At a glance
- Who it's for
- Dealers that finance or arrange financing and need a written security plan. Other small businesses can read along.
- Rule
- 16 CFR Part 314
- Preview
- Free, watermarked
- Signed plan
- Essentials, $99 per store a month
On this page
What goes in a dealer WISP
| Section | What it says | Rule |
|---|---|---|
| Qualified Individual | Who runs the program, and who oversees them if the role is outsourced | 314.4(a) |
| Risk assessment | The risks to customer data and how each is handled | 314.4(b) |
| Access and inventory | Who can see what, and every system and device that holds customer data | 314.4(c)(1), (2) |
| Encryption and MFA | How data is encrypted, and MFA on every system | 314.4(c)(3), (5) |
| Disposal | When and how old data is destroyed | 314.4(c)(6) |
| Changes and logs | How changes are approved and activity is logged | 314.4(c)(7), (8) |
| Testing | How controls are tested or monitored | 314.4(d) |
| Training | Who is trained, on what and how often | 314.4(e) |
| Vendors | How service providers are picked, bound by contract and reviewed | 314.4(f) |
| Incident response | The written plan, required at 5,000+ consumers | 314.4(h) |
| Yearly report | The report to the owner or board, required at 5,000+ consumers | 314.4(i) |
| FTC notice | What happens after a breach of 500+ consumers | 314.4(j) |
Why a generic WISP template falls short
Most free WISP templates were written for accountants or tax preparers. They don't name a DMS, a CRM, a credit bureau or an e-contracting portal, and they don't say where paper deal jackets are kept. The rule asks for a program based on your own risk assessment, so a plan that describes someone else's office doesn't help you when it matters.
A dealer WISP should name your real systems, say who has the keys, and match what your staff actually do at the desk.
How the CarShots WISP is written
We wrote a clause library from the rule text. Your answers decide which clauses apply, and AI only fills in the parts about your own systems, people and controls. It never writes legal language. A checker confirms every required part of 314.4 is in the plan before it can be signed.
The preview here is free and watermarked. With Essentials, the owner signs the final plan, names the Qualified Individual, and the plan stays current as your systems change.
Keep the plan current
The rule asks you to adjust the program after testing, after a material change to your business, and when your risk assessment changes (314.4(g)). A new DMS, a new F&I vendor or a new store is a reason to update. Review it at least yearly even if nothing changed.
Rules checked and limits
Rules checked October 31, 2026. We read every rule on this page in the eCFR or on the agency's own site, and each is linked in the sources below. We re-check them every quarter.
Templates and tools, not legal advice. CarShots is software, not a law firm. For a question about your own dealership, ask your attorney or your state dealer association.