Australian Dealer Software Security: Govern DMS AI Before Data Leaks

Australian Dealer Software Security: Govern DMS AI Before Data Leaks

Turn on multi-factor authentication, keep every system patched, and run offline backups that you have actually restored in a test. Then build an incident response plan that fits the OAIC’s Notifiable Data Breaches (NDB) timelines. The ASD/ACSC Essential Eight is your roadmap after that, and any AI added to your dealer management system, including MDMS AI, needs its own governance before it touches customer data.

TL;DR:

• For a suspected breach, complete a reasonable, expeditious assessment within 30 calendar days; notify affected people and the OAIC if the breach is eligible.
• Before connecting AI to DMS data, confirm whether vendors can access or reuse customer information, require human oversight, and prohibit training without consent.
• Place DMS and finance systems on separate network segments, isolate workshop diagnostics and cameras, and keep guest wireless entirely outside internal systems.
• Require contracts to confirm dealer ownership, usable data exports, limited extraction fees, breach notification, retention and erasure rules, and documented API access.

Table of Contents

• Why are dealerships such attractive targets for attackers?
• What do the NDB scheme, APP 11 and the Essential Eight require?
• Which technical controls should every dealership enforce now?
• How do you adopt AI in a DMS without exposing customer data?
• How should you run backups, incident response and staff training?
• What should you demand from a DMS vendor on data ownership and exit?
• What is your 90-day security checklist?
• How do you secure on-site servers and dealership hardware?
• Which network security practices suit dealerships best?
• What does regular security auditing look like in a dealership?
• How do you assess third-party integrations and keep monitoring them?
• How should you manage user access and RBAC in a DMS?
• Why do we think security and fast modernization belong together?
• How do we help you run a secure DMS with MDMS AI?
• FAQ
• Sources

Why are dealerships such attractive targets for attackers?

A dealership holds the data criminals want in one place: customer identities, driver licence details, finance and credit applications, VINs and payment records. That combination is useful for identity theft and fraud, which is why a mid-sized dealer gets the same attention as a large retailer. Attackers rarely need anything exotic to get in. The usual entry points are:

• Phishing and business email compromise, where a convincing email to accounts or sales staff leads to stolen credentials or redirected payments.
• Unpatched and legacy software, including old DMS installs and workshop PCs that nobody has updated in years.
• Exposed remote access, such as remote desktop services open to the internet without MFA.
• Weak or shared passwords on admin accounts and vendor logins.

The Australian Institute of Criminology’s Cybercrime in Australia 2025 report found that small-to-medium businesses reported more negative impacts from cybercrime. For a dealer, the damage goes beyond the ransom or the fraud loss. A locked DMS stops sales, workshop jobs and parts orders on the same day, and the reputational cost lingers long after systems come back.

What do the NDB scheme, APP 11 and the Essential Eight require?

Three anchors define what “reasonable steps” look like. First, under the NDB scheme you must run a reasonable and expeditious assessment of a suspected breach, and the OAIC’s NDB scheme guidance sets that assessment at no more than 30 calendar days. If the breach is eligible, you notify affected individuals and the OAIC.

Second, Australian Privacy Principle 11 expects a layered mix of technical and organisational measures, with logs and audit trails, scaled to the nature of your business.

Third, the Essential Eight gives you a prioritized list: patch applications and operating systems, MFA, restrict administrative privileges, application control, restrict Office macros, user application hardening and regular backups. Treat it as the checklist your DMS and dealership network get measured against.

Which technical controls should every dealership enforce now?

Start with the controls that stop the most common attacks, then tighten from there. The ACSC’s small business cyber security guide puts three measures first: turn on MFA, update software and back up your information. Then work toward Essential Eight Maturity Level One.

• MFA everywhere it matters: admin accounts, email, remote access and your DMS login. Stolen passwords stop being enough.
• Patching on a schedule: operating systems, browsers, Office, and the DMS itself. Subscribe to vendor security alerts so critical fixes do not wait for a monthly cycle.
• Endpoint protection: deploy EDR or a managed antivirus with ransomware protections such as controlled folder access, and lock down Office macros.
• Encryption: TLS for every external connection and API, and encryption at rest for databases, laptops and backups.
• Least privilege: staff get the access their role needs and nothing more.

Pro Tip: Run an inventory first. You cannot patch or protect a remote desktop service, old workshop PC or forgotten test server that nobody has listed.

How do you adopt AI in a DMS without exposing customer data?

AI changes the risk picture because staff will paste customer details, deal notes and finance information into it, often without thinking. Personal information entered into an AI tool is still covered by the Australian Privacy Principles. The OAIC’s guidance on commercially available AI products tells organizations to do due diligence before adoption, including whether the vendor can access or reuse your customer data and how human oversight is built in. The regulator has also warned that it may act where customer information is not properly protected.

This applies to MDMS AI and to any third-party AI add-on connected to your DMS or ERP data. Our governance checklist:

• Map the data flow: know what leaves your system, where it goes and who can see it. The ACSC’s AI data security guidance stresses data provenance and trusted environments.
• Prefer private or tightly scoped deployments for finance and identity data where feasible.
• Require contract clauses: no training on your customer data without consent, notice of model changes, and human oversight controls.
• Document risks and supply chain: the National AI Centre’s implementation guidance covers model risks, provenance and transparency.
• Log queries and review outputs for leakage, and reassess model performance and drift on a regular cycle.

Pro Tip: Write a one-page AI use rule for staff: what may be entered into AI tools, what may never be entered, and who approves new tools.

How should you run backups, incident response and staff training?

Backups are your last line of defense against ransomware, and only a restored backup counts. Keep offline copies of critical DMS data and test a full restore on a schedule. The ACSC’s regular backups guide covers tested offline backups and Microsoft 365 configurations.

Build your operational routine around these steps:

1. Keep an incident response runbook that names who decides, who calls the vendor, and who preserves forensic evidence before systems are wiped.
2. Map the runbook to the OAIC’s data breach reporting process so you know what an NDB notification must contain.
3. Run phishing simulations regularly and brief staff on payment-redirection fraud.
4. Offboard leavers the same day and review access for anyone who changed roles.
5. Turn on comprehensive logging and keep the audit trail, since regulators and investigators will ask for it.

Carsales’ security guidance for dealerships makes the same practical points on account audits, unused accounts and staff training. Our own post on audit trails in dealership software goes deeper on logging and evidence.

What should you demand from a DMS vendor on data ownership and exit?

Your contract decides who controls your data when something goes wrong or when you change systems. The AADA’s Dealer Data and Software Systems Framework sets out explicit dealer rights to access and export data, secure storage and encryption, reasonable costs for extraction, and vendor obligations on security and API access. Use it as your procurement baseline:

• Ownership and export: the dealer owns the data, exports come in usable formats, and exit fees are limited.
• Security attestations: SOC 2 or an equivalent, a subprocessor list and a firm breach notification commitment.
• API access: documented APIs, not a promise that integration “can be arranged”.
• Retention and erasure: written policies on how long data is kept and how it is deleted.
• Vendor access to personal information: who at the vendor can see your customer records, and under what controls.

Our page on dealership data security and data sovereignty explains how we approach data ownership.

What is your 90-day security checklist?

Sequence the work so the biggest risk reductions come first.

1. Days 1 to 7: enable MFA on admin, email and remote access accounts, inventory systems and exposed services, and confirm that backups exist.
2. Weeks 2 to 4: apply critical patches, switch on endpoint and ransomware protections, and schedule a full restore test.
3. Months 1 to 3: rehearse the incident response plan with a realistic scenario, run staff phishing training, and review your DMS contract and any AI vendor terms against the AADA and OAIC points above.
4. Ongoing: track your Essential Eight maturity, subscribe to cyber.gov.au alerts, and review AI governance regularly.

Pro Tip: Assign one named owner to each step with a date. A checklist with no owner is a wish list.

How do you secure on-site servers and dealership hardware?

Cyber controls fail if someone can walk up to the server. Many dealerships still run a server in a back office, a comms cupboard behind the parts counter, or under a desk. Treat that hardware as the asset it is.

Put servers and network gear in a locked room or cabinet with limited key holders, and log who enters. Keep the room away from the showroom floor and workshop dust, and add basic environmental protection such as a UPS and sensible cooling so a power spike does not become an outage. Remove or disable unused USB ports on key machines, and lock BIOS or boot settings so a stranger cannot start the server from their own drive.

Workshop tablets, laptops and handheld scanners are the other exposure. They move around, get left in utes and get lost. Enforce full-disk encryption, screen locks and remote wipe, and keep a register of who holds which device. For offline-capable mobile apps, confirm that locally cached data is encrypted and that a lost device can be cut off from your DMS quickly.

Finally, destroy decommissioned drives properly. Old servers and PCs often carry years of customer records, and selling them untouched is a breach waiting to happen.

Which network security practices suit dealerships best?

A dealership network usually mixes sales PCs, workshop systems, guest Wi-Fi, security cameras, key-cabinet controllers and sometimes diagnostic equipment. Flat networks, where everything can talk to everything, turn one infected laptop into a company-wide incident.

Segment the network. Put the DMS and finance systems on their own VLAN, keep workshop diagnostic tools separate, isolate cameras and building systems, and run customer Wi-Fi on a completely separate path with no route into internal systems. Firewall rules between segments should allow only what each system genuinely needs.

For remote access, use a VPN or a zero-trust access gateway with MFA, and close direct remote desktop exposure to the internet. Give vendors time-limited, logged access instead of a permanent shared login. Staff working from home or checking the DMS from a phone should connect the same way.

Keep the basics current: firmware updates on routers and firewalls, strong Wi-Fi encryption, changed default passwords and DNS filtering to block known malicious sites. Review firewall rules a couple of times a year, because rules added for a one-off project tend to live forever.

What does regular security auditing look like in a dealership?

Audits catch what daily work misses: the contractor account nobody closed, the admin rights a former manager still holds, the backup job that quietly stopped. Build a calendar so reviews happen whether or not anyone is worried.

A practical rhythm looks like this. Regularly, review privileged accounts and failed login alerts. Check user access against the staff list, confirm patch compliance across sales, workshop and parts machines, and test a restore. Run a broader review against the Essential Eight and APP 11 expectations, and consider an independent penetration test of your internet-facing systems.

Tailor the checks to how a dealership actually operates. Look at who can edit pricing and discounts, who can approve finance paperwork, who can issue refunds or change payment details, and who can export customer lists. Those are the actions fraudsters want, so they deserve the tightest review.

Keep evidence. Dated screenshots, signed-off checklists and exported access reports show regulators and insurers that your steps were reasonable. Our guide to audit trails in dealership software shows how audit trails inside the DMS support this work, and our GST compliance demo checks are a useful companion for the financial side of compliance.

How do you assess third-party integrations and keep monitoring them?

Every integration is a door into your data: accounting links, finance portals, OEM feeds, parts catalogs, payment gateways, telematics, customer portals and AI tools. Most dealers add these over time and rarely look again at what each one can access.

Before connecting anything, ask a short set of questions. What data does the integration read and write? Does it use scoped API keys or a full admin login? Where is data stored and processed? Does the provider hold SOC 2 or equivalent certification, and will it notify you of a breach? What happens to your data if you disconnect?

After go-live, monitor continuously. Keep an integration register listing each connection, its owner, its permissions and its last review date. Rotate API keys, remove integrations you no longer use, and alert on unusual volumes, such as an unexpected bulk export through an API.

Automation tools that handle tasks across email, calendars and other apps deserve the same scrutiny. A workflow assistant such as Otto shows what to look for: published security practices and approval steps before outbound actions. Whatever you choose, keep a human in the approval loop for anything touching customer data or payments.

How should you manage user access and RBAC in a DMS?

Role-based access control (RBAC) is the cleanest way to keep least privilege manageable. Instead of granting permissions person by person, define roles such as salesperson, service advisor, parts counter, rental coordinator, accounts clerk and administrator, and assign each person the role that fits their job.

Set roles around real risk. A salesperson can view their own pipeline but not export the full customer database. A service advisor can open work orders but not change general ledger entries. Parts staff can adjust stock but not approve supplier payments. Finance approvals should need a second person, so no single login can both create and pay an invoice.

Write the policy down and enforce it:

• Unique logins for everyone, no shared accounts.
• MFA on all privileged roles.
• Same-day removal when someone leaves, and a role change when someone moves department.
• Quarterly access reviews signed off by department managers.
• Separate admin accounts used only for administration, not for daily email.

Audit logs tie it together. When the DMS records who viewed, changed or exported what, you can answer an investigator’s questions and spot misuse early. When you evaluate software, check that role definitions are granular, that logs are tamper-resistant and that exports can be restricted by role. Our features overview shows how department-specific workflows map to this model.

Why do we think security and fast modernization belong together?

Dealers often feel forced to pick between moving quickly onto modern software and staying safe. We don’t think that trade-off holds. Our approach is modular: you adopt the modules that fix your most urgent pain, such as service, parts or rental. You keep ownership of your data throughout, with no lock-in, so a future exit stays on your terms.

AI is where the discipline matters most. MDMS AI can support your admin work. The trade-off is straightforward: the more customer data an AI feature can see, the stronger your contract terms, logging and human review need to be. Quick wins like MFA, role cleanup and restore testing can happen this month, alongside the slower work of AI governance and vendor clauses.

If you want to pressure-test your current setup, ask us for a security-focused demo or a migration checklist.

— ModernDMS

How do we help you run a secure DMS with MDMS AI?

Whether you are replacing an ageing DMS or adding AI to the one you have, we build around data ownership, modular rollout and department workflows made for equipment dealers. MDMS AI is available at 449 AUD per month, with MDMS AI-enabled users at 29 AUD per month per seat, so you can bring AI to the teams that need it first.

• Modular DMS modules for sales, service, parts, rental, warranty and finance
• Configurable MDMS AI deployment, with your data staying yours
• Setup support, with no long-term lock-in

Request a security-focused demo, compare modules on our pricing page, or start a free trial and see how it fits your dealership.

FAQ

What software do most dealerships use?

Most dealerships run a dealer management system (DMS) for sales, service, parts and finance, often alongside separate accounting, CRM and OEM tools. The right choice depends on your equipment type and departments. Security should be a selection criterion, including data ownership, export rights and role-based access.

What are the 5 C’s in security?

There is no single official list, and versions vary by source. A common version covers change, compliance, cost, continuity and coverage. For a dealership, the practical takeaway is to manage change safely, meet your legal duties, plan for continuity, and make sure every system is covered by your controls.

What are some security software?

The main categories are endpoint detection and response (EDR) or managed antivirus, MFA tools, backup and recovery software, email filtering and firewall or VPN gateways. The ACSC’s Essential Eight shows which controls to prioritize, such as MFA, patching and backups.

How quickly must we assess a suspected data breach?

You must carry out a reasonable and expeditious assessment, and the OAIC’s NDB guidance sets this at no more than 30 calendar days. If the breach is eligible, you then notify affected individuals and the OAIC.

Sources

• Cybercrime in Australia 2025 | Australian Institute of Criminology
• Part 4: Notifiable Data Breach (NDB) Scheme | OAIC
• Cyber
• Guidance on privacy and the use of commercially available AI products | OAIC
• INTRODUCTION

Recommended

• Dealership Data Security & Data Sovereignty
• 3 Contract Demands Equipment Dealers Must Test to Protect DMS Data