A dealership CFO should ask whoever runs IT ten plain questions about ownership, access, testing, insurance and the cost of a week down. A good answer names a person, a date or a dollar figure. A vague one names a feeling.
Last updated: November 2, 2026
Ask the person who runs IT at most dealerships whether the store is secure, and you’ll usually hear some version of “Yeah, we’re good.” I believe they mean it. But that answer gives a CFO nothing to put in front of an auditor, an insurer or a lender, and over more than 20 years with Helion I’ve watched the distance between “we’re good” and what’s actually written down show up at the worst possible moment.
The risk itself has moved, too. When I started, the IT risk a finance team cared about was uptime: slow systems, the internet down at the body shop again, a server that needed a reboot every Monday. That still happens, and it’s still annoying. It isn’t what worries me most anymore. Access is. A dealer group today runs the DMS, Microsoft 365, a CRM, a phone system, F&I menus, OEM portals and something like 100 vendors in all, and every one of those systems keeps its own list of who can log in and what they can see. Pull that data into an AI tool and the question gets harder, because the AI will show people whatever it’s been given access to.
Erik Nachbahr, our founder and president, describes our conversations with leadership teams as a second opinion rather than a sales pitch. That’s the right frame. Most of the people signing the checks can’t easily tell whether the security they’re paying for is the right security, or whether the money is going where it should. These questions are how you find out without needing a CISSP yourself. I have one. You shouldn’t need it.
If you want the bigger picture of what a dealership cybersecurity program covers, start there. This post is the short list a CFO can take into a 30-minute meeting.
What Dealership CFO IT Risk Actually Covers
Dealership CFO IT risk is the financial exposure that comes from how the store’s systems and data are run: who can reach customer and deal data, what stops if a key system or person is gone, whether the controls have actually been tested, and how much of a loss insurance would really cover.
Some of this already lands on the finance side. Nobody planned that. The FTC Safeguards Rule requires the dealership’s Qualified Individual to report in writing, “regularly and at least annually,” to the board or its equivalent, covering the state of the security program, risk assessments, test results and security events (16 CFR 314.4(i)). At most stores that report goes to the dealer principal and the CFO. The FTC’s own FAQ for auto dealers makes clear that a dealer arranging financing is a financial institution under the rule, so very few franchised stores sit outside it.
I’d treat that report as the start of a program you can operate and defend, not a form someone signs once a year. The odds aren’t small. In CDK Global’s 2024 dealer cybersecurity survey, 35% of auto dealers reported a cyberattack or incident that year, and 92% of those said it caused real financial or operational damage.
The written report is the floor. Your questions are the rest of the building.
Ten Questions to Put to Whoever Runs IT
I’ve kept these in plain language on purpose, so you can ask them of your IT manager, your outside provider or both in the same room. Listen less for the technical detail and more for the shape of the answer. Specific answers have names, dates and numbers in them. Vague ones have adjectives.
1. Who owns each system, by name?
Not which vendor. Which person. Your DMS, Microsoft 365, the CRM, the phones, the firewall, and the shop network that lets technicians reach the manufacturer’s systems securely. Each one should have a name next to it, plus a second name for the weeks the first person is out.
A good answer is a list IT can hand you today. A vague answer sounds like “we all kind of handle that,” or it puts a vendor’s name where a person’s should be. Ownership is the word I come back to more than any other with dealer groups, because the systems nobody owns are the ones nobody’s watching.
2. Who can see customer financial data, and when did someone last check?
The Safeguards Rule calls for “implementing and periodically reviewing access controls,” so that people reach only the customer information they need to do their jobs (314.4(c)(1)). Note the word reviewing. Something like “we went through DMS roles in September and removed the accounts nobody could explain” is a real answer. “Everyone has what they need” usually is true, and that’s exactly the trouble, since most people have far more than they need.
While you’re on the subject, ask whether multi-factor authentication is on for every account that touches customer data. The rule requires it for anyone accessing an information system, with an exception only where the Qualified Individual approves an equivalent control in writing. If there’s an exception, ask to see the writing.
3. What happens to someone’s access the day they leave?
Dealerships turn over salespeople faster than almost any business I know. Every departure leaves logins behind in the DMS, the CRM, email, the F&I menu system and the OEM portals, and sometimes a personal phone with company mail still on it. A good answer describes a process tied to HR that shuts every login off before the person’s last shift ends, with a checklist and someone who confirms it’s finished. “The manager lets us know” is the vague version.
Sometimes the manager does.
4. What data have we given AI tools, and who said yes?
This is the newest question here and the one I’d push hardest on. Cox Automotive’s AI in Auto Retail Tracker found that 82% of dealers already use AI, which means your data is probably sitting in an AI tool already. Maybe several. Once it’s connected, the access question changes shape: an assistant set up with broad permissions can answer a salesperson’s question with figures pulled from a file that salesperson was never meant to open.
The answer you want has three parts. There’s a list of approved tools, there’s a named executive who approves new ones (at a smaller store that’s often the CFO), and the connections are set up so each tool reaches only the data it needs. Our posts on setting up a dealership AI governance committee and on least-privilege access for AI tools go deeper on both. If the answer is “nobody here really uses AI,” ask the department heads. You’ll get a different answer.
5. If our IT person were out for a month, what stops?
I don’t mean quits. I mean surgery, a family emergency, a long trip that was planned a year ago. In a lot of dealer groups the honest answer is that some things would simply wait, because the know-how for the firewall, the vendor portals and the odd setup at the third rooftop lives in one person’s head, and that person has been too busy fixing things to write any of it down. For a CFO, that’s a single point of failure sitting on the payroll.
No blame here. Most of the IT people I meet are carrying more than one person should. A good answer points to documentation the dealership owns and a second set of hands, whether that’s another employee or a team behind them. That’s the point of co-managed IT: your IT manager stays in charge and stops being the only one who knows. Our post on co-managed IT for truck dealer groups covers where the admin passwords should live. If you’re adding that other employee, our IT manager job description lists the duties and interview questions.
6. What did we last test, and what did it find?
Unless the dealership has effective continuous monitoring, the Safeguards Rule calls for a penetration test every year and vulnerability assessments at least every six months (314.4(d)(2)). We run human-led penetration testing annually and vulnerability monitoring twice a year for our clients.
Listen for “we passed.” It’s vague. A penetration test doesn’t produce a pass. It produces findings, and the good answer gives you the date, who ran it, what they found and which findings are already fixed. If the last test was before your newest rooftop opened, it didn’t test that rooftop.
7. What does our cyber insurance actually cover?
One of the largest public dealer groups in the country put its own numbers on this after the June 2024 DMS outage. In its quarterly filing with the SEC, it reported cybersecurity insurance coverage of $15.0 million with a $2.5 million deductible, and warned that any insurance recoveries “may not occur for several quarters or longer.” That’s a big group with a finance team built for this. Read yours the same way.
Ask IT and your broker together: what’s the limit, what’s the deductible, what would a claim need from us, and which controls did we list on the application? If MFA, backups or endpoint detection were on that application, someone should be able to show you today that they’re in place everywhere. Ask your broker what happens to a claim if one of them isn’t.
8. What would a week down cost us?
Nobody likes this one. CDK Global’s 2023 State of Cybersecurity in the Dealership study put average downtime after a dealership cyberattack at 3.4 weeks, and Anderson Economic Group’s revised July 2024 estimate put franchised dealers’ direct losses from the three-week DMS outage that June at $1.02 billion.
A good answer is a per-day number that finance and IT worked out together: deals not funded, F&I income, repair orders, pay guarantees so the sales staff doesn’t walk. It also names which systems come back first and how long a restore really takes, because somebody tested it. Write the number down. Our guides to dealership backup and disaster recovery and to planning for a DMS outage cover the IT side of that number.
9. Who makes the call during an incident, and is it written down?
The rule requires a written incident response plan designed to “promptly respond to, and recover from, any security event” (314.4(h)). I care less about the binder than about one line in it: who decides, and how fast.
We worked with a large dealer group as a consultant and escalation support. We evaluated their environment and recommended they consolidate IT support and standardize process, security controls and platforms across the organization, because the environment as it stood was going to lead to a security incident and enormous business disruption and costs. We presented our approach to leadership, and they did not make any changes. Months later, while we were monitoring some of their systems, we warned them they had an active breach and gave them options for immediate action. They decided to wait and consult other outside parties. Within 24 hours they had a full-scale ransomware attack that took down their entire system, and it took weeks to get back to just basic operations.
They had the warning. They waited. Open your incident response plan and look for the name of the person allowed to take systems offline without calling a meeting first, because if there isn’t one, that decision gets made by a group on a conference call while the attack keeps moving. Find the name.
10. What are we spending on IT and security, and what does each line buy?
Here’s Erik’s second look at the spending. Your home turf. When a group grows one acquisition at a time, its IT bill grows the same way, store by store, and it’s common to find three tools doing parts of one job, two vendors who each assume the other handles backups, and more licenses than people. The good answer is boring. Every line has an owner and a reason, meaning a risk it actually lowers. Then you can cut cost and complexity without adding risk, which is almost always possible once it’s all on one sheet. Our dealership IT budget checklist is a good place to start the list.
If nobody can say what a line buys, it’s buying confusion.
Specific Answers vs. Vague Answers at a Glance
| Question | A specific answer sounds like | A vague answer sounds like |
|---|---|---|
| Who owns each system? | A written list with a primary and a backup name per system | “We all handle that” |
| Who sees customer financial data? | The date of the last access review and what it removed | “Everyone has what they need” |
| What happens when someone leaves? | A checklist tied to HR that ends access on the last day, confirmed by a named person | “The manager tells us” |
| What’s in AI tools? | An approved list, a named approver, scoped connections | “Nobody really uses AI here” |
| IT person out for a month? | Documentation the dealership owns, plus a second set of hands | “He’d be reachable” |
| What was last tested? | Test date, tester, findings and what’s fixed | “We passed” |
| What’s insured? | Limit, deductible and proof of every control on the application | “We have a policy” |
| What does a week down cost? | A per-day dollar figure and a tested restore order | “We’d figure it out” |
| Who decides in an incident? | A name with authority to act, written in the plan | “We’d get everyone on a call” |
| What does each IT dollar buy? | Every line mapped to an owner and a risk | “It’s all necessary” |
When the Answers Come Back Vague
You’ll get a few. We’ve seen it across 2,000-plus dealerships under management: nearly every store has a question here that nobody ever asked out loud. A vague answer usually means it never came up. Nobody’s hiding anything. Dealership IT people tend to be generalists covering networking, phones, security and now AI all at once. One person can’t be a specialist in all of that. A team can.
So treat the vague answers as a to-do list rather than a verdict on anyone. Pick the two that worry you most, give them an owner and a date, and ask again next quarter. If you’d like help with the ones that need specialization, our continuous compliance program turns the Safeguards requirements into something the store runs all year, and a vCIO can own the bigger roadmap with your leadership team.
Simpler, more secure, and easier to support. That’s the test for every fix.
What CFOs Ask Us About IT Risk
Shouldn’t our outside CPA be the one asking these?
Realistically, how often should a CFO run through this list?
Our IT manager gets defensive. How do we ask without it feeling like an audit?
Is the Safeguards report enough on its own?
We’re a single rooftop. Does all of this still apply?
Ask for Names, Dates and Numbers
Write the answers on one page and keep it with the Safeguards report. Next year, ask the same ten questions. Then compare. The page will get more specific every time you ask, and that change is the best measure of risk a CFO can get without becoming an IT expert. If you’d like a second set of eyes on the first version, our complimentary IT and cybersecurity assessment walks through your environment and puts names, dates and numbers next to what we find.
Specific answers are the ones you can defend.