Compliance · WISP
What is a WISP, and does your firm need one?
A WISP (written information security plan) documents how your firm protects customer information: who is responsible, what risks you face, which safeguards you use and how you respond to incidents. Tax preparers and other businesses covered by the FTC Safeguards Rule are expected to have one.
- MBE certifiedNMSDC
- i-SIGMA memberSecure data destruction
- CSDS-ledCertified Secure Data Specialist
- NIST SP 800-88 Rev. 2Aligned media sanitization
What you get
Who needs one
Tax preparers, CPA firms and other financial institutions under the FTC Safeguards Rule.
What it covers
A qualified individual, a risk assessment, safeguards, training, vendor oversight and an incident response plan.
Keep it current
Review it at least yearly and when your firm or systems change.
How it works
- 01
Name a qualified individual
Assign one person to own the security program.
- 02
Assess risk
List the customer data you hold, where it lives and what threatens it.
- 03
Document safeguards
Record your controls: MFA, encryption, access, backup, training.
- 04
Plan for incidents
Write down how you will respond to and report a breach.
- 05
Review regularly
Update the plan yearly and after material changes.
Get the free WISP checklist
A one-page checklist you can work through with your team this week.
Frequently asked questions
Is a WISP required for tax preparers?
Yes. Tax preparers are covered by the FTC Safeguards Rule, which requires a written information security program, and the IRS asks PTIN holders to confirm they have one.
Can I use a WISP template?
A template is a starting point, but the plan must reflect your actual systems, risks and safeguards.
Related
Find your gaps before an auditor does
A free IT & security assessment: we review your devices, Microsoft 365, backups and policies, then give you a plain-English action list.