Dick Smith Automotive turns FTC compliance into a proactive security model

About Dick Smith Automotive

Dick Smith Automotive is a multi-location dealership group serving communities across the Carolinas. The organization handles sensitive financial data every day as part of the car-buying process, including loan applications, credit checks, and personal identity information. A lean IT team of five, led by CIO Craig Barnes, supports everything from networking and infrastructure to security, collaboration, and user support.

The Challenge

The FTC Safeguards Rule changed how dealerships are required to protect consumer data. The shift was not about adopting new tools, it was about implementing structure through documentation, reporting, training, and visibility.

Before managed security, Craig and his team did their best to stay ahead of security needs while supporting every part of day-to-day IT. There simply was not enough time to investigate and address every potential risk. As Barnes put it, "We were just busy day by day and made a lot of assumptions. We took some risk mainly because we were so busy." With a compliance deadline approaching, consistent monitoring could no longer be optional.

The Solution

The relationship deepened after Craig attended a Katalyst Security Summit, which gave him clarity on security maturity, FTC expectations, and the value of long-term strategy over quick fixes.

Security analysis and roadmap

Katalyst started with a Security Analysis and Roadmap that provided visibility into vulnerabilities, prioritized remediation, and created a realistic path to improve posture over time. "It gave us levels of things we needed to attend to. We could attack the high-level risks immediately and lower our exposure," Barnes said.

Managed security, simplified licensing, and resilient backups

Managed security services added consistent support, monthly reporting, and advisory guidance for decisions affecting network health and compliance. A Meraki Enterprise Agreement simplified licensing and budgeting, and Rubrik improved backup speed and recovery without adding operational overhead.

The Results

The partnership delivered clear operational and security advantages while the internal team kept control of priorities.

Monthly reporting gave Craig's team actionable insight into vulnerabilities, trends, and remediation priorities, so issues get addressed before they become urgent. The Meraki Enterprise Agreement consolidated renewal timelines into a predictable three-year model aligned to automotive budgeting cycles, with license portability that allows hardware refreshes without buying new licenses. Rubrik delivered a clear backup and recovery strategy with fast restores. Most importantly, managed services created breathing room: "It allowed us to do our normal jobs instead of worrying about security on a moment to moment basis," Barnes said.

Key Takeaways

• Compliance is a structure problem. Meeting the FTC Safeguards Rule took documentation, reporting, and monitoring, not just new tools.
• Visibility drives better decisions. Monthly managed security reporting surfaced risks early and set clear remediation priorities.
• Predictable licensing and backups. A Meraki Enterprise Agreement and Rubrik simplified budgeting and strengthened recovery.
• Reactive to proactive. A lean team of five gained room to focus on strategic projects instead of daily firefighting.