{"version":1,"type":"rich","provider_name":"Libsyn","provider_url":"https:\/\/www.libsyn.com","height":90,"width":600,"title":"S13 E7 9 Steps to Secure Your Dealership to Comply with FTC Safeguards Rules","description":"On today\u2019s episode I am joined by Brad Miller, Chief Regulatory Counsel for Digital Affairs and Privacy at NADA, and James Crifasi, CTO at RedZone Technologies.  Brad and James are presently working together with car dealerships and other businesses to translate the recently revised FTC Safeguard regulations about data security and privacy into practical action plans.  Here are the 9 key areas that were discussed in the conversation about what car dealerships must comply with prior to December 9th 2022.  \u201cDetermine the right person to implement and oversee company\u2019s information security program.\u201d \u201cConduct a risk assessment.\u201d \u201cDesign and implement safeguards to control the risks identified through your risk assessment.\u201d \u201cRegularly monitor and test the effectiveness of your safeguards.\u201d \u201cTrain, educate, and test your staff.\u201d \u201cMonitor your service providers.\u201d \u201cKeep your information security program current.\u201d \u201cCreate a written incident response plan.\u201d \u201cRequire your Qualified individual to report to your Board of Directors.\u201d  As a CIO and Business IT Leader here are some wins you will get by listening: (3:52) Brad Miller: \u201cThe type of data financial institutions is so sensitive that they have to have special obligations with respect to this information.\u201d  (3:55) Brad Miller: \u201cOne side is the privacy rule...you have to tell the consumers what you\u2019re gathering and what you\u2019re going to do with it. The other half is the Safeguards Rule where you have to take steps to protect this information.\u201d  (6:45) Brad Miller: \u201cWhat resulted was a rule that came out about a year ago, it\u2019s a mix of technical steps, contracts, policies, and training that companies have to do just as a minimum to meet your obligations.\u201d  (7:35) Brad Miller: \u201cThe FTCs looking for a way to move the market forward, to really push data security across the board.\u201d  (9:05) Brad Miller: \u201cIf you don\u2019t think data security is part of your core competency, you have to make it one.\u201d  (10:25) James Crifasi: \u201cIn the Safeguards, there\u2019s a lot of room for what\u2019s called the qualified individual or whoever is in charge of the IT security program.\u201d  (12:57) Brad Miller: \u201cDealers are buttoning up their internal systems but need to make sure those third parties are doing the things they can.\u201d  (16:20) James Crifasi: \u201cThis DMS provider just won\u2019t budge. What do I do?\u201d  (17:46) Brad Miller: \u201cDealers shouldn\u2019t assume that just because you\u2019re dealing with someone larger means they\u2019re probably further along.\u201d  (21:15) Brad Miller: \u201cWhat makes it particularly difficult for dealers?\u201d  (29:33) James Crifasi: \u201cWe want to keep the business side progress going as much as the security side.\u201d  (31:36) Brad Miller: \u201cWe\u2019re living in an age where the FTC is very, very activist.\u201d  (31:53) Brad Miller: \u201cWe want people to do as much as they can as far as they can by the deadline, then continue plowing forward.\u201d  (39:42) James Crifasi: \u201cAdvances in cars are going to start making security more important.\u201d  (41:35) Bill Murphy: \u201cThe most inexpensive way to raise your security profile is to educate and train your employees.\u201d (43:15) Bill Murphy: \u201cWhat does a written response plan look like?\u201d (44:42) Brad Miller: \u201cThink beforehand what you\u2019re going to do in the event of an issue and then practice.\u201d  (48:34) James Crifasi: \u201cWhen it comes to incident response plan and training, more attention to not assuming people know what the right thing to do is because naturally people don\u2019t know the right thing to do.\u201d   Key Resources:  RedZone Technologies  National Automobile Dealers Association (NADA)  \u201cData Security and Privacy: What Dealers Need to Know\u201d  \u201cFTC Issues Guidance on the Revised Safeguards Rule: The Time for Dealers to Act is Now\u201d  \u201cA Dealer Guide to the FTC Safeguards Rule\u201d  \u201cDrive Down Your Cyber Risk and Stop Breaches\u201d  \u201cFTC Safeguards Rule: What Your Business Needs to Know\u201d ","author_name":"Bill Murphy's RedZone 10X Podcast","author_url":"https:\/\/redzone10x.net\/podcast","html":"