The responsibility you can’t sign away

The contract moves the work. It does not move the responsibility.

A dealership’s security might run through an IT provider, a dealer management system provider and a string of software vendors. A software vendor’s might run through a cloud platform whose data centers it will never visit. Signing those contracts can feel like handing off the risk. It hands off the labor, and sometimes part of the cost. It does not hand off the obligation.

“The patch nobody was assigned” asked who patches each system: your team, your managed service provider or your software vendor. This is the harder half. Even when the answer is “the vendor,” the vendor owns the work and the promise. The responsibility is still yours.

Regulators say so in almost the same words. The FTC Safeguards Rule, 16 C.F.R. § 314.4, reaches dealers that finance or facilitate the financing of vehicles, or lease them for longer than 90 days.¹ It requires a dealer to oversee the service providers that can reach its customer information: taking reasonable steps to select capable ones, requiring safeguards “by contract,” and “periodically assessing” them “based on the risk they present.”² The FTC’s own examples are unglamorous: a marketing company with direct access to customer records, a shredding company handling paper ones.¹ And where the person running the dealer’s security program works for a service provider, the rule says it outright: the dealer must “retain responsibility for compliance” and name a senior member of its own staff to direct and oversee that person.²

This is not one rule’s quirk. In 2023, the Federal Reserve, the FDIC and the OCC reminded banks that they must operate safely and lawfully whether work is done in-house or by a third party, and that “a banking organization’s use of third parties does not diminish its responsibility to meet these requirements to the same extent as if its activities were performed by the banking organization in-house.”³ In the European Union, the Digital Operational Resilience Act, which has applied since January 17, 2025, says financial firms that contract for technology services “shall, at all times, remain fully responsible for compliance” with their obligations.⁴

Vendors meet the same pattern from the other side. Amazon Web Services puts it plainly: “Security and Compliance is a shared responsibility between AWS and the customer.” AWS secures the infrastructure; the customer’s share depends on the services it chooses. On a virtual server, that includes the operating system and its patches. On storage, it includes the data, encryption choices and access permissions.⁵ Even a model built to split responsibility leaves the customer a share that stays the customer’s.

Delegation is a fine management technique. Try delegating the apology letter.

None of this argues against outsourcing. A specialist may do the work better than you would. It argues for knowing what you kept, and the rule’s three verbs are a good place to start: select, require, assess.

For a dealer, that means one page. List the providers that touch customer financing information. For each, write down what it handles, who it relies on, what the contract requires, including how fast it must tell you about an incident, and when someone last checked. If your IT company runs your security program, put the name of the senior person inside the dealership who oversees it at the top. Your controller can start it this week. It is a starting point, not the whole rule.

For a vendor, it means the same page one level down, and something more. To your customers, you are the third party, and the questionnaire in your inbox may be a dealer doing exactly what the rule asks. Answer it before it arrives: publish a plain responsibility matrix saying who handles user accounts, multifactor authentication, backups and patching, you or the customer.

For any company, it means the same page for whoever runs your email, payroll, customer data and cloud. A contract is a promise from someone else. Oversight is how you find out whether it is being kept.

If your most important vendor failed tomorrow, does the person who would answer for it know yet?