At a glance
- Rule
- 16 CFR 314.4(a)
- Who can hold it
- An employee, an affiliate or a service provider
- Small dealers
- Required at any size
- Certification
- None named in the rule
On this page
What the rule says
Section 314.4(a) asks you to designate a qualified individual responsible for overseeing, implementing and enforcing your information security program. The person can be your employee, an employee of an affiliate, or a service provider.
The rule does not name a degree or a certification. Pick someone who understands your systems, has the time, and has the authority to make people follow the plan.
Who it usually is at a dealership
- At a small independent: the owner, the general manager or the office manager, with help from the IT company.
- At a larger store or group: a controller, an IT manager or a dedicated compliance manager.
- Outsourced: a managed IT or security firm that takes the role by contract.
If an outside company holds the role
You can hand the role to a service provider, but under 314.4(a) you then must:
- Keep responsibility for complying with the rule yourself.
- Name a senior member of your own staff to direct and oversee the Qualified Individual.
- Require the provider to keep its own security program that protects you.
Put all three in writing: in the appointment letter and in your contract with the provider.
What the Qualified Individual does
- Runs the program day to day and keeps it current (314.4(g)).
- Approves, in writing, any control used instead of MFA (314.4(c)(5)), and any compensating control where encryption is not feasible (314.4(c)(3)).
- At 5,000+ consumers, reports in writing to the owner or board at least yearly on the program's status and material matters (314.4(i)).
- Makes sure staff are trained and vendors are reviewed.
The appointment letter
Write the appointment down: who holds the role, from when, what they are responsible for, and, if outsourced, who on your staff oversees them. In CarShots Compliance the owner signs a Qualified Individual letter with the security plan, and the outsourced version adds the oversight terms above.
Rules checked and limits
Rules checked October 31, 2026. We read every rule on this page in the eCFR or on the agency's own site, and each is linked in the sources below. We re-check them every quarter.
Templates and tools, not legal advice. CarShots is software, not a law firm. For a question about your own dealership, ask your attorney or your state dealer association.