WISP builder: a first draft of your firm's security plan
Answer a few questions about your firm and its systems, and get a written information security plan with your answers filled in and every gap marked for you to complete.
The FTC Safeguards Rule treats a tax preparation firm as a financial institution, and requires a written information security plan of every one, whatever its size. The IRS and the Security Summit publish a sample in Publication 5708. This WISP generator follows that sample's sections, from the objective to the implementation clause, and adds the parts of 16 CFR 314.4 the sample covers lightly: the written risk assessment, encryption, change management, testing, the incident response plan and the annual report.
Your answers change the plan, not just the blanks. A firm holding information on fewer than 5,000 consumers is relieved of four of the rule's requirements, and the plan says which. No remote work, no remote access section; an outside IT provider as Qualified Individual, and the plan names who at the firm oversees them. For the elements on their own, see the WISP template.
Before you use this
A starting draft, supplied as-is, with no guarantee. It is general information, not legal or security advice, and having it does not make a firm compliant with the Safeguards Rule. Complete every bracketed item, check each statement is true of your firm, and have a qualified adviser review the plan before you adopt it. FirmHello accepts no responsibility or liability for any use made of it.
Where a client portal fits in the plan
The plan says client documents are not sent by plain email. FirmHello is a client portal: you send a request list, the client uploads against it, and the reminders go out until it is complete. It does not write or check security plans, and it does not make a firm compliant. Whichever portal you choose, FirmHello included, treat it as a service provider under section IX and assess it like any other vendor that can see client data. More on the client portal for accountants page.