Staff security training for your whole office: $99 a year. The Safeguards Rule requires security awareness training for everyone who handles client information. Our video course is built for tax offices, with a quiz, certificates and completion records for your files. $99 a year covers up to 5 staff. See the course and a sample →
Why tax professionals need a WISP
Tax preparers are "financial institutions" under the FTC Safeguards Rule. That means you need a written information security program, which the IRS and the tax industry call a WISP. The IRS reminds tax professionals of this obligation every year and publishes guidance and a sample template to help.
It also comes up at PTIN renewal. Line 11 of Form W-12 asks you to check a box acknowledging that paid preparers are required by law to create and maintain a WISP. If you're checking that box, the plan should actually exist.
The IRS and state tax agencies also watch for data theft at tax offices, because stolen client data fuels fraudulent returns. A breach can mean lost clients, notifying clients by mail, state reporting and, when 500 or more consumers are affected, a report to the FTC within 30 days of discovery.
Is the free template enough?
The IRS sample WISP (Publication 5708) is a good starting point. But a template isn't a program. It still has to be:
- tailored to how your office handles client data, including the software, cloud storage and portals you use
- carried out: MFA, encryption, secure disposal and staff training actually in place
- owned by a named Qualified Individual who enforces it
- kept current as your staff, systems and vendors change
That's the gap we fill.
What we do for your office
Build your WISP
Written around your practice, your tax software and your vendors. No fill-in-the-blank boilerplate.
Serve as your QI
We're named in the plan as your Qualified Individual, with someone in your office designated to oversee us.
Put it into practice
A short, prioritized list for you or your IT person: MFA, encryption, backups and access.
Review it every year
An annual review before filing season, updated for new staff, software and threats.
Train your staff
Security awareness training built for tax offices, with a quiz, certificates and completion records for your files. Included with Managed QI, first year included with Program Setup, or on its own from $99 a year. See the course →
Small office? The exemption may help
If your firm keeps records on fewer than 5,000 individuals (count both spouses on a joint return, and past clients as well as current ones), your firm is exempt from the written risk assessment, formal pen testing, the written incident response plan and the annual report. Your firm still needs a QI and a written program. Our DIY Toolkit, or Program Setup if you'd rather not write it yourself, is built for exactly this.
Get ready before filing season. Email us with a question or to set up a free 20-minute call, and we'll review what you have and tell you what's missing. Get in touch →