By Ron Conti, Owner and Founder of Tech Marvel
Somewhere in your Safeguards Rule paperwork there's a line that says "Qualified Individual," and next to it there's either a name nobody remembers agreeing to or a blank. For many dealerships, the Controller ends up holding it by default. You approve the budget, you answer the insurer's questions, and when someone asks who owns the information security program, everyone looks at you.
That's a lot to carry when you're also closing the month. It's also why the question comes up: can our IT company take that role?
Yes. The FTC Safeguards Rule allows a dealership's Qualified Individual to be employed by a service provider, including a managed IT provider. The dealership still keeps responsibility for compliance, must name a senior person on its own staff to oversee the outside Qualified Individual, and must require the provider to maintain an information security program that protects the dealership.
Our FTC Safeguards Rule checklist for auto dealerships covers the rule's other requirements in more detail. This isn't legal advice, and your attorney should confirm how the rule applies to your dealership.
What Does the Qualified Individual Do?
The Qualified Individual oversees, implements and enforces the dealership's written information security program and reports on it in writing at least once a year.
In plain terms, this is the person who makes sure the program is real and current. That covers the risk assessment, the safeguards that come out of it (access controls, multi-factor authentication, encryption, monitoring), testing, employee training, service provider oversight and the written incident response plan. The rule also lets the Qualified Individual approve certain alternatives in writing, such as a reasonably equivalent control where multi-factor authentication isn't used.
Then there's the report. The rule requires the Qualified Individual to report in writing, regularly and at least annually, to the dealership's board or, if there isn't one, to a senior officer responsible for the program. The report covers the program's overall status and material issues such as risk decisions, testing results, service provider arrangements and security events.
For a Controller, the question is whether anyone on staff has the time and technical background to do that well, every year, while the dealership changes around them.
What the Safeguards Rule Says When a Provider Is a Dealership's Qualified Individual
The rule allows an outside Qualified Individual but sets three conditions the dealership must meet.
According to 16 CFR 314.4(a), when a service provider or affiliate fills the role, the dealership must:
- Retain responsibility for compliance with the rule.
- Designate a senior member of its own personnel to direct and oversee the Qualified Individual.
- Require the service provider to maintain an information security program that protects the dealership.
Read those carefully. If a provider takes the role, the dealership still owns the outcome, still needs a named senior person who stays involved, and has to hold the provider to a standard in writing.
What Stays With the Dealership
The dealership keeps the business decisions, the oversight and the parts of the program only its own people can carry out.
An outside Qualified Individual can run the technical side of the program well. Your dealership still decides which risks to accept, approves the budget for safeguards, and sets the business processes the technology can't enforce on its own. Who in accounting verifies a change to a vendor's banking information? Who tells IT the day an F&I manager gives notice? Who decides whether a new marketing vendor gets access to customer data? Those decisions belong to dealership leadership.
The senior person who oversees the Qualified Individual is usually the Controller, GM or Dealer Principal. That role takes no technical skill. The overseer reads the reports, asks questions when something is unclear, and makes the decisions the reports call for.
How to Set Up an Outside Qualified Individual
Put the appointment, the oversight and the provider's own security obligations in writing before the provider starts.
A workable setup covers five things:
- A written designation naming the Qualified Individual and the provider they work for.
- A named senior person at the dealership who oversees that individual, with a regular meeting on the calendar.
- Contract language requiring the provider to maintain an information security program that protects your dealership, as the rule requires.
- A clear list of what the Qualified Individual handles and what stays with dealership staff, such as payment verification and employee change notices.
- A date for the written annual report and who receives it.
The cyber insurance questionnaire is a good test of the setup. If your Qualified Individual can answer it accurately, with evidence for each control, the arrangement is working. Our article on what cybersecurity controls dealerships need for cyber insurance covers what insurers commonly ask.
What It Looks Like When the Program Isn't Owned
An information security program without an active owner tends to surface during an incident, when the dealership has the least time to sort out responsibilities.
Several years ago, we worked with a dealership that went through a cybersecurity incident that significantly disrupted its operations. Recovering took far more than restoring systems. The management team spent considerable time coordinating the response with vendors and insurance companies, restoring operations and reviewing security measures. The dealership recovered, but the biggest cost was the disruption and the time it took leadership to work through it.
Without a clear owner, you end up chasing recurring IT problems, vendor finger-pointing, and unanswered security or backup questions that should already be handled. And the Controller who thinks, "I'm not the IT person, but somehow these problems keep ending up on my desk," ends up owning the program by default.
Get Clear on Who Owns Your Safeguards Program
A short review shows who holds the Qualified Individual role today, what the program covers, and where ownership is unclear.
Technology should help your dealership sell, finance, service, and deliver vehicles, not create more work for the people leading the business. The Safeguards Rule doesn't have to land on one overloaded person.
We understand how frustrating it is when technology problems interrupt the workday, vendors point fingers, and leadership still has to chase down clear answers. Tech Marvel combines dealership IT experience with over 30 years of technology expertise to help New Jersey dealerships reduce downtime, strengthen cybersecurity, coordinate technology vendors, and get clear answers from one accountable local partner. Tech Marvel can serve as a dealership's Qualified Individual, help prepare the annual report, and run vulnerability scans and penetration tests with the results in writing. We also carry cyber liability and errors and omissions insurance, which is worth asking any outside Qualified Individual about. Your attorney still confirms the legal side, and your dealership keeps responsibility for compliance. Our compliance and data protection page covers that work in more detail.
The first step is a short review. We look at your systems, vendors and risks with you, and if it makes sense, you get one local IT partner who owns the outcome. For dealerships in Morris County and Northern New Jersey, you leave with your top risks ranked, quick wins for the next 30 days, and what to plan and budget for over the next 6 to 12 months. The result is a smoother, safer dealership where sales, service, finance, accounting, and management can work with clear answers and dependable local IT support.
Schedule Your Free 20-Minute Automotive IT Risk Review
Not ready for a call? Get the Dealership IT Buyers Guide
Frequently Asked Questions
Does the Qualified Individual have to be a dealership employee?
No. The rule allows the Qualified Individual to be employed by the dealership, an affiliate or a service provider. If you use a service provider, the dealership keeps responsibility for compliance and must designate a senior employee to oversee that person.
Who receives the Qualified Individual's annual report?
The dealership's board of directors or equivalent governing body. If there isn't one, the report goes to a senior officer responsible for the information security program. It must be in writing and happen at least annually.
Should our Qualified Individual work for the same company that manages our IT?
It's common and practical, since that provider already knows your systems. The tradeoff is that the provider is partly reviewing its own work. Ask for vulnerability scan and penetration test results in writing, read the annual report closely, and have your senior overseer ask questions about anything that looks unchanged from last year.
Does appointing an outside Qualified Individual make the dealership compliant?
No. It fills one required role. The dealership still needs the rest of the program in place and still owns compliance. Confirm your obligations with your attorney.
