16 C.F.R. § 314 · FTC SAFEGUARDS RULE
The security plan the IRS expects your firm to have.
WISPer turns twenty minutes of plain-English questions into a firm-specific Written Information Security Plan — then keeps it reviewed, acknowledged, and audit-ready, year after year.
The questionnaire is free. Pay only when you generate the document.
Why your firm needs a WISP
16 C.F.R. § 314
Tax preparers are financial institutions
Under the FTC Safeguards Rule, a written information security plan is required of every firm — not recommended.
IRS Pub 4557
PTIN renewal asks about it
The IRS now has preparers confirm their data-security responsibilities, and Pub 4557 spells out what examiners expect to see.
§ 314.4(j)
Breaches must reach the FTC in 30 days
Incidents involving 500+ people carry a federal reporting deadline. Your plan includes the playbook and the phone numbers.
From questionnaire to signed plan
1
Answer honestly
Twenty minutes of plain questions about your software, devices, people, and vendors. No security expertise needed — honest answers are the point.
2
Generate your WISP
One payment produces the full document, built from your answers. Where a control is missing, the plan commits to a fix with a target date instead of pretending.
3
Keep it alive
Edit in place, export to Word or PDF, collect staff sign-offs, and get reminded when the required annual review comes due.
MODELED ON IRS PUB 5708
Every section the rule expects. None of the boilerplate shame.
This is the document you'll generate, section by section — filled with your firm's names, systems, and practices, not a find-and-replace template. Here's what each one actually contains.
- 01
Purpose, Scope & Objectives
Opens the plan under the Gramm-Leach-Bliley Act and states its three objectives, then defines every term the rest of the document leans on.
16 C.F.R. § 314 authoritydefined termswho and what the plan binds
- 02
Qualified Individual
Names the one person accountable for your program — plus an optional backup — with their duties enumerated, not implied.
designation by name & titlelisted responsibilitiesbackup contact
- 03
Risk Assessment
Inventories exactly what client data you hold and where it lives, then maps each foreseeable threat to the safeguard that answers it.
PII inventory (SSNs, bank, IDs…)where data is storedeight-threat table with impact & mitigation
- 04
Safeguards
The technical core — seven control areas written to match what your firm actually does. Anything you don't yet have is flagged for remediation, never overstated.
access control & MFAencryption at rest & in transitnetwork & Wi-Fipatching & endpoint protectionbackupsremote work & BYODphysical security
- 05
Retention & Secure Disposal
How long records are kept, and exactly how they're destroyed when that time comes — paper, drives, and cloud alike.
retention scheduleshreddingdrive sanitizationcloud deletion
- 06
Employee Management & Training
The people controls, from the day someone is hired to the day they leave.
hiring & background screeningonboarding acknowledgmentannual security trainingoffboarding checklistsanctions
- 07
Service Provider Oversight
Documents the vendors who can touch client data — your IT firm, cloud apps, the shredding service — and the diligence you apply to each.
provider inventorysecurity vetting before engagementwritten safeguard & breach-notice termsannual reassessment
- 08
Incident Response Plan
A ready-to-use breach playbook: who to call, the containment steps in order, and every notification deadline you're legally on the hook for.
response contactscontain → assess → notify → recoverIRS Stakeholder LiaisonFTC 30-day rule (500+ people)per-state deadlines, AG & credit-bureau thresholds
- 09
Monitoring, Testing & Annual Review
How the program stays alive — ongoing monitoring, a yearly control test, and the annual review that regenerates the document.
access & MFA reviewsbackup-restore testannual review procedureevidence retained
- 10
Appendices A–F
The evidence pack an examiner or insurer asks for — inventories, the staff roster with access levels, and your dated gap-closure plan.
A · hardwareB · software & servicesC · personnel & accessD · service providersE · acknowledgment formF · remediation plan with target dates
A WISP isn't a PDF you file away. It's a plan you keep.
Employee acknowledgments
Each staff member gets a personal link to read the plan and e-sign. Timestamped, versioned, ready to show an auditor.
Version history
Every published revision is an immutable, dated snapshot with a what-changed view between versions.
Annual review reminders
The rule expects a yearly review. WISPer tracks the clock and nudges you before it lapses — publishing resets it.
ENGAGEMENT TERMS
One document. One price.
- Initial WISPgenerated from your questionnaire · first year of updates included
- $400
- Annual updatesediting, regeneration, reminders & acknowledgments · from year two
- $100/yr
Cancel anytime — every version you've published stays yours to view and export.
Start free — pay when you generate