Restrict employee access to only the information they truly need to perform their job functions. For example:

• Service technicians don’t need access to customer financing documents
• Accounting personnel may not need access to driver’s license information
• Parts department staff shouldn’t have access to credit applications

For electronic systems, implement logging that records:

• Who accessed customer information
• When the access occurred
• What actions were taken with the data

For physical documents, establish check-in/check-out procedures similar to a library system to track document handling.

Deploy systems that can identify and alert you to:

• Unusual access patterns
• Login attempts outside normal business hours
• Multiple failed login attempts
• Access from unexpected locations

As your information security program evolves, document how access privileges are adjusted. This includes:

• Procedures for requesting new access
• Approval workflows for changing permissions
• Documentation of all access changes

When employees join or leave your dealership:

• Establish clear protocols for granting initial access
• Immediately revoke all access upon employee departure
• Regularly audit user accounts to remove outdated access

Identify who has administrator-level access to your systems and:

• Restrict admin privileges to only essential personnel
• Use separate admin accounts for daily operations
• Regularly audit administrative actions

Determine how long to keep customer data based on:

• Regulatory requirements
• Business needs
• Risk assessment findings

Then establish secure methods for disposing of information when it’s no longer needed.