Why the DMS deserves executive attention
A DMS concentrates customer data, vehicle and deal records, financial transactions, service history, employee access, and connections to external providers. A disruption can stop sales, workshop throughput, accounting, and reporting at once. Security should therefore be evaluated as operational resilience, not only as an IT questionnaire.
Identity and access
Require unique accounts, MFA for privileged and remote access, role-based permissions, joiner-mover-leaver processes, session controls, and periodic access reviews. Separate duties for discounts, refunds, finance approvals, user administration, and accounting changes. Log privileged actions and make logs available for investigation.
Integration and supplier controls
Inventory every API key, service account, webhook, marketplace, OEM feed, finance connection, payment provider, and analytics destination. Scope credentials, rotate them, restrict network access where possible, and remove unused integrations. Review subprocessors and vendor notification obligations.
Data protection
Classify personal, financial, vehicle, warranty, and telemetry-related data. Encrypt data in transit and at rest, minimise exports, protect backups, and define retention. Mask sensitive fields in test environments. Validate deletion, correction, access, and export workflows for each relevant market.
Recovery and response
Ask how the vendor detects an incident, communicates it, preserves evidence, restores service, and supports customer notifications. Test backup restoration and a manual operating procedure. A backup that has never been restored is an assumption, not a recovery plan.
Frontline behaviour
Security controls must work at the sales desk, service advisor station, parts counter, and mobile device. Use short training, clear escalation, phishing-resistant MFA where practical, and a simple way to report suspicious activity without fear of blame.
Procurement evidence
Request independent assurance, vulnerability management, penetration-testing scope, incident history, uptime and recovery objectives, logging retention, data location, and a named security contact. Record exceptions and compensating controls rather than accepting vague “enterprise-grade” claims.
Related dealer software guides
Continue the research with these connected guides:
Editorial note: This guide is educational content, not legal, accounting, cybersecurity, or vendor-specific advice. Confirm current requirements and product behaviour for your dealership, market, and contracts before making a decision.
