why Cybersecurity Becomes a Leadership Issue

Dealership leaders do not need to manage firewalls or investigate suspicious emails. They do need to set expectations, approve the right safeguards, and make sure every important responsibility has an owner.

A Controller, General Manager, or Dealer Principal may never configure MFA, update a firewall, or remove an old user account. Leadership still decides whether managers are expected to report employee changes promptly, whether payment changes require independent verification, and whether employees feel safe reporting a mistake before it becomes a larger problem.

Leadership also decides whether cybersecurity is treated as an ongoing business responsibility or as a product the dealership already bought. Those are very different approaches. Software can protect systems, but it cannot create a clear offboarding process, decide which vendor should have remote access, or make a department tell IT that an employee changed roles.

For dealerships covered by the FTC Safeguards Rule, the written information security program also reaches beyond software. The exact obligations depend on the dealership's situation, so legal and compliance questions should be reviewed with qualified counsel. From an IT standpoint, the practical point is that responsibility reaches across the business.

What IT Should Own

IT should own the technical controls it is responsible for, explain what those controls cover, respond when employees report a concern, and tell leadership where important gaps or decisions remain.

Depending on the dealership's environment and agreement, that may include email protection, endpoint security, patching, MFA, Microsoft 365 security, backups, network security, monitoring, remote access, user accounts, and technical incident response. IT should also help leadership understand which systems sit outside its direct control, including the DMS, CRM, OEM portals, lender platforms, payroll systems, and other vendor-hosted applications.

Good IT support should make the boundaries clearer rather than hiding behind them. If the dealership asks whether MFA covers every important account, whether recovery has been tested, or which vendors have remote access, the answer should be understandable. If a system belongs to another company, IT should still help determine who needs to be involved and what the dealership needs to know.

What IT cannot do is make every business decision in isolation. It cannot decide who should approve a payment, whether a salesperson still needs access to a lender portal after changing roles, or whether a new vendor is permitted to handle customer information. IT can advise and implement, but the dealership has to provide the business decision and the information behind it.

What Leadership Should Own

Leadership should set the standard, assign authority, fund the priorities, and make it clear that verification and early reporting matter more than avoiding inconvenience or embarrassment.

Employees take their cues from management. If a Dealer Principal or General Manager regularly asks employees to ignore verification steps because a request is urgent, people learn that speed matters more than the process. If someone is criticized for pausing to verify a message that turns out to be legitimate, the next employee may decide not to ask.

The opposite is also true. When leadership backs an employee who stopped a questionable payment, reported an accidental click, or questioned an unusual login request, the dealership becomes easier to protect. Employees do not need permission to be suspicious of everything, but they should know that a reasonable pause will be supported.

Leadership should also insist on clear ownership. Who approves access to sensitive systems? Who tells IT when someone leaves? Who can authorize a vendor's remote connection? Who coordinates an incident that involves the cyber insurance carrier, legal counsel, the DMS company, and the dealership's IT provider? These decisions should not be invented during an emergency.

What Department Managers and HR Should Own

Managers and HR should tell IT about employee starts, departures, and role changes early enough for access to be added, adjusted, or removed across the systems that employee actually uses.

A dealership employee may have access to more than a computer and email. Depending on the job, that person may use the DMS, CRM, OEM systems, lender portals, payroll or HR applications, vendor websites, shared mailboxes, document storage, building systems, or remote-access tools. IT may manage some of those accounts, while a department manager or outside vendor manages the rest.

That makes employee changes a business process as much as a technical task. When someone leaves, changes departments, takes on new responsibilities, or no longer needs a vendor account, the manager closest to the role is often the first person who knows. A simple, consistent notification process helps IT and other account owners act on that information instead of learning about it later.

Managers should also review access based on the work an employee actually performs. The question is not whether the employee is trusted. It is whether the account has more access than the role requires and whether the dealership would know to remove that access when the role changes.

What Accounting and F&I Should Own

Accounting and F&I should own the business verification steps around money, customer information, and unusual requests. IT can protect the communication channel, but it cannot decide whether a transaction is legitimate.

The Friday-afternoon banking request is a good example. Email filtering, MFA, and endpoint security can reduce risk, but none of those controls can confirm that a vendor truly changed its payment instructions. The employee needs a process for verifying the request using contact information already on file, not a phone number or link supplied in the questionable message.

The same principle applies when someone requests customer information, asks for a password reset, changes a direct-deposit account, or wants access to a financial platform. A convincing email is not the same thing as authorization. The dealership should decide which requests need independent confirmation and who has authority to approve them.

Those steps should be practical enough that employees can follow them on a busy day. If the process requires five approvals for every ordinary request, people will eventually work around it. The useful control is the one that slows down the unusual, high-impact request without making normal work unnecessarily difficult.

What Every Employee Should Own

Employees should follow the dealership's verification process, pause when a request feels unusual, and report possible mistakes quickly. They are an important layer of protection, but they should not be expected to investigate incidents on their own.

Today's phishing messages can look like normal business. An employee may see a Microsoft 365 sign-in page, an OEM notification, an updated invoice, a document related to a deal, or a message that appears to come from management. The sender may use familiar names, timing, and language because the goal is to make the request feel routine.

Telling employees to be careful is not enough. They need to know who to contact, how to verify a request, what to do if they already clicked, and how quickly they should report it. The reporting path should be simple enough to use without searching through an old policy or wondering whether the issue is serious enough.

Employees also need to know that early reporting is useful, even when they made the mistake. If someone fears being embarrassed or blamed, that person may wait and hope nothing happens. IT can do more with a prompt, honest report than with a problem that stayed hidden for several hours.

What Outside Vendors Should Own

Each vendor should secure and support the platform or service it provides, but the dealership still needs to know where the vendor's responsibility ends and how that company fits into the larger response.

Dealerships depend on a long list of outside companies. The DMS provider owns its platform, the internet company owns the connection it provides, and other vendors may support phones, CRM, payroll, copiers, cameras, websites, or specialized applications. Each company should be accountable for the service it controls.

The difficulty begins when an issue crosses those boundaries. A suspicious login may involve Microsoft 365, an employee device, a vendor account, and a security tool managed by different companies. A service interruption may begin with the internet connection but affect cloud applications and phones. The dealership should not have to diagnose the whole chain before anyone helps.

This is where an accountable IT partner adds value. Even when another vendor owns the underlying fix, someone should help gather the facts, contact the right companies, explain the business impact, keep leadership informed, and follow the issue until there is a clear answer.

Shared Responsibility Should Not Mean Blurred Responsibility

Cybersecurity works better when responsibilities are shared deliberately, documented in plain English, and coordinated by someone who can see across departments and vendors.

Saying that cybersecurity is everyone's responsibility is directionally right, but it can become an excuse for leaving ownership vague. If everyone assumes someone else reported the employee departure, verified the vendor, reviewed the remote account, or called the insurance carrier, the dealership can still end up with a gap.

The better approach is to define the handoffs. A manager reports the employee change. Leadership approves the business decision. IT handles the accounts and technical controls within its scope. The employee reports anything suspicious. The relevant vendor handles its system. One accountable partner helps coordinate the entire response when several pieces are involved.

That is consistent with the governance direction in the NIST Cybersecurity Framework 2.0, which emphasizes establishing and communicating cybersecurity roles, responsibilities, and authorities. A dealership does not need to turn the framework into a complicated project to benefit from the basic idea: people should know what they own and where to go when an issue crosses boundaries.

A Practical Three-Step Plan

I would keep the first pass simple. The goal is not to create a large policy manual. It is to remove the most important assumptions from everyday dealership work.

1. Assign the Important Responsibilities

Write down who approves access, who reports employee changes, who verifies banking and payment requests, who can authorize vendor access, who receives suspicious-email reports, and who coordinates an incident. Use names or job roles that employees will recognize, not vague phrases such as 'management' or 'the security team.'

2. Give Employees One Clear Reporting Path

Employees should know exactly how to report an unusual message, accidental click, unexpected MFA prompt, lost device, or questionable request. Make the path easy to use and give them a backup method in case email is the system affected.

3. Review the Handoffs

Walk through a few ordinary situations: a salesperson leaves, an F&I manager changes roles, a vendor asks for remote access, accounting receives new payment instructions, or an employee reports a suspicious login. If the group cannot explain who acts next and how the task gets completed, that is the part to fix.

Questions Dealership Leadership Should Be Able to Answer

A Controller, General Manager, or Dealer Principal does not need to know every technical detail. Leadership should, however, be able to get clear answers to questions like these:

  • Who has authority to approve access to sensitive dealership systems?
  • How does IT learn about new employees, departures, and job changes?
  • Which requests involving money or customer information require independent verification?
  • What should an employee do after clicking a suspicious link or approving an unexpected MFA prompt?
  • Which vendors can access dealership systems or information, and who reviews that access?
  • Who coordinates the response when an issue involves more than one vendor?
  • How does leadership receive a plain-English summary of what happened, what was protected, and what should happen next?

If the answer to one of those questions is unclear, that does not automatically mean the dealership has a serious cybersecurity problem. It does mean there is an assumption worth replacing with a simple, documented answer.

What Good Cybersecurity Ownership Looks Like

The best outcome is not a dealership where every employee studies cybersecurity. It is a dealership where people can do their jobs, the right technical protections are in place, unusual requests receive a second look, and employees know how to get help without hesitation.

Leadership should not have to chase five companies to find out what happened or personally supervise every security task. The Controller should be able to ask whether access was removed, whether a request was verified, or whether an incident was contained and receive a clear answer from someone who owns the follow-through.

That is the difference between saying cybersecurity belongs to everyone and having a dealership where the important responsibilities are actually covered.

Frequently Asked Questions

Does every dealership employee need cybersecurity training?

Employees should receive practical training that matches the situations they are likely to encounter, including phishing, unexpected login prompts, unusual payment requests, password handling, and reporting mistakes. Training is most useful when it is reinforced by a clear process employees can follow during the workday.


Is IT responsible when an employee clicks a phishing link?

IT should provide appropriate safeguards, respond quickly, investigate, and help contain the problem. The larger question is whether the dealership created several layers of protection, including technology, employee guidance, reporting, and a tested response process, rather than expecting one person or product to prevent every incident.


Who should lead dealership cybersecurity?

Leadership should assign authority and accountability, while a qualified internal or external technology professional manages the technical program and coordinates the work. For dealerships covered by the FTC Safeguards Rule, the dealership should confirm its legal obligations and required roles with qualified counsel.


How often should cybersecurity responsibilities be reviewed?

Review them whenever the dealership changes vendors, adds a location or major system, changes department leadership, or significantly changes employee roles. A regular review is also useful because access, applications, and responsibilities tend to drift even when the business appears stable.

Get Clear About Who Owns What

Cybersecurity should not become one more responsibility that dealership leadership has to supervise across departments and vendors.

Tech Marvel combines dealership IT experience with over 30 years of technology expertise to help New Jersey dealerships reduce downtime, strengthen cybersecurity, coordinate technology vendors, and get clear answers from one accountable local partner.

For dealerships in Morris County and Northern New Jersey, we can help review your current safeguards, employee-access process, vendor responsibilities, reporting path, and incident-response handoffs. The goal is to show leadership what is already working, where ownership is unclear, and what should happen next.

Schedule Your Free 20-Minute Dealership IT Review

We will talk through your current environment, recurring concerns, cybersecurity priorities, vendor relationships, and any responsibilities that still seem to fall between departments or providers.

Not ready for a review? Get the Plain-English Guide to the IT Questions Every Dealership Should Ask Before Switching Providers and use it to start a clearer conversation with your current IT company.