If you prepare tax returns, the FTC Safeguards Rule applies to your firm the same way it applies to a bank, and the IRS puts the requirement in front of you every time you renew your PTIN. Most firms don't have the plan. We write it, from your real environment, in about a week.
Serving CPA, tax and accounting firms in South Florida.The requirement
A Written Information Security Plan is a document that states how your firm protects taxpayer data. It names the person accountable, records the risks you identified, describes the safeguards you chose in response, and is reviewed at least once a year.
It is a document, not software. No product exists that is your WISP.
The obligation comes from the Gramm-Leach-Bliley Act, which treats a firm that prepares returns as a financial institution. That puts you under the FTC Safeguards Rule, 16 CFR Part 314. IRS Publication 4557 covers the same ground for tax professionals specifically.
You have probably already been told. Form W-12, the PTIN renewal, asks you to check a box acknowledging that the law requires you to create and maintain a written information security plan. Checking it does not say you have one. It says you knew you needed one. That is a narrower thing than compliance, and a much harder thing to walk back.
Who is accountable
Ask a firm who handles their security plan, and the answer is almost always the same:
"Our IT company handles that."
Your IT provider keeps your systems running. Configuring a system and documenting a compliance program are two different jobs, and the second one is almost never in their scope of work.
There is an easy way to find out. Ask yours for your written risk assessment, your data inventory, or last year's report to your partners. If those come back, you are in better shape than most firms. In our experience they do not come back at all.
The rule is also specific about who owns this. Your Qualified Individual has to be a person at your firm. The risk assessment records which risks your firm accepts. The annual report goes to your own leadership, signed. None of that is delegable to a vendor, which is why forwarding it to IT usually ends with nothing happening and the obligation still sitting with you.
And there is a conflict you cannot design around.
Under the same rule, your IT provider is one of the vendors your firm is required to assess. Asking them to write the program that evaluates their own work is not independent review, and it is not what the rule contemplates.
The engagement
Documents your firm adopts as its own, built from what is actually running in your environment, not a template with your name typed into it.
The written plan itself, covering every element the Safeguards Rule requires, populated with your real systems and your named Qualified Individual.
A documented assessment of foreseeable risks to client data and the safeguards chosen in response, dated and current within twelve months.
Roles, escalation, and the notification contacts you would need on the worst day, decided in advance rather than during.
Every vendor that touches client data, the due diligence behind each one, and the contract language obliging them to safeguard it. Your IT provider is on this list, not exempt from it.
The written report your Qualified Individual owes the firm's leadership each year, covering the program's status, the risks accepted, and what changed.
The artifacts behind each control, timestamped and retrievable, so when your insurance carrier asks, the answer takes minutes instead of weeks.
After the plan is written
The Safeguards Rule expects a program that is maintained, not a document with a date on it. That is the part firms lose track of, and it is the part we keep running for you.
Your environment is re-checked automatically. If a control drifts, an admin account appears, or a setting is turned off, you hear about it that month rather than a year later.
You are prompted on the items that expire: backup restore tests, EFIN activity review, staff training, and vendor confirmations. Nobody has to remember four separate calendars.
A signed written report to your firm's leadership covering what changed, what was found, and what was closed. The rule requires it, and almost no firm produces one.
No cost, no obligation
One of the twenty-three controls your firm must document can be checked from outside, using only your domain's public DNS records. That is the same information every mail server on the internet reads before accepting a message from you.
You send your firm's domain name. Nothing else.
No credentials, no access, nothing installed. Your systems are never touched.
You get a written report with the findings, what each one means, and the citation behind it.
Whether or not anything comes of it, you keep the report.
Who you would be working with
Network and Cloud Engineer
I have spent years administering Microsoft 365, Entra ID, Intune, SQL Server and enterprise networks for financial services companies and accounting firms in Miami. Those are the same environments this work is about.
That background is the reason this is not a template exercise. When a report says your device encryption cannot be verified, it is because I looked at how your environment is actually configured and know what evidence an auditor will accept for it.
You work directly with me. The person who assesses your environment is the person who writes your plan and puts his name on it. No account manager, no handoff, and nobody learning on your file.
Contact
conde@getuswisp.com
(305) 726-4103
Serving
CPA, tax and accounting firms across South Florida.
Entity
Montecristi Group LLC, Florida.