Dealership insights
Coming Out of a Shutdown: What's Your Dealership's Plan?
A business continuity plan for dealerships: what to do in the first hour and first week of a storm, outage, system failure, cyber incident or staff gap.
Quick answer
A business continuity plan for a dealership is a short written plan for how the store keeps selling, servicing and talking to customers when normal work stops: a storm, a power or internet outage, a CRM, DMS or phone failure, a cyber incident, a supply gap or key staff out. Keep it to one page, and test it.
This post first ran in April 2020, when many powersports stores were closed by pandemic orders and dealers were asking what to do when the doors reopened. It featured a recorded panel of dealership leaders hosted by PSX; that recording is no longer public. The question it asked still matters: what is the plan when the store cannot run normally? This rewrite answers it for any shutdown, not only that one.
What a dealership continuity plan is
A business continuity plan is the written answer to one question: if something stops normal work tomorrow, how do we keep selling, keep servicing and keep talking to customers until it is fixed?
It is not the same as three related plans, though it points to all of them:
- The emergency action plan keeps people safe: evacuation, shelter, first aid. Safety always comes first.
- The IT disaster recovery plan restores systems and data.
- The incident response plan handles a security event such as ransomware or a data breach.
The continuity plan sits on top: the hours and days when the building, the systems or the people are not all available, and customers are still waiting.
Ready.gov's business continuity guidance breaks the work into six steps: prepare, define the plan's objectives, identify and prioritize risks and impacts, develop strategies, define teams and tasks, and test the plan. The SBA's version is shorter: assess your risk, create a plan, and practice it with your staff "so you're ready when a disaster occurs." For a single-rooftop powersports store, both fit on a page.
Six things that can stop a dealership
Most dealers think of the big storm, but smaller things stop a store too: a phone system that will not ring, a DMS that will not open, or the one person who knows parts ordering calling in sick. For each of six scenarios, the plan answers four questions:
- How do we keep selling?
- How do we keep servicing?
- Who calls customers, and from what list?
- Where are the backups, and who can reach them?
Storms and floods
- Selling: Move units, keys and titles you can protect before the storm if there is warning. Shift sales conversations to phone, text and email; deliveries wait until roads and the store are safe.
- Servicing: Contact every customer with a unit in the shop. They will want to know their machine is safe before they ask when it will be ready.
- Who calls: The service writer calls service customers; the sales manager calls customers with pending deliveries.
- Backups: A copy of the unit inventory with VINs and photos stored off-site, plus your insurance policy numbers and agent contact. If a disaster is declared, the SBA offers low-interest disaster loans for damaged business assets, including inventory and equipment, and says "there is no cost to apply."
Power and internet outages
- Selling: A cell phone hotspot and charged laptops keep the CRM open if it runs in the browser. Paper deal jackets and a printed rate sheet let you keep writing deals to finish later.
- Servicing: Technicians can often keep working on jobs already open. Write repair orders by hand and enter them when the system returns.
- Who calls: The receptionist or BDC calls today's appointments from the printed list (see below) to confirm or move them.
- Backups: A second internet connection or a hotspot plan, a printed list of today's and tomorrow's appointments, and a phone forwarding rule that sends the main number to a cell phone.
A key system down: CRM, DMS or phones
- Selling: Leads keep arriving by email, the website and the phone. Agree in advance where they go while the CRM is down, such as one shared inbox owned by one person, so none are lost.
- Servicing: Without the DMS, use paper repair orders numbered in sequence so nothing is skipped when you enter them later.
- Who calls: The BDC lead, working from the offline list.
- Backups: The vendor's support line and your account number, written down outside the system that failed. Ready.gov's IT recovery guidance says recovery time for a system "should match the recovery time objective for the business function or process that depends on" it. In plain words: decide how long you can sell without the CRM, then ask your vendor whether they can restore it faster than that.
A cyber incident
Ransomware or a breach is different from an outage, because acting fast in the wrong way can make it worse.
- First moves: CISA's ransomware guide says to determine which systems were impacted and "immediately isolate them", taking the network offline at the switch level if several systems appear affected. Do not wipe or rebuild machines before you get advice; you may need the evidence.
- Selling and servicing: Run on the same paper processes as a system outage, from devices you know are clean.
- Who calls: No one tells customers anything about the incident until the owner and counsel agree on what to say. Staff keep calling about appointments and deliveries as normal.
- Backups: CISA recommends offline, encrypted backups of critical data, tested "on a regular basis", and a hard copy of the incident response plan, because the digital copy may be locked too. CISA also asks businesses to report incidents to CISA or the FBI.
The FTC Safeguards Rule. If your dealership is a financial institution under the FTC's Safeguards Rule, 16 CFR 314.4(h) requires a written incident response plan covering seven areas: its goals; internal processes for responding; clear roles, responsibilities and decision authority; external and internal communications; fixing identified weaknesses; documenting and reporting security events; and reviewing the plan after an event. Section 314.4(j) adds that a notification event involving the information of at least 500 consumers must be reported to the FTC no later than 30 days after discovery. Section 314.6 exempts businesses holding customer information on fewer than 5,000 consumers from the written plan requirement, though not from notification. The FTC says coverage depends on "the types of activities your business undertakes," so ask your counsel whether it covers you. This is general information, not legal advice.
Supply gaps
- Selling: When units are short, sell what is on order. Keep a "units expected" list with dates, and take customer details for each model so the store calls them when it lands, rather than waiting for them to check back.
- Servicing: When parts are short, tell the customer the real wait on the first call, and offer to book the job for when the part arrives.
- Who calls: The salesperson who owns the customer, for units; the parts counter or service writer, for parts.
- Backups: A second supplier for common service parts and a written note of which orders are waiting on what.
Key staff absent
- Selling and servicing: Cross-train one backup person for every task only one person can do today: payroll, parts ordering, deal funding, and the website or Google Business Profile.
- Who calls: The backup named in the plan, not whoever happens to notice.
- Backups: Every account the business depends on (CRM, DMS, phones, website, domain, Google Business Profile, social pages, the email platform) should have at least two administrators who are current employees. Never write passwords in the plan itself; record who holds admin access and where the company password manager is.
The list that is always inside the system that broke
Most continuity advice for dealerships, including the top-ranking guides from accountants, trade publications and software vendors, tells you to back up the DMS and keep customers informed through your website and listings. Few say what a salesperson actually needs at 9 a.m. when the CRM will not load: the names and phone numbers of the people expecting to hear from the store today.
That list lives inside the system that is down. A backup on a server somewhere does not help the BDC lead who has to call this morning's service appointments.
The fix is a short next-seven-days list, refreshed every day:
- Today's and this week's service appointments, with phone numbers and the unit.
- Pending deliveries and their customers.
- Open deals and hot leads, with the owning salesperson.
- Units in the shop and their owners.
Keep one copy where you can reach it without the main systems, such as a printout in a locked drawer or an encrypted file on a manager's laptop. Treat it as the sensitive customer information it is: keep it locked, keep it small, and shred or delete the old copy when the new one is made. For what customer data a store should hold at all, see our guide on what customer data a dealership should collect.
Pair the list with a call tree: who calls whom, in what order, and what they say. A plan where everyone assumes someone else is phoning customers produces a day when nobody does.
First hour and first week, by scenario
The first hour is about safety, containment and the customers expecting you today. The first week is about running in a reduced mode and telling the market you are open.
| Scenario | First hour | First week |
|---|---|---|
| Storm or flood | Staff safety first. Secure keys, titles and records. Call customers due in today using the offline list | Photograph damage for insurance. Update hours on Google Business Profile, the website and social. Sell by phone and text; reschedule deliveries |
| Power or internet outage | Switch to hotspot and paper. Forward the main line to a cell phone. Confirm today's appointments | If it runs past a day, rent a generator or move sales calls to another location. Enter paper deals and repair orders as soon as systems return |
| CRM, DMS or phones down | Open a support ticket. Name one person to collect all incoming leads. Work from the offline list | Track the vendor's restore time against what you can live with. Re-enter everything; check no lead was missed |
| Cyber incident | Isolate affected systems. Call your IT provider, insurer and counsel. Do not wipe anything | Follow your incident response plan. Report to CISA or the FBI. With counsel, decide what customers and regulators must be told |
| Supply gap | Tell customers waiting on units or parts the real wait. Log every request | Build an "expected units" list with customer names. Find a second parts source. Sell on-order units |
| Key staff absent | Hand their open deals, jobs and leads to the named backup | Check the backup has the access they need. Reassign the absent person's CRM leads so none sit untouched |
When the store is back to normal, a post-event review matters as much as the plan. What failed, what took longest, and what one change would help next time? A broader dealership growth checkup is a good place to put the answers.
A one-page plan template
Print this, fill it in, and keep copies at the store, at the owner's home and with the general manager.
| Section | What to write |
|---|---|
| Plan owner and backup | One name for each, with mobile numbers |
| Critical functions | Sell units, service units, answer calls and leads, fund deals, pay staff. Note the longest you can go without each |
| Six scenarios | One line each: who leads, first action, where the backup is |
| Call tree | Who calls staff; who calls service customers; who calls sales customers; who calls lenders and OEM contacts |
| Next-seven-days list | Where the daily copy is kept and who refreshes it |
| Systems and vendors | CRM, DMS, phones, internet, website: support number, account number, two admins each (no passwords) |
| Lead handling when systems are down | Where leads go and who owns them |
| Customer message | Two prepared lines: "We're open with reduced service" and "We're temporarily closed; here's how to reach us" |
| Insurance and finance | Policy numbers, agent, bank contact, floor plan lender contact |
| Cyber incident contacts | IT provider, cyber insurer, counsel, and where the incident response plan is kept |
| Last tested | Date, scenario used, what changed |
Build and test it in four weeks
- Week 1: List your critical functions and decide how long each can stop before customers are lost.
- Week 1: Name the plan owner, a backup, and a backup person for every one-person task.
- Week 2: Fill in the template. Map every system you rely on; our guide to planning a dealership tech stack has a simple way to list them.
- Week 2: Start the daily next-seven-days list and confirm who keeps it.
- Week 3: Check that backups exist, are offline or off-site, and can actually be restored. Ask each vendor how you would export your data.
- Week 3: Confirm two admins on every account and remove anyone who has left.
- Week 4: Run a one-hour tabletop exercise: "It's Saturday at 10 a.m. and the CRM and phones are down." Walk through who does what.
- Every six months: Re-test with a different scenario and update the "last tested" line.
Where PSX Ascend fits
No CRM keeps a store running by itself; the plan and the people do. Technology helps most when the customer record is complete, so whoever steps in can see the history, the unit and the next step. PSX Ascend's view is that quality data comes first.
The AI-powered powersports CRM is built to give dealer groups one customer view across every rooftop, and PSX's multi-location BDC software is built to route each opportunity to the right rooftop, team and owner without losing the original customer context. That matters on the day one store is closed or short-staffed. Whatever CRM you use, ask your vendor, us included, how you export your customer and appointment lists and how long a restore takes, before you need to know.
If the disruption is economic rather than physical, our guide to dealership marketing in an economic downturn covers the marketing side. When the store is steady again, our hub on where to start growing a powersports dealership picks up from there.
You can also see the same AI-powered powersports CRM on our sister site, PSXDigital's AI-powered powersports CRM page.
Sources
- Ready.gov, Business (preparedness plans covering communications, IT support and recovery, and continuity; training and exercises)
- Ready.gov, Business Continuity Plan (six steps: prepare, define objectives, identify and prioritize risks and impacts, develop strategies, define teams and tasks, test)
- Ready.gov, IT Disaster Recovery Plan (IT recovery time should match the recovery time objective of the business function that depends on it)
- U.S. Small Business Administration, Prepare for emergencies (assess risk, create a plan, practice with staff; regular data backups; disaster loans, no cost to apply)
- CISA, #StopRansomware Guide (offline, encrypted, tested backups; hard copy of the incident response plan; isolate impacted systems; report to CISA or the FBI)
- CISA, Report to CISA
- FBI, Internet Crime Complaint Center (IC3)
- Electronic Code of Federal Regulations, 16 CFR 314.4, Elements (paragraph (h): written incident response plan and its seven areas; paragraph (j): FTC notification for events involving at least 500 consumers, no later than 30 days after discovery)
- Electronic Code of Federal Regulations, 16 CFR 314.6, Exceptions (fewer than 5,000 consumers)
- Federal Trade Commission, FTC Safeguards Rule: What Your Business Needs to Know (coverage depends on the activities a business undertakes)