Is your firm’s security plan in writing?
Under the FTC Safeguards Rule, tax preparers count as financial institutions, so every firm, including a one-person practice, needs a written information security plan, often called a WISP. The IRS publishes guides and a template to help.
A template is the easy part. The plan has to describe safeguards that are actually in place: multi-factor sign-in, encryption, backups, monitoring and a response plan. Mayertech sets up those technical safeguards for Coachella Valley firms and helps you document them, before tax season gets busy.
The main pieces of a written security plan
The FTC Safeguards Rule expects the plan to fit your firm’s size and the client data you hold. In practice, these are the parts most firms need to cover:
A responsible person
One named person, inside the firm or an outside provider, who oversees the security program and reports on it at least once a year.
A written risk assessment
Where client data lives, who can reach it and what could go wrong, reviewed when your systems or staff change.
Multi-factor sign-in and encryption
A second step at sign-in for anyone who reaches client information, and encryption for client data stored on devices and sent over the internet.
Access controls
Each person sees only the client data they need, and access is removed the same day someone leaves.
Staff training
Regular security awareness training, so staff recognize phishing, fake IRS notices and changed-bank-details scams.
Incident response plan
What you’ll do if client data is exposed, including who to call. The rule also requires notifying the FTC after certain breaches.
The technical side, set up and documented
Most small firms already have the template. What’s missing is time and IT help to make the plan true. We handle the technical safeguards and give you plain-English descriptions to put in your plan.
- Review of where client data lives: tax software, file shares, email, laptops and phones.
- Multi-factor sign-in on Microsoft 365 or Google Workspace, remote access and tax software portals.
- Encryption on laptops and phones, and secure ways to exchange files with clients instead of email attachments.
- Monitored protection and automatic updates on every computer.
- Backups kept separate from your main systems, with test restores.
- Security awareness training and practice phishing emails for staff.
- Email protection (SPF, DKIM and DMARC) so scammers can’t easily send email in your firm’s name.
- A written summary of each safeguard, plus help drafting your incident response steps.
Find the gaps before tax season
We’ll compare your current setup with what your written plan needs to describe, check how your firm would spot a fake “new bank details” or IRS email, and give you a short list of what to fix first. No charge and no obligation.
Want a quick start on your own? Our free IT security scorecard and email security check take a couple of minutes each.
Frequently asked questions
Does a one-person practice need a WISP?
Yes. The FTC Safeguards Rule applies to tax preparers regardless of size. The plan can be simpler for a small practice, but it still needs to be written down and kept current.
Isn’t the IRS template enough?
The IRS template (Publication 5708) is a good starting point, but it’s a framework you fill in. It needs to describe safeguards your firm actually uses, which is where most of the work is.
Will working with you make our firm compliant?
We set up and document the technical safeguards. The plan itself, your policies and decisions about legal obligations stay with your firm and your advisors. We’re glad to work alongside your attorney or compliance consultant.
Do you work with our tax software?
We secure the computers, network, email and accounts your tax software runs on, and turn on multi-factor sign-in where the software supports it. Tell us what you use during the free check.
When should we start?
Before January if you can. Setting up multi-factor sign-in, encryption and backups is much easier before the busy season than in the middle of it.
You may also be interested in
Accounting & financial firms
Managed IT for accounting firms, financial advisors and bookkeepers in the Coachella Valley: secure client data, reliable tax-season systems, 24/7 support.
Learn moreManaged security
Managed cybersecurity for Coachella Valley businesses: endpoint protection, email security, multi-factor sign-in and security awareness training.
Learn moreEmail security
Email security for Coachella Valley businesses: spam and phishing filtering, SPF, DKIM and DMARC setup, and protection against fake invoices and account takeover.
Learn more
Get your security plan ready before tax season
Start with a free, no-obligation assessment and a practical list of what to fix first.