The FTC Safeguards Rule and your WISP
Under the Gramm-Leach-Bliley Act, tax preparers and many accounting firms are considered financial institutions, which brings them under the FTC Safeguards Rule. The rule requires a written information security program, a designated person responsible for it, a risk assessment, and safeguards such as access controls, encryption, and multi-factor authentication. IRS Publication 4557, Safeguarding Taxpayer Data, walks tax professionals through these expectations and points them to a written information security plan, often called a WISP.
Many firms have a WISP template sitting in a folder that no longer matches how the office actually works. We help you build or update a plan that reflects your real systems, then put the technical safeguards in place to back it up. You get documentation you can stand behind and controls that work. When a client, insurer, or regulator asks, you can show what you do.