Firm Information
Basic details about your tax or accounting practice. This information will appear on the cover page of your WISP.
ℹ️ Legal Requirement: Under the Gramm-Leach-Bliley Act (GLBA) and the FTC Safeguards Rule, all tax professionals are considered financial institutions and must maintain a written information security plan. See IRS Pub. 5708 ↗
🏢 Practice Details
Click to upload or drag & drop your logo
PNG, JPG, SVG, or GIF · Recommended max width 400px
6-digit number assigned by the IRS
WISPs must be reviewed at least annually
📋 Types of Client Information Handled
Check all types of Personally Identifiable Information (PII) your practice handles:
Responsible Officials
Designate the individuals responsible for your information security program. The FTC Safeguards Rule requires you to name a qualified individual to coordinate your WISP.
🔐 Data Security Coordinator (DSC)
The DSC is responsible for implementing, supervising, and maintaining the WISP — including daily operations, employee training, vendor oversight, and incident response.
📢 Public Information Officer (PIO)
The PIO is the single spokesperson for all outward communications related to any data breach — client notifications, media, law enforcement statements. In a sole practice, this may be the same person as the DSC.
🖥️ IT Support / Service Provider
Risk Assessment
Identify and document internal and external risks to the security of client data. The FTC requires each firm to assess risks and evaluate existing safeguards.
⚠️ Internal Risks
Check all internal risks that apply to your practice:
🌐 External Risks
🔍 Risk Monitoring Procedures
Hardware Inventory
Catalog all devices used in your practice that come into contact with client data. This is required under the FTC Safeguards Rule and IRS guidance.
📋 Include all computers, laptops, tablets, phones, printers, servers, routers, modems, USB drives, and any device that stores, processes, or transmits client PII.
💻 Device Inventory
| Device Description | Physical Location | Principal User | Types of PII Stored/Processed | In-Service Date | |
|---|---|---|---|---|---|
☁️ Cloud & Software Services Containing PII
Security Policies & Safeguards
Select the security policies your firm implements. These form the core of your WISP and demonstrate compliance with the FTC Safeguards Rule.
🔑 Network & Access Control
📡 Wi-Fi & Remote Access
📁 Data Handling & Transmission
👥 Employee Training & Personnel
🤝 Third-Party Service Providers
📅 Record Retention Policy
IRS generally recommends 3–7 years depending on record type
Security Breach Response Plan
Document your procedures for responding to a data breach. The FTC requires firms to report security events affecting 500 or more people within 30 days of discovery.
⚠️ FTC Reporting Requirement: Security events affecting 500 or more customers must be reported to the FTC within 30 days of discovery via the FTC Safeguards Rule Security Event Reporting Form.
🚨 Breach Detection & Internal Notification
📞 External Notifications Required
Select all agencies and parties your firm will notify in the event of a data breach:
🛡️ Insurance & Legal
Authorized PII Access List
Maintain a record of all individuals — employees, contractors, and vendors — authorized to access client PII. This supports compliance and provides a chain of custody in the event of an investigation.
🪪 Authorized Personnel
| Full Name | Role / Title | Job Duties | Access Level | Date Access Granted | Date Terminated | |
|---|---|---|---|---|---|---|
Include contractors (IT support, cleaning service, copier repair) who may have physical or electronic access to areas containing PII.
✍️ Signatories
The WISP must be signed by the principal operating officer or owner and the Data Security Coordinator.
Your WISP Document
Review your completed Written Information Security Plan below. Click Print / Save as PDF to generate your official document.