What a WISP is
A Written Information Security Plan, or WISP, is a document that describes how your office protects client information. It says what information you hold, who handles it, where it is kept, how it is protected, and what you do if something goes wrong. Writing it down means you, your staff, and any outside help all work from the same rules.
Many tax offices start with IRS Publication 4557, Safeguarding Taxpayer Data, and the FTC Safeguards Rule, which are common references for this topic. Read both to see which subjects they cover, then adapt those subjects to the size and habits of your office.
Why a small office needs one
A one-person practice and a ten-person office face the same kinds of risk: a stolen laptop, a phishing email that looks like it came from a software vendor, a former employee who still has a login, or a paper file left on the copier. A written plan turns good habits into routines that do not depend on anyone's memory.
Step 1: Inventory what you hold
List every kind of client information that comes through the door, by email, or through the portal. Most small offices hold more than they expect.
- Tax returns, organizers, and working papers, including Schedule C records
- Bank and card statements that clients send you
- Social Security numbers, bank account and routing numbers, and copies of identification
- Signed consent forms and engagement letters
- Email threads and text messages with clients
For each item, ask: How does it enter the office? Where is it stored? Who can open it? How long do you keep it, and how do you dispose of it?
Step 2: Name a person in charge
Give one person responsibility for the plan, even if the office has only two people. That person keeps the document current, answers staff questions, and decides what to do when an exception comes up.
Step 3: Write the controls
For each area, write what the office actually does, not what it hopes to do. Be specific enough that a new employee could follow it.
- Access: who can see which client files, and how access is removed when someone leaves
- Sign-in: unique passwords, and two-step verification on email, tax software, and cloud storage
- Devices: screen locks, encryption on laptops and phones, and rules for personal devices
- Email and file sharing: how documents are sent safely, and a rule against sending full Social Security numbers in plain email
- Paper: locked storage, a shredder, and a clear-desk habit
- Backups: where copies are kept and who can restore them
- Updates and antivirus on every computer
- Vendors: which outside services hold client data and how they protect it
Step 4: Train the staff and test the plan
A plan nobody reads does little good. Review it with everyone in the office before the busy season begins. Then walk through a simple scenario: a client reports that an email with their documents went to the wrong address. Who calls whom? Who checks the sent folder? What gets written down, and by whom?
Step 5: Plan for an incident
Your plan should say what happens when something goes wrong, before it happens.
- A contact list: the responsible person, your IT help, and a professional adviser
- Steps to isolate a compromised computer or account
- Steps to change passwords and remove access
- A decision process for when and how clients are told
- A written log of what happened and what was done about it
Step 6: Review and update
Review the plan on a regular schedule, and also whenever you add a new tool, hire or let go of staff, move offices, or change how clients send you documents. Record the date of each review at the top of the document so you can show when it was last checked.
Common mistakes
- Writing the plan once and filing it away
- Listing controls the office does not actually use
- Forgetting paper files, shared printers, and phones
- Leaving former staff with active logins
- Writing vague sentences such as "client data is kept secure" with no steps behind them
This guide describes general office practice. It is not legal advice. For questions about your specific obligations, speak with a qualified professional.
How AnalytixData helps
The portal generates a Written Information Security Plan with fifteen sections from a few answers about your office, based on IRS Pub. 4557 and the FTC Safeguards Rule. Files are encrypted, sign-in uses two-step verification, and every firm's data is kept separate. You still review the plan and make it match how your office really works.
A practical guide for tax offices; not tax or legal advice for a specific situation.