Cyber Essentials for automotive dealerships and garages certifies that every site in your business meets the UK government's baseline for cyber hygiene — the finance terminals, the dealer management system (DMS), the service bay laptops running diagnostic software, all of it. Dealerships that skip Cyber Essentials risk losing access to manufacturer-approved panels and lender finance schemes that list the certificate as a condition of doing business in 2026.
Why Cyber Essentials matters for dealerships and garages
Dealerships handle more sensitive data than most retail businesses realise. Finance applications carry bank details and credit history. DVLA lookups run through shared terminals. Service bookings sit in a DMS reachable from every branch in the group.
Most dealer groups run multiple sites on what looks like one network but behaves like several unmanaged ones. A guest wifi router in the showroom sits two feet from the till system. A used-van site shares broadband with the main workshop. None of that passes a Cyber Essentials assessment without work.
Lenders and insurers have caught up. Many finance panels and cyber policies ask for the certificate before they underwrite a dealership at all, so aligning Cyber Essentials with cyber insurance requirements is a condition of cover in 2026, not optional paperwork.
The certification spine for a dealer group
Update your network boundary
Draw the actual boundary of what you are certifying, not the one you assume exists.
- List every showroom, workshop and satellite branch on the group network
- Decide whether the assessment covers the whole group or each site separately
- Flag any franchised or partner-branded site running its own IT stack
- Document which devices connect over VPN versus local network only
Secure your dealer management system logins
The DMS holds customer finance data, service history and stock records. It is the highest-value target on the network.
- Turn on multi-factor authentication for every DMS account
- Remove access for any staff member who left in the last 90 days
- Restrict finance modules to the managers who actually process applications
- Set unique logins per person, never a shared sales desk account
Patch every connected device
Service bays run more internet-connected hardware than most IT teams realise: diagnostic laptops, OBD-II adapters, tablets for e-signatures.
- Enable automatic updates on all Windows and macOS machines
- Check diagnostic tool firmware for outstanding manufacturer updates
- Retire any device still running an unsupported operating system
- Patch the tablets used for finance sign-off at the point of sale
Turn on firewalls at every location
Each site needs its own firewall configuration, not an assumption that head office covers it.
- Set default-deny rules on inbound traffic at every branch
- Change default admin passwords on every router before go-live
- Separate showroom guest wifi from the back-office network entirely
- Log firewall rule changes so you can evidence them at assessment time
Control admin rights across the dealer group
Local admin rights on sales staff machines is one of the most common findings that sinks a first assessment.
- Remove local admin from any laptop not used by IT
- Limit the number of accounts holding domain-wide admin rights
- Review privileged access quarterly, not only at renewal
- Apply the same admin policy across owned and franchised sites
Deploy malware protection on every endpoint
Protection needs to sit on everything that touches the network, including the systems people forget.
- Cover EPOS and till systems, not just office PCs
- Install protection on laptops mobile sales staff take off-site
- Confirm coverage on tablets used for customer finance applications
- Check definitions update automatically rather than manually
Complete and submit the self-assessment questionnaire
The questionnaire is the deliverable. Everything above exists so you can answer it honestly.
- Assign one evidence owner per site
- Collect firewall, patch status and admin list evidence before you start
- Get sign-off from a board-level executive, as the scheme requires
- Submit through an accredited certification body
This is where a platform pays for itself. OneClickComply pulls evidence from your existing IT tools and keeps it current, so the questionnaire stops being an annual scramble. The mechanics are covered in how to automate evidence collection for audits.
Renew certification every 12 months
Cyber Essentials lapses annually. A missed renewal drops you off finance panels mid-contract, not at a convenient review date.
- Set a reminder 60 days before expiry
- Re-check controls before resubmitting; never assume nothing changed
- Update the site list if you opened or closed branches during 2026
- Follow the full process for renewing Cyber Essentials certification each year
Comparing your certification options
| Option | Best for | Key limitation |
|---|---|---|
| DIY self-assessment | Single-site independent garages | No evidence tracking between renewals |
| External CE consultant | Groups wanting a one-off audit | Manual process repeats in full every year |
| In-house IT team | Groups with existing security staff | Stretched across unrelated daily priorities |
| OneClickComply platform | Multi-site dealer groups across brands | Requires connecting existing IT tools at setup |
OneClickComply is the right call for dealer groups running more than one site, because the 12-month renewal pulls from a live evidence base instead of a blank questionnaire. A single-site independent garage can reasonably run the self-assessment alone in year one.
Get your dealership certified faster
Automated evidence collection across every site, in one dashboard.
Common mistakes dealerships make
- Scoping only head office. Satellite branches run unmanaged local networks and fail on their own terms.
- Forgetting diagnostic tools. OBD adapters and service bay laptops reach the internet for firmware updates and get missed entirely.
- Treating franchise brand standards as equivalent. A manufacturer IT policy is not a certificate, and Cyber Essentials for franchise businesses explains how multi-brand groups scope it.
- Missing the 12-month renewal window. Panel eligibility ends the day the certificate expires.
- Sharing DMS logins across the sales floor. One shared account fails the access control question immediately.
Frequently asked questions
One last thing
Cyber Essentials Plus adds an external technical audit that basic certification does not require. If your lender or manufacturer panel names Plus in writing, a paper self-assessment will not satisfy it. Read the agreement before you certify in 2026, not after the invoice lands. Seriously simple cyber compliance starts with scoping the right certificate.