Security and compliance for tax practices
One binder for the IRS, the FTC and your insurer
The PTIN renewal asks if you know you need a written information security plan. Your insurer asks if you use MFA. We give you the controls, the paperwork that shows they’re real and a WISP template on every plan. On Managed IT plans we write the WISP with you and keep it current. No add-on fee either way.
15 minutes on a call. You get a written gap list either way. Or download the WISP template for tax preparers
Your binder, first tabs
- WISP, dated and signed by you
- MFA enrollment by user
- Restore test log, this quarter
- Incident response plan
What each rule asks, and how we cover it
These are the documents behind the questions you’re being asked. You stay responsible for your firm’s plan. Our job is to make the plan true and keep the evidence on file.
| Rule | What it asks | How we cover it |
|---|---|---|
| PTIN renewal (Form W-12) | You confirm you know paid preparers are required by law to create and maintain a WISP. It points to Pubs 5708 and 4557. | Every plan includes a WISP template. On Managed IT plans we write your WISP and keep it current. |
| IRS Publication 4557, Safeguarding Taxpayer Data | Tells tax pros to create a data security plan and take basic security steps. | Our controls are mapped to the publication’s checklist in your binder. |
| IRS Publication 5708 | Explains how to write a WISP for a tax and accounting practice. | Our template follows its structure. |
| FTC Safeguards Rule (16 CFR Part 314) | A written security program plus a qualified individual, risk assessment, MFA, encryption, staff training and vendor oversight. | MFA and encryption in every plan. Training and phishing tests in Managed IT. Vendor records in the binder. |
| FTC breach notification amendment | If unencrypted customer information on 500 or more consumers is taken without authorization, notify the FTC as soon as possible and no later than 30 days after discovery. | Our incident runbook counts affected records early and gives you what the FTC notice needs. |
| Cyber-insurance questionnaire | Usually asks about MFA, backups, EDR and training. Questions vary by carrier. | Your binder answers each one with dates and evidence, ready to copy onto the form. |
Read the source documents: IRS Form W-12, Publication 4557, Publication 5708, FTC Safeguards Rule breach notification. This is a plain summary, not legal advice.
The controls behind the paper
A WISP that describes controls you don’t have is worse than no WISP. Here’s what is actually running.
MFA on every plan
Server logins and Microsoft 365, with no per-user fee.
Encryption
In transit and at rest.
A private server for your firm
Your Drake, Lacerte or UltraTax data doesn’t share a server with another firm.
Server backups
Every 4 hours, kept 90 days.
A quarterly restore test
On every plan. We restore your data and write down how long it took. That log goes in the binder.
On Managed IT plans
EDR on laptops and desktops, email security, Microsoft 365 backup, staff training with phishing tests, and device setup when you hire for January. About Managed IT
Our own SOC 2 report
Plenty of hosts point to their data center’s SOC 2. That report covers the building, the power and the racks. It says nothing about who at the host can log in to your server or how they handle a password reset.
We’re audited ourselves [SOC 2 Type II, auditor and report period pending]. You can read the report [under NDA] and put it in your vendor file, which is the file the Safeguards Rule expects you to keep on service providers.
[Report available on request once issued.]
If something goes wrong
Say a preparer clicks a bad link at 4:40 p.m. on April 14. Here’s what happens next.
- We lock it down. Your named team of 3 engineers isolates the account and checks the logs to see what was touched.
- You hear from a person. You get a call, not a ticket number.
- We count the records. The FTC rule turns on one number: whether unencrypted data on 500 or more people was taken. Few incidents get anywhere near that line.
- You get the record. If an incident does cross it, the 30-day clock starts at discovery. You’ll already have the facts, the timeline and a draft notice.
Notifying states, clients and the IRS is still your call, and your attorney’s. We give you the record they’ll ask for.
What you get in the binder
One shared folder, updated as things change, so nobody rebuilds it in December.
- Your WISP, dated and signed by you
- Annual risk assessment
- Incident response plan and contact sheet
- Restore test logs, one per quarter
- MFA enrollment records by user
- Our SOC 2 report [under NDA] and a vendor list
- Training and phishing test records (Managed IT plans)
- A one-page sheet answering the questions insurers usually ask
Get the WISP template for tax preparers
Written for a 1 to 25 person tax practice, each section tied to Pub 5708, with notes on what to fill in and what to delete. Plan on an afternoon for a first draft.
[Form placeholder: replace this line with the email form shortcode once the email tool is chosen.]
One email with the file. No drip sequence.
Questions about WISPs and compliance
Do I really need a WISP if I’m a two-person office?
Form W-12 says paid preparers are required by law to create and maintain one, and it doesn’t carve out small firms. A small firm’s plan is shorter, but you still need one.
Does using your cloud make my firm compliant?
No host can promise that, and you should be wary of one that does. We run the controls and keep the evidence. You own the plan, the policies and how your staff follow them.
Is the WISP extra?
No. Private Cloud includes the template. Managed IT and the combined plan include a WISP we write with you and keep current. There’s no add-on fee either way. See plans and prices
What happens on the call?
15 minutes. We go through your current setup against the rules in the table above. Within 2 business days you get a written list of what’s covered and what’s missing. You keep it, sign or not.
Can I see your SOC 2 report before I sign?
Yes, [under NDA, once the report is issued].
Who notifies the FTC after a breach?
Your firm does. We give you the affected-record count, the timeline and a draft notice so you can file well before the 30 days are up.
Find out what your binder is missing
Bring your last insurer questionnaire or your PTIN renewal questions. In 15 minutes you’ll know which answers you can back up and which you can’t.
You get a written gap list either way. Or grab the WISP template first.