Free Template for Dealers
Incident Response Plan Template for Dealerships
A fill-in plan built on the seven parts the FTC Safeguards Rule requires, ready to edit, print and drill with your managers.
Or download the template as an editable Word file or a printable PDF.
An incident response plan template for dealerships covers the seven areas the FTC Safeguards Rule lists in 16 CFR 314.4(h), from roles and decision authority to communications, fixing the weakness and a review afterward. Fill in the names, print it, then drill it.
Last updated: October 14, 2026
A template gets the plan on paper. A drill makes it work.
Picture the service drive at 7:15 on a Monday morning. The DMS won’t open. The phones are ringing, and the controller wants to know whether anybody has called the insurance company yet, which nobody has, because nobody is sure whose job that is. A 2023 dealership cybersecurity study from CDK Global put the average downtime after an attack at 3.4 weeks. That’s a long time. The first few hours are where a plan earns its keep.
This template gives those hours a script. It follows the seven areas the FTC Safeguards Rule lists for a written incident response plan, in the order you’d reach for them, with blanks for the names, numbers and decisions that belong to your store. It’s free. It’s yours to change. It isn’t legal advice, either. The plan sits inside your wider dealership cybersecurity program, and it only works if the people named in it have practiced it at least once.
One rule before you start. If a name in the plan has left the building, the plan has a hole in it.
Which Dealerships Need a Written Incident Response Plan
Any dealership that arranges financing or leasing counts as a financial institution under the Gramm-Leach-Bliley Act, so the FTC Safeguards Rule applies to it. Cars or heavy trucks, one rooftop or twenty. The test is the same. The written incident response plan is one of the rule’s nine required elements, and paragraph (h) of section 314.4 spells out what it has to cover.
Size changes one thing. Under section 314.6 of the rule, a dealership that keeps customer information on fewer than 5,000 consumers doesn’t have to put the plan in writing. That’s the only break. It still has to deal with an incident when one happens, though, and the FTC breach notice applies at every size, so a short written version is worth the hour it takes.
Small store or not, write it down anyway.
Fewer than 5,000 consumers
The written plan is optional for you, along with the written risk assessment, the fixed testing schedule and the annual report to your board. The 30-day FTC notice for a breach involving 500 or more consumers still applies.
A one-page version of this template still pays off.
5,000 consumers or more
The plan has to exist in writing and address all seven areas. A store that has financed cars for a few years usually crosses this line once the old deal files are counted.
Fill in every section.
In the rule
What the FTC Safeguards Rule Requires in an Incident Response Plan
Section 314.4(h) names seven areas. The wording is yours. Here’s each one, what it looks like at a dealership, and where it sits in the template below.
| Area the rule names | What it means at your store | Where it is in the template |
|---|---|---|
| Goals of the plan | What the plan protects and what counts as an incident, from a locked-up DMS to a stolen deal jacket. | Section 1 |
| Internal response processes | The steps from the first report to the all-clear. Who gets called, what gets unplugged, what gets saved. | Sections 4 and 5 |
| Roles, responsibilities and decision authority | Who runs the response, who can take the network offline and who can approve spending on outside help. | Section 2 |
| External and internal communications | What staff, customers, lenders, your OEM, your insurer and regulators hear, and who tells them. | Sections 3, 6 and 7 |
| Remediation of weaknesses | Closing the hole the attacker used, not just restoring from backup and hoping. | Section 8 |
| Documentation and reporting | A running log of what happened and what you did, written while it happens. | Section 9 |
| Evaluation and revision | A review after every security event, and a plan that changes because of it. | Section 10 |
Areas from 16 CFR 314.4(h), as of October 2026. For the full version of each element, read the nine FTC Safeguards Rule requirements explained.
The template
The Dealership Incident Response Plan Template
Ten sections, in the order you’d reach for them during a bad morning. Each one says what belongs there and leaves blanks for your store’s answers. Use pencil first. Fill it in at one sitting with your general manager, your controller and whoever runs IT, since they’re the people who’ll be named in it. Bring coffee.
Prefer to work offline? Download the editable Word version or the printable PDF. For the long federal reference behind plans like this one, NIST’s incident response guide, SP 800-61 Revision 3, is free to read.
Where Helion fits
For our clients, the security side of this plan is already staffed. Live, US-based analysts watch around the clock, and the same team runs day-to-day IT, so section 3 gets one number for both. Want help with the rest? Start with a complimentary IT and cybersecurity assessment.
Incident response plan Covers 16 CFR 314.4(h)(1) through (7). Owner is your Qualified Individual. Review it at least once a year.
1 Goals and scope
Say what this plan protects and what sets it off. Keep it short. Customer information in the DMS, the CRM, email and the F&I office is in scope, and so are paper deal jackets. Under the rule, a security event is anything that gives someone unauthorized access to those systems or that information, or disrupts or misuses them. A lost laptop counts. So does a ransom note on the parts counter printer.
- Stores and systems covered
- What counts as an incident here
- The plan’s goals, in a sentence
- Version date
Covers 314.4(h)(1).
2 Response team and who decides
Somebody has to be in charge, and at most stores that’s the Qualified Individual, with a backup who can step in when the lead is on a plane. Write in who’s allowed to make the expensive calls too, like taking every store offline, hiring a forensics firm or answering a ransom demand, because those decisions tend to sit until the one person who can say yes picks up the phone. One dealer group we support lost its whole internal IT team, CIO included, overnight when it split from eight stores into three, which is exactly why every role here gets a second name. Our advice on ransomware payments hasn’t changed in years. Don’t pay.
- Incident lead
- Backup lead
- Can take systems offline
- Can approve outside spending, up to $
- Speaks for the dealership
- Rooftop contact at each store
Covers 314.4(h)(3).
3 Contact sheet, printed
Paper matters more here than anywhere else in the plan. When ransomware locks the file server, the contact list saved on it goes with it, so print the numbers and keep one copy in the general manager’s desk and one at the incident lead’s house. Your DMS provider’s support line belongs on the list as well, because vendors get breached too, and truck dealers found that out in 2025 when the Motility DMS breach reached their customers. Check the list twice a year.
- IT and security provider, 24-hour line
- DMS provider support
- Cyber insurer claims line and policy number
- Breach counsel
- Bank fraud line
- FBI field office or IC3
Keep a copy at home with the incident lead.
4 The first hour
The first person to notice may not work in IT at all. It could be a BDC rep whose screen fills with a ransom note, or a title clerk who suddenly can’t get into the DMS, so the opening line of this section is simply who they call. After that, the machine comes off the network but stays powered on, since shutting it down can erase what an investigator needs to see how the attacker got in. Nobody wipes, reinstalls or pays anything until your security team says so. If your IT lead has ten minutes this week, CISA’s StopRansomware guide covers the same ground in more depth.
- How staff report an incident
- Who disconnects what
- Where the first notes go
Covers 314.4(h)(2).
5 Investigate and size it
Once it’s contained, somebody sizes it up, and that means the stores and systems that were hit, the customer records involved, and whether anything was copied out or only locked where it sits. If the trouble started in email, a Microsoft 365 breach assessment shows whether someone is still inside. Write down the day you first knew. The rule counts discovery from the first day any employee other than the attacker knew, so a tech who saw something odd on a Friday and mentioned it on Monday has already spent three of the 30 days the FTC allows for a qualifying breach.
- Systems and stores affected
- Records involved, type and count
- Date and time discovered
- Taken, locked or both
Covers 314.4(h)(2) and 314.4(j)(2).
6 Communications
Rumours move fast in a dealership. By lunch the service drive, the sales floor and a good number of your customers will have heard some version of what happened, so decide now who says what, and give your staff a short, calm script for the phone and the service desk. Customers who need a letter get one in plain English, and the FTC’s Data Breach Response guide includes a model letter to start from. Adapt it to your store. Floor plan lenders, your OEM and your DMS provider may have notice terms in their agreements, and those are far easier to find on a quiet Tuesday than in the middle of an incident. One person talks to reporters, and everyone else knows who that is.
- Staff script owner
- Customer letter owner
- Lender, OEM and vendor notices
- Media contact
Covers 314.4(h)(4).
7 Notification deadlines
A few notices run on hard deadlines, and the FTC’s is the one every covered dealership shares, at 30 days from discovery when unencrypted information on 500 or more consumers was taken. State laws add their own clocks and their own lists of who has to be told, and those depend on where your customers live, which is why a lawyer belongs in this part of the conversation. Don’t guess here. The notification sheet below puts it all on one page.
- FTC notice owner
- States where your customers live
- Insurer notice deadline, from the policy
Covers 314.4(h)(4) and 314.4(j).
8 Recover and fix the weakness
Restoring from backup is what gets the sales floor working again, but it doesn’t close the door the attacker came through, and a store that skips that step can restore itself straight back into the same trouble. Put one name next to checking that the backups are clean before anything gets restored, another next to resetting passwords and multi-factor authentication, and a third next to confirming the hole is actually closed, whether it was a phished login, an old remote-access account or a server that missed a year of updates. Our notes on data backup best practices go deeper on the restore side.
- Who checks the backups
- Who resets passwords and MFA
- Who confirms the fix
Covers 314.4(h)(5).
9 Keep the record
Somebody should be writing things down from the first phone call to the all-clear, including the times, the decisions, who was called, what got unplugged and what it all cost. Your insurer will want that log, and so will anyone who later asks how you looked after customer information during the incident. A legal pad works fine. What doesn’t work is trying to rebuild the timeline from memory a week later, when everybody remembers it a little differently.
- Log keeper
- Where the log is stored
Covers 314.4(h)(6).
10 Review and update
Within a few weeks of any security event, big or small, get the people named in the plan back in a room to talk through what worked, what didn’t and what needs to change, then actually change the plan and put the new date on it. The rule asks for that review after an event. Keep the old versions. Between incidents we’d run a tabletop drill at least once a year, and again after anything that shakes the plan up, like a new store, a DMS conversion or somebody new in one of the named roles.
- Review owner
- Last drill date
- Next review date
Covers 314.4(h)(7).
Section 7, up close
Who a Dealership May Have to Notify After a Breach
Notices are where an otherwise good response tends to go wrong, and it’s almost always over dates. We’d fill this page in before you ever need it, ideally with your lawyer in the room, and keep it right behind the plan. Not every incident triggers every notice, so at the start of each one, go down the list and write a line about why each notice does or doesn’t apply.
The federal notice is the one with a fixed rule. Our guide to the Safeguards Rule breach notification walks through the FTC form field by field. It’s worth the read.
Notification sheet Check each one at the start of an incident. Note why it applies or doesn’t.
FTC Federal Trade Commission
Due no later than 30 days after discovery when unencrypted customer information on at least 500 consumers was acquired without authorization. The notice goes through the FTC’s online form and covers who you are, what information was involved, the dates, how many consumers were affected and what happened. Don’t miss it.
16 CFR 314.4(j).
AG State attorneys general and residents
Each state where affected customers live can set its own deadline, its own threshold for telling the attorney general and its own rules for the customer letter. A dealer group near a state line can face two or three sets at once. Plan for that. Our guide to dealership privacy laws by state lists the clocks for the states we cover.
Check every state on the customer list.
INS Your cyber insurer
The notice clause in your policy sets this clock. Find it today. Some policies only pay for the forensics firms and lawyers the insurer has approved, so call the claims line early. Insurers look hard at preparation too, a point we covered in getting better cyber insurance terms.
Read the notice clause now.
LE Law enforcement
Report to the FBI through IC3 or your local field office. Keep the case number. If an official tells you in writing that public notice would hurt a criminal investigation, your FTC notice says so, and the rule lets law enforcement ask for a delay.
No fixed federal deadline.
BIZ Lenders, your OEM and your vendors
Floor plan lenders, captive finance companies, your manufacturer and your DMS provider can all have notice terms in their agreements. GM, for one, wants a confirmed incident reported within 72 hours, and our guide to OEM cybersecurity requirements covers the others. Find them now and write the deadlines on this page, so nobody is reading contracts at midnight.
Check each agreement.
SEC Publicly traded dealer groups
A public company discloses a material cybersecurity incident on Form 8-K, generally within four business days of deciding that the incident is material. That filing belongs to the group’s securities counsel, but the plan should say who tells them.
Form 8-K, Item 1.05.
Who’s Behind This Incident Response Plan Template
Helion Technologies has worked only with automotive and heavy truck dealerships since 1997. Our security operations center runs on live, US-based analysts watching around the clock, and the same team handles day-to-day IT, because a security incident and an IT outage are usually the same event described by two different vendors. A template is where the plan starts. Practice is what holds it together.
How to Use This Incident Response Plan Template
-
1
Fill in every blank
Use real names and mobile numbers, with a backup for each role. Blanks are where plans fail.
-
2
Print it and store it offline
Keep copies at each store and one at home with the incident lead. Ransomware can lock the only digital copy.
-
3
Run a tabletop drill
Walk through one scenario, like a locked DMS on a busy Saturday, with everyone the plan names. Time it.
-
4
Review it every year
Update it after each drill, each real incident, each new store and each change in a named role. Then reprint it.
Common Questions
Want a second set of eyes?
Bring your filled-in plan to a complimentary IT and cybersecurity assessment. We’ll go through it with you, section by section.
What should a dealership incident response plan include?
Does the FTC Safeguards Rule require a written incident response plan?
How often should we test our incident response plan?
Who should be on a dealership’s incident response team?
When does a dealership have to notify the FTC about a breach?
Who do we call first, our insurer or our IT provider?
Is a free template enough to be compliant?
Some blanks in this plan won’t have an obvious owner at your store. Sorting that out is what a complimentary assessment is for.
Get Your Complimentary IT & Cybersecurity Assessment →