WISP · FTC SAFEGUARDS RULE
A WISP that matches what your computers actually do.
The FTC Safeguards Rule requires tax preparers, CPA firms, mortgage brokers and other covered businesses to keep a written information security program. We write it with you, set up the safeguards it describes, and keep it current every year.
- Written from an interview, not a fill-in-the-blank template
- Every gap it finds gets fixed, not just listed
- MFA, encryption and admin access checked on every computer
- Every app and vendor that touches client data reviewed
- Reviewed and updated every year
Free 30-minute call with Noah · A written quote before anything starts · No obligation
- 16 CFR Part 314
- IRS Pub 5708
- Risk assessment
- MFA
- Yearly review
East Canton basedNortheast Ohio coverageOwner-led
The short answer
The document is the easy part. Making it true is the work.
A small office can start a WISP from the IRS sample in Publication 5708. Where firms get caught is the gap between what the document says and what the computers do: a plan that says every account has MFA, next to an old email account that does not.
We are an IT company, so we start from the computers. We take stock of your data, devices, software and vendors, write the program around what is really there, and fix the gaps before you sign it.
Sounds familiar?
- Your tax software or insurer asked if you have a WISP
- You downloaded the IRS sample and it is still blank
- You have a WISP, but nobody has opened it since it was written
- You are not sure every account has MFA
- Staff use browser extensions or apps nobody approved
- You do not know what to do first if a laptop is stolen
What we do
The program, and the safeguards it describes.
Inventory
Every computer, account, piece of software, cloud service and vendor that touches customer information, written down.
The written program
Built from an interview with you and from what the inventory found. It names your Qualified Individual, records the risks and how each is handled, and is delivered as a Word document you own.
Fixing the gaps
MFA turned on everywhere it is missing, laptops encrypted (BitLocker on Windows, FileVault on Mac), ex-employee accounts removed, admin rights cut back, backups checked by restoring them.
Apps, extensions and vendors
Each app and browser extension that can read client data is checked for what it sends and where. Some get approved, some get removed, and the rest are written up as a risk the firm accepts.
Testing
Vulnerability scans of what faces the internet, and monitoring on the computers themselves, so the testing part of the rule has evidence behind it.
The yearly review
Once a year we go through the program with you, update it for what changed, and help the Qualified Individual write the report to the owners.
Who it's for
Businesses the rule calls financial institutions.
That covers far more than banks. If you are not sure the rule applies to you, ask your attorney or advisor. We can help either way.
Tax preparers, CPA firms and enrolled agents
The rule's own example names any business that completes income tax returns. The IRS says the same in Publication 5708, regardless of the firm's size.
Mortgage brokers and finance companies
Named in the rule's list of examples, along with collection agencies and credit counselors.
Small investment advisors
Advisors that are not required to register with the SEC are among the rule's examples.
Ohio insurance agencies
Generally under Ohio's own insurance data security law rather than this FTC rule. The work is similar, and our Safeguards Rule post covers both.
How it works
From a blank template to a signed program.
First call
What you have now
How many people, what software you use, where client files live, and whether you already have a plan.
Interview and inventory
We take stock
A sit-down with you, plus a look at the computers, accounts and vendors themselves.
Draft and fixes
The program and a gap list
You get the draft and a short list of what must change before it is true. We do the fixes.
Every year
Signed, then kept current
Your advisor reviews it, you sign it, and we put the yearly review on the calendar.
What the rule asks for
Section 314.4, in plain terms.
This is our summary, not legal advice. Read the rule itself, and have your attorney or advisor review your program.
A Qualified Individual
One person in charge of the program. It can be an outside provider, but the firm stays responsible and names a senior person to supervise them.
A written risk assessment
What could expose customer information, and how each risk is handled.
Safeguards that match the risks
Access limited to staff who need it, an inventory of data and systems, encryption, MFA for anyone signing in to any information system, secure disposal, change management and logging.
Testing
Continuous monitoring, or an annual penetration test plus vulnerability scans at least every six months.
Training and vendor oversight
Security training for staff, and contracts that require your vendors to protect customer data.
A plan for incidents, and a yearly report
A written incident response plan, a yearly written report to the owners, and notice to the FTC within 30 days when unencrypted information on 500 or more consumers is taken.
Firms holding customer information on fewer than 5,000 consumers are exempt from four of these: the written risk assessment, the monitoring-or-testing requirement, the incident response plan and the yearly report (section 314.6). Everything else still applies.
Sources: 16 CFR Part 314 on eCFR, the FTC's Safeguards Rule guide for businesses, and IRS Publication 5708 for tax professionals. Ohio insurance agencies fall under Ohio Revised Code Chapter 3965 instead. Ohio's section 1354.02 gives a business whose written program reasonably conforms to a recognized framework an affirmative defense in some data-breach lawsuits; ask your attorney how it applies to you.
FAQ
Questions people ask first.
Something not covered here? Call (330) 305-2750 and ask. You get Noah, not a menu.
Talk directly with the owner
Get a WISP you can stand behind.
Tell us about your firm and what you have now, even if it is a blank template. You get a written quote, and we start with what puts client data most at risk.
Monday-Friday, 8:00 AM-5:00 PM Eastern. Based in East Canton, working across Northeast Ohio.