The ‘Senior Officer’ Requirement

As we approach the end of the year, every dealership and financial institution must fulfill one of the most critical administrative requirements of the Safeguards Rule: the Annual Report to the Board. Miss this, and the FTC has a clear paper trail showing that leadership was not engaged in your security program.

The Exact Regulatory Text: 16 CFR 314.4(i)

The rule states:

“Require your Qualified Individual to report in writing, regularly and at least annually, to your board of directors or equivalent governing body. If no such board of directors or equivalent governing body exists, such report shall be timely presented to a senior officer responsible for your information security program. The report shall include the following information: (1) The overall status of the information security program and your compliance with this part; and (2) Material matters related to the information security program, addressing issues such as risk assessment, risk management and control decisions, service provider arrangements, results of testing, security events or violations and management’s responses thereto, and recommendations for changes in the information security program.”

That is not guidance. That is federal regulation. Every word matters.

Who Receives the Report?

The rule establishes a clear hierarchy:

• If you have a board of directors: The report goes to the board. For dealer groups with a corporate board structure, this is straightforward.
• If you have an “equivalent governing body”: This could be a management committee, ownership group, or partnership council that functions as the decision-making authority for the business.
• If neither exists: The report must go to a “senior officer responsible for your information security program.” For most single-point dealerships, this is the dealer principal, general manager, or whoever holds ultimate authority over business operations and has accepted responsibility for the security program.

The key point: someone with actual authority must receive and acknowledge this report. You cannot file it in a drawer. The FTC wants proof that leadership is informed and engaged.

The Small Business Exemption

Under 16 CFR 314.6, the annual board report requirement under 314.4(i) does not apply to financial institutions that maintain customer information concerning fewer than 5,000 consumers. The same exemption covers the written risk assessment format (314.4(b)(1)), continuous monitoring or periodic penetration testing (314.4(d)(2)), and the written incident response plan (314.4(h)).

However, most dealerships will exceed the 5,000 consumer threshold quickly. Consider that this count includes every customer whose information you hold, not just active buyers. Service records, financing applications (approved or denied), trade-in records, and warranty claims all contribute to that number. A dealership processing 50 deals a month accumulates 5,000 records in under nine years, and that excludes service-only customers.

If there is any question about whether you meet the threshold, assume you do.

What the Report Must Cover

The regulation specifies two categories of required content. Here is what that looks like in practice:

1. Overall Program Status and Compliance

• Is the Information Security Program current and active?
• Are all nine elements of 16 CFR 314.4 implemented?
• Have there been any gaps identified, and what is their remediation status?
• Is the Qualified Individual still in place and actively overseeing the program?

2. Material Matters

• Risk Assessment Results: Summary of the most recent risk assessment, key threats identified, and how they are being mitigated
• Risk Management Decisions: What controls were implemented, modified, or accepted as residual risk
• Service Provider Arrangements: Status of vendor assessments under 314.4(f), any vendors added or removed, and compliance gaps identified
• Testing Results: Findings from penetration tests, vulnerability scans, and any other security assessments conducted during the reporting period
• Security Events and Violations: Any incidents, near-misses, or policy violations, along with how management responded
• Recommendations for Changes: Budget requests, staffing needs, technology upgrades, or policy revisions needed for the coming year

What Makes a Report “Meaningful” vs. a Rubber Stamp

The FTC has emphasized through its guidance and enforcement actions that compliance must be substantive, not performative. A one-page memo that says “everything is fine” will not survive scrutiny. The report should:

• Be specific: Reference actual test dates, actual findings, actual vendors assessed
• Show evidence of action: If last year’s report recommended MFA deployment, this year’s report should confirm it was implemented
• Quantify risk: Use severity ratings, remediation timelines, and trend data
• Document leadership engagement: Include a signature or acknowledgment from the board member or senior officer who received the report, along with the date of presentation
• Address deficiencies honestly: A report that identifies no issues is either incomplete or dishonest. Both are red flags for auditors.

Sample Report Structure

A compliant annual report should follow a structure similar to:

1. Executive Summary: Two-paragraph overview of program health and key developments

2. Program Status: Current state of all nine elements of 314.4, with compliance status for each

3. Risk Assessment Summary: Threats identified, risk ratings, and mitigation status

4. Testing Results: Penetration test and vulnerability scan findings with remediation timelines

5. Security Events: Incident log for the reporting period, including response actions taken

6. Vendor Oversight: List of assessed service providers, assessment dates, and findings

7. Metrics and Trends: Year-over-year comparisons (incidents, vulnerabilities found, training completion rates)

8. Recommendations: Prioritized list of changes, investments, and resources needed

9. Acknowledgment Page: Signature block for the receiving officer or board, with date

Timeline Recommendations

• Q3 (July through September): Begin compiling testing results, incident logs, and vendor assessment data
• Q4 (October through November): Draft the report, incorporate year-end projections, and finalize recommendations
• December (or your fiscal year-end): Present to the board or senior officer, obtain signed acknowledgment, and file

Do not wait until December 28th to start pulling data together. A rushed report reads like a rushed report, and an FTC examiner will notice.

The Enforcement Reality

This report is your best defense against “willful neglect” charges. If the FTC investigates your dealership following a breach or complaint, the annual report is one of the first documents they will request. It proves that leadership was informed of risks, that the program was being actively managed, and that resources were being allocated to security.

The absence of a report, or the presence of a clearly performative one, tells the FTC that security was not a priority for leadership. Under the FTC Act, civil penalties can reach $50,120 per violation, and each day of non-compliance can be treated as a separate violation.

If your report is a one-page memo, you are not doing it right. If your report does not exist, you have a much bigger problem.