Review the risks behind your systems
Tell us what customer information you collect, where it is stored, who can access it and which vendors handle it. Include your dealer management system, email, payment processing and financing platforms.
Cyber policies differ. Ask about incident response, privacy claims, data restoration, business interruption, ransomware and social engineering. Coverage for one type of cyber event does not mean every fraud loss is included.
Insurance and compliance have different jobs
The FTC’s Safeguards Rule applies to qualifying financial institutions, including many dealers that finance or facilitate consumer financing. It requires an information security program and other safeguards. Buying cyber insurance does not complete those obligations.
Use the FTC’s dealer-specific guidance to review which requirements apply to your business. Your insurer may separately ask about multifactor authentication, backups, employee training and access controls.
Know what to do after an incident
Keep your insurer’s incident-response contact available outside your ordinary email system. After a suspected event, follow the reporting instructions and preserve relevant information. Ask before hiring vendors when the policy requires approval.
At renewal, explain changes in systems, stored records and vendor relationships. A growing finance operation can create a different exposure from the one described in last year’s application.
Keep reading
Sources & resources
Policy wording controls actual coverage.