Short answer: WISP software for auto dealers generates a Written Information Security Program document tied to your dealership's actual, current risk assessment — not a generic template with your dealership's name swapped in. The difference matters because examiners, lenders, and the FTC itself can tell the difference between a real WISP and a filled-in form, and a mismatched one is often worse than having no document at all.
What a WISP actually is
A Written Information Security Program is the master document the FTC Safeguards Rule requires every covered dealership to maintain. It's supposed to describe, specifically, how your dealership identifies risks to customer financial data, what safeguards you've put in place, who's responsible for the program, how employees are trained, and what happens if something goes wrong.
The rule doesn't just want this document to exist. It wants the document to accurately describe what your dealership is actually doing — which is exactly where a lot of dealers run into trouble.
Why downloaded templates create their own risk
It's easy to find a generic WISP template online, swap in your dealership's name, and file it away. The problem is what happens next: an examiner or lender review doesn't just check that a WISP exists — a thorough one checks whether it matches reality. A generic template describes generic safeguards. If your actual systems don't match what the document claims, you're not in a stronger position than having no document at all. In some respects you're in a worse one, because you've now put something in writing that doesn't hold up.
This is a common trap for independent dealers who treat Safeguards Rule compliance as a one-time paperwork task rather than an ongoing program.
What WISP software should actually do
Build the document from your actual risk assessment. Your WISP should describe the specific risks identified for your dealership's specific systems — not a boilerplate list of generic threats every dealership supposedly faces equally.
Update when your risk assessment changes. If you switch DMS providers, add a new F&I integration, or change how customer data is stored, your WISP should be able to reflect that without starting over from a blank template.
Include what the rule actually requires, not just what looks official. A Qualified Individual designation, specific safeguards tied to identified risks, training program details, vendor oversight procedures, and an incident response plan — all specific to your dealership, not generic language.
Produce something you can hand over on request. When a lender or examiner asks for your WISP, you should be able to produce a current, accurate document immediately — not scramble to update a stale one first.
The gap between "having a WISP" and "being compliant"
Plenty of independent dealers technically have a WISP sitting in a drawer or a shared drive. Far fewer have one that accurately reflects their current systems and could survive someone actually reading it closely. Sterling Safeguard builds your WISP directly from your risk assessment results, so the document you'd hand a lender or examiner actually matches what your dealership is doing — not what a template assumed a generic dealership might do.