Tax professionals are required by law to have a Written Information Security Program. We assess your office, write or update your WISP, and help you put the required safeguards in place, in plain language and at a fixed price.
Under the FTC Safeguards Rule, an accountant or tax preparation service that completes income tax returns is a "financial institution" and must protect client information accordingly.
The IRS reminds tax professionals that they are required by law to create a Written Information Security Program to protect client data, and publishes a template (Publication 5708) to help.
16 CFR Part 314 · IRS Publication 5708The rule requires a Qualified Individual to oversee the program, multi-factor authentication for anyone accessing your systems, encryption of client data, staff training, and oversight of your service providers.
16 CFR § 314.4If unencrypted information about at least 500 clients is acquired without authorization, you must notify the FTC as soon as possible and no later than 30 days after discovery.
16 CFR § 314.4(j)Firms that hold information on fewer than 5,000 consumers are exempt from a few requirements (written risk assessment, annual penetration test, written incident response plan, annual report). The WISP, the Qualified Individual, MFA, and encryption still apply. We tell you exactly which rules apply to your firm.
We learn how many staff, offices, and systems you have, and which requirements apply to your firm.
We review your office, software, and accounts, remotely or on site, outside tax deadlines if you prefer.
We write or update your Written Information Security Program to match how your firm actually works.
We present the WISP and the fixes, and help your Qualified Individual keep it current.
Starting prices for a typical small office. Your written quote sets the final price after the free call.
Yes. Under the rule, an accountant or other tax preparation service that is in the business of completing income tax returns is a financial institution, whatever its size. Firms with fewer than 5,000 consumers are exempt from only a few specific requirements.
You can, and IRS Publication 5708 is a good starting point. A WISP only protects you if it matches how your firm really works, so we assess your systems first and then tailor the document and the safeguards to your office.
The person responsible for overseeing and enforcing your information security program. It can be an owner, an employee, or an outside provider. We help you designate that person and give them what they need.
Yes. The rule requires multi-factor authentication for any individual accessing any information system, unless your Qualified Individual approves in writing reasonably equivalent or more secure controls.
If unencrypted information about at least 500 clients is involved, you must notify the FTC within 30 days of discovery. A current WISP and an incident response plan make that process much faster.
Review it at least once a year and whenever your firm changes, such as new software, a new office, or a security incident. Our Annual WISP Update covers that review.
This page is general information about regulatory requirements, not legal advice.