FTC Safeguards readiness you can keep proving — across every rooftop.
Dealerships hold consumer financial information across DMS, F&I workstations, CRM, shared printers and a network that also carries showroom Wi-Fi and lot cameras. AssurIQ gives the qualified individual, the group IT team or the MSP one place to see the environment, prove the safeguards and fix what is exposed.
- CVSS base9.8
- EPSS0.94
- Known exploited (KEV)Yes
- ExposureInternet-facing
- Asset criticalityEdge firewall
- Compensating controlNone
- Age11 days
- 3 controls affected — AIQ-NET-011, AIQ-VUL-001, AIQ-NET-014 move to FAIL
- Frameworks — FTC Safeguards, NIST CSF 2.0, Cyber Insurance Baseline
- Blast radius — every VLAN behind the edge, incl. F&I workstations
- Remediation — firmware update queued · validation rescan on completion
The pressures are specific. So is the platform.
A designated qualified individual, a written risk assessment, access controls and MFA, encryption, monitoring, service-provider oversight, incident response and reporting to the board.
Several stores, shared vendors, a DMS provider, and technicians who are rarely on site. Inventory drifts the moment someone plugs in a new device.
Lot cameras, guest Wi-Fi, F&I workstations and service-bay diagnostics often share segments they should not.
DMS, CRM, digital retailing and lender integrations each handle customer data. Oversight has to be documented, not assumed.
Capabilities that map to your obligations.
Identity & MFA
Asset inventory per rooftop
Vulnerability & configuration risk
Service-provider oversight
Evidence & risk assessment support
Remediation with validation
Board & qualified-individual reporting
Continuous verification
The finance manager's admin account without MFA is a Safeguards finding.
AssurIQ reads the identity provider directly, ranks privileged accounts without MFA as high-risk findings, maps them to the access-control and MFA requirement areas, and validates the fix by reading the provider again.
- Privileged M365 / Entra ID and AD accounts inventoried
- Legacy authentication and stale credentials surfaced
- Control state changes when MFA is actually enforced
- svc-backup@brightpathGlobal AdminNo MFA
- j.reyes@brightpathGlobal AdminMFA enforced
- legacy-scanDomain Admin (AD)Password 412d old
- kiosk-frontdeskUserLegacy auth allowed
A lot camera on the corporate VLAN shows up as a change — and a control failure.
The collector's topology snapshots catch the device crossing a segmentation boundary. The segmentation control drops to FAIL with the evidence attached, and the remediation item already knows which switch port to correct.
- Topology change narrative with the port and VLAN involved
- Segmentation and exposure controls updated automatically
- Fix validated by the next snapshot
| Control | State | Confidence | Latest evidence |
|---|---|---|---|
AIQ-IAM-002 MFA enforced for privileged cloud identities | Fail | 96 | Identity connector · 2h ago |
AIQ-NET-011 Internet-facing services free of known-exploited CVEs | Fail | 98 | Collector scan · 40m ago |
AIQ-END-004 Endpoints run supported operating systems | Partial | 88 | Asset inventory · 1h ago |
AIQ-BCK-001 Backups tested for restore within policy window | Evidence Gap | — | No evidence attached |
AIQ-NET-003 Guest / IoT traffic segmented from corporate VLANs | Pass | 92 | Topology snapshot · 40m ago |
A board report the qualified individual can stand behind.
Readiness against the Safeguards requirement areas, evidence gaps still open, exceptions and their expiry, vendor reviews due, and remediation trend — generated from live evidence as a point-in-time snapshot.
- Security Risk, Assurance and Operational Health kept separate
- Evidence attached, not just percentages
- Shareable with scoped, expiring auditor access
- Evidence gaps reduced 14 → 6; backup restore proof still open
- Privileged MFA moved PARTIAL → PASS and held for 61 days
- 1 approved exception expires in 41 days
- Collector coverage 97% of known subnets
Summit Ridge Ford (fictional)
A dealership group managed by the fictional Northline MSP, with a sales floor, F&I office, service bays and a lot camera network — and a set of realistic problems to work through.
- Internet-facing edge firewall with a known-exploited CVE ranked as the top risk
- Lot camera moved onto the corporate VLAN via a config change
- Overdue service-provider assessment for the DMS vendor
- Executive report showing what changed this quarter
Common questions
Does AssurIQ make us FTC Safeguards compliant?+
We use an MSP. Who runs AssurIQ?+
How does this fit with our DMS vendor's security?+
AssurIQ provides continuous assurance, readiness, evidence, risk and remediation support. It does not certify an organization as compliant, a passing dashboard is not a legal determination, and AssurIQ does not make breach-notification decisions. Framework mappings use original AssurIQ summaries, not reproduced standard text.
Manage the endpoint. Understand the infrastructure. Prove the controls.
Explore the connected platform, or talk with the AssurIQ team about a controlled Windows RMM pilot. No production data is required to explore the fictional sandbox.