Safeguards Compliance Program (Basic)

The Basic Safeguards Compliance Program fulfills the new training requirements of the revised FTC Safeguards Rule. If you already have other Safeguards in place, but need to fill in gaps in your information security program you’ll have access to additional a la carte services.

Security Awareness Training

All employees must take annual Security Awareness Training. We’ll manage and deploy it for dealers.

Qualified Individual Training

Every dealership needs a Qualified Individual to oversee the implementation of Safeguards. Ongoing training provides what they need to know.

Access to a Customized Solution and Preferred Pricing

Already have Safeguards in place? Gain access to a la carte Safeguards options and preferred pricing to meet any remaining requirements.

Written Information Security Program (WISP) Document

Mosaic’s team of retail automotive compliance attorneys will craft your written information security program, which includes all the policy documentation you need to comply with the FTC’s revised Safeguards Rule.

Tailored Compliance Training for All Dealership Personnel

Dealership personnel has to deal with a myriad of laws that govern their day-to-day activities, but how can they follow laws they don’t even know exist? They can’t! It is a reasonable expectation of both an employer and a consumer, that employees know the laws and how to follow them in the context of their role at the dealership.

Online Training Based on Job Description

Mosaic offers learning paths for: General Managers, Compliance Officers, Sales Managers, Sales Consultants, BDC, Accounting Office, IT Personnel, and General Employees.

Searchable, Archived Test Results and Usage Records

Management gets access to a supervisor dashboard where they can access and review all kinds of archived system activity via audit logs.

Customizable Reporting

Produce custom reports on any user, object, or action within your portal.

Online Policy Documents

Online policy documents for:

• Employee Handbook
• F&I Policy & Procedures
• Sales Policy & Procedures
• Identity Theft Prevention Program (Red Flags)
• Military Lending Act Policy (upon request)

Fair Credit Policy and Program

Dealers can choose from NADA’s policy or the Mosaic-created option. Includes the policy template and online training about the policy based on the policy selected.

Service Provider Oversight

Dealers must select and retain service providers that satisfactorily protect their customer information. Mosaic helps identify service providers and collect their data protection policies for review.

Identification

Mosaic helps the dealer identify service providers and collects the proper Safeguards paperwork on behalf of the dealer. Under the revised Safeguards Rule, “dealers must take reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue.”

Service Provider Library

Mosaic collects signed service provider agreements or equivalent documentation from each service provider and then makes these documents available for the dealership’s QI in our online Safeguards portal. This portal includes a digital library of the dealer’s service providers’ agreements that can be reviewed or downloaded.

Ongoing Guidance

Mosaic also provides ongoing guidance and support regarding the monitoring of dealers’ service providers.

Enhanced Safeguards

Risk Assessments

Confidently conduct assessments, run reports, and manage risk over time through the SecurityStudio platform. Leverage the power of continuous risk management to save time and keep your data secure.

Annual Reporting

SecurityStudio makes the required annual report a simple task. SecurityStudio’s robust risk assessment platform empowers you to generate your annual report anytime, with a click.

Active Risk Management

The SecurityStudio platform allows you to manage and prioritize risks and assists you in developing a plan to mitigate risks over time.

Additional Options

“Variable Cost” Cyber Requirements

These optional services fulfill the remaining requirements of the Safeguards Rule. They are considered variable costs because they are priced according to the size of your dealership's computer network.

Endpoint Detection and Response

AgileBlue detects and stops cyber threats quickly and accurately across your entire digital infrastructure and cloud. You get 24/7 monitoring from a team of cyber security experts (SOC), so you can sleep at night knowing you are well protected.

• Dealers with continuous cyber protections like EDR, reduce costs from a breach by 70%
• 24/7 threat monitoring
• Defends against cyber attacks
• Expert humans do the work

Vulnerability Scanning

Nodeware provides complete and continuous visibility of your network, its assets, and the vulnerabilities that put your business at risk—all while running silently in the background during normal business hours.

• Daily scanning of network devices
• Identifies existing weak points
• Recommends steps to improve

Multifactor Authentication & Encryption

The Rule requires you to implement MFA for any individual accessing any information system and encrypt customer information both in transit and at rest. At a minimum that will mean your CRM, DMS, and email. Typically your DMS and CRM will already have MFA functionality and be encrypted. Mosaic has partnered with trusted managed service providers to help implement a tailored solution for your encryption and MFA needs. Often, your existing managed service provider will be able to provide guidance and implement a solution for you.