What a WISP is
A WISP is a written information security plan: a document describing how your office protects client information. Under the Gramm-Leach-Bliley Act, the FTC treats tax preparers as financial institutions, and its Safeguards Rule (16 CFR Part 314) requires a written information security program. The IRS publishes a guide (Publication 4557) and a sample plan you can fill in (Publication 5708).
This checklist follows the parts of the rule in 16 CFR 314.4. It’s general information, not legal advice; your own advisors decide what applies to your firm.
Who’s responsible
Name one qualified individual to oversee the program. In a small office that’s often the owner. It can also be an outside provider, as long as someone senior at the firm oversees them.
What the plan should cover
- Risk assessment: where client data lives, who can reach it and what could go wrong.
- Access controls: each person reaches only the client data they need.
- Data and device inventory: a list of your computers, phones, software and where client data is stored.
- Encryption: client data encrypted on devices, in backups and when it’s sent over the internet.
- Multi-factor sign-in: for anyone who accesses client information, including email, tax software and remote access.
- Secure disposal: client data deleted securely once it’s no longer needed (generally within two years of last use, unless you have a reason to keep it).
- Change management: a sensible way to make changes to systems without opening gaps.
- Monitoring and logging: a record of who accessed client data and when.
- Testing: regular checks that the safeguards work.
- Staff training: security awareness training for everyone, kept up to date.
- Vendor oversight: choosing service providers that protect data, and checking on them.
- Incident response plan: what you’ll do if client data is exposed.
- Annual report: the qualified individual reports on the program in writing to the owner or board at least once a year.
Smaller firms: under 16 CFR 314.6, firms that hold information on fewer than 5,000 consumers are exempt from a few of these written requirements (the written risk assessment, the incident response plan, the annual report and some testing). The IRS sample plan still includes them, and they’re worth doing anyway.
Breach notice to the FTC
Since May 2024, if unencrypted information about 500 or more consumers is acquired without authorization, you must notify the FTC as soon as possible and no later than 30 days after you discover it, using the FTC’s online form. State breach laws may also require notices to the people affected.
Where small offices usually fall short
- No multi-factor sign-in on email or tax software.
- Shared logins, so nobody can tell who did what.
- Backups that have never been test-restored.
- No written plan for a breach or ransomware.
- A template downloaded and filled in once, but describing safeguards that aren’t actually in place.
Keep it alive
Review the plan at least once a year, and whenever you change staff, software, vendors or offices. Keep notes of what you checked and when.
Related
- IT for accounting and financial firms
- Fake invoices with new bank details: how to stop the scam
- Multi-factor sign-in: a plain-English guide
More guides
- Microsoft 365 admin: add staff, reset passwords and offboard someone who leaves
- Microsoft 365 Copilot: what it does, where to find it, and how to use it safely
- Set up Microsoft Authenticator and Outlook on your phone (iPhone and Android)
- How to check your email's SPF, DKIM and DMARC records (and what the results mean)
- How to send an encrypted email in Outlook (Microsoft 365)
- Share files with clients securely from OneDrive (expiring links, no attachments)
- Hand over HOA or office email when a board member or manager changes
- How to spot and report a phishing email in Outlook
Microsoft changes its menus from time to time, so a button may have moved. These guides are general information for small businesses; check with your IT provider before changing settings that affect everyone.