WISP Template for Tax Preparers and Small CPA Firms

WISP template for small CPA firms

The IRS reminds tax professionals that federal law requires a written information security plan. This outline follows the elements of the FTC Safeguards Rule in order, so each part of your plan maps to a paragraph of 16 CFR 314.4.

Free Plan with invoices within 200 transactions, bills & quotes — no credit card.

[FIRM NAME] WRITTEN INFORMATION SECURITY PLAN Version [N] · Approved [DATE] · Next review [DATE] 1. QUALIFIED INDIVIDUAL [16 CFR 314.4(a)] Name and role of the person who oversees and implements this program: ____ Outside provider, if any, and who at the firm supervises them: ____ 2. RISK ASSESSMENT [314.4(b)] Where client information lives (systems, devices, paper, cloud services): ____ Risks identified to confidentiality, integrity and availability: ____ How often the written risk assessment is repeated: ____ 3. SAFEGUARDS [314.4(c)] (1) Access controls: who can see what, and how often access is reviewed: ____ (2) Inventory of data, personnel, devices, systems and facilities: ____ (3) Encryption of client information held or transmitted: ____ (4) Secure development practices for any in-house applications: ____ (5) Multi-factor authentication for anyone accessing any information system: ____ (6) Secure disposal of client information and the retention schedule: ____ (7) Change management procedures: ____ (8) Monitoring and logging of authorized users' activity: ____ 4. TESTING AND MONITORING [314.4(d)] Continuous monitoring, or penetration testing and vulnerability assessments on the schedule the rule sets: ____ 5. PEOPLE [314.4(e)] Security awareness training schedule and records: ____ Qualified staff or providers to run the program: ____ 6. SERVICE PROVIDERS [314.4(f)] How providers are selected, the contract clause requiring safeguards, and how they are periodically assessed: ____ 7. KEEPING THE PROGRAM CURRENT [314.4(g)] What triggers an update (testing results, changes in the firm, new risks): ____ 8. INCIDENT RESPONSE PLAN [314.4(h)] Goals, internal process, roles, external and internal communications, remediation, documentation and post-incident review: ____ Contacts: IRS Stakeholder Liaison for [STATE]: ____ State tax agencies: ____ Insurer: ____ Counsel: ____ 9. REPORTING [314.4(i)] Written report from the Qualified Individual to [OWNER/PARTNERS] at least annually: ____ 10. FTC NOTIFICATION [314.4(j)] Process to notify the FTC of a notification event involving at least 500 consumers, no later than 30 days after discovery: ____ Approved by: ____________________ Date: __________

What the regulation asks for

The FTC Safeguards Rule lists the elements of an information security program in 16 CFR 314.4, paragraphs (a) to (j). The outline above follows them in order, quoting the subject of each paragraph. The IRS also publishes a sample plan for tax practices, Publication 5708, and security guidance in Publication 4557.

(a) “Designate a qualified individual responsible for overseeing and implementing your information security program.”
(b) “Base your information security program on a risk assessment.”
(c)(5) “Implement multi-factor authentication for any individual accessing any information system.”
(f) Oversee service providers, including “requiring your service providers by contract to implement and maintain such safeguards.”
(h) “Establish a written incident response plan designed to promptly respond to, and recover from, any security event.”
(j) Notify the FTC of a notification event involving at least 500 consumers, no later than 30 days after discovery.

Have it reviewed before you rely on it

This outline is a starting point to be reviewed by the firm’s counsel and, ideally, an IT security adviser. The rule has exceptions and details (for example in 16 CFR 314.6) that this page does not cover, and state data breach laws add their own duties.

Frequently asked questions

Does a sole practitioner need a WISP?

The IRS says federal law requires tax and accounting professionals to create and maintain a written information security plan. Size changes what goes in it, not whether you need one.

Who do I call after a data theft?

The IRS recommends contacting your IRS Stakeholder Liaison. Your plan should also list the state tax agencies, your insurer and counsel.

WISP template for small CPA firms

What the regulation asks for

Have it reviewed before you rely on it

Frequently asked questions

Keep exploring

Sources

Start automating your books today

WISP template for small CPA firms

What the regulation asks for

Have it reviewed before you rely on it

Frequently asked questions

Keep exploring

Sources

Start automating your books today

Subscribe to our newsletter