Federal law requires every tax preparation firm, of every size, to maintain a written information security program (FTC Safeguards Rule, 16 CFR 314.3(a)). We build yours from a questionnaire about your actual software, devices, staff, and vendors — every answer reviewed in-house by a Client Verification Specialist — and hand you the plan plus the evidence file behind it.
The problem — facts, not fear
The requirement isn't new, and it isn't optional. What most small firms are missing isn't effort — it's a plan that describes their firm, built before the day it's needed.
Form W-12 — the PTIN application and renewal every paid preparer files — line 11 asks you to acknowledge that paid tax return preparers are required by law to create and maintain a written information security plan. All PTINs expire December 31. Renewal season is when the question gets asked; the plan has to exist before the answer is given.
Tax preparers are financial institutions under the Gramm-Leach-Bliley Act (16 CFR 314.2(h)(2)(viii)). IRS Publication 5708 says the WISP requirement applies “regardless of size.” Firms under 5,000 consumers are exempt from four specific paragraphs of 16 CFR 314.4 — we explain them in writing to every client — but the program itself, the risk assessment it's based on, MFA, encryption, training, vendor oversight, and FTC breach notification apply to everyone.
The IRS's own guide says “there is no one-size-fits-all WISP” and that a plan should be developed from the specific needs of your business. A plan that claims safeguards you haven't actually turned on is worse than an honest gap list — after an incident, it's the first thing an insurer or investigator reads.
It's the day a laptop is stolen, an email account is taken over, or an insurer asks for your documentation. The clocks are short and they don't match each other: the IRS expects data theft reported to your stakeholder liaison by the next business day; the FTC must be notified within 30 days when 500 or more consumers' unencrypted information is acquired (16 CFR 314.4(j)); state deadlines run by where your clients live. A plan written in advance, with those steps pre-drafted, is the difference between a bad week and a catastrophe.
What you get
The Core WISP Build creates the plan from your firm's real facts. Safeguards Year keeps it current — because the rule requires the program to stay current, and a plan written once and shelved ages out fast.
One-time build · Word and PDF · Every item below included
Built from IRS Publication 5708's outline, mapped clause-by-clause to 16 CFR 314.4(a)–(j), naming your actual software, devices, and vendors.
Built from your reviewed answers, with stated evaluation criteria and mitigate/accept decisions you approve and sign (314.4(b)).
Every device, system, and authorized user, and what each user can reach (314.4(c)(1)–(2)).
Checked answer by answer, system by system, in our in-house review. Settings, never passwords — and if anything needs clarifying, we reach out by email. Exceptions are documented honestly, with compensating controls your Qualified Individual approves (314.4(c)(3), (c)(5)).
Every provider that can touch client information, whether its contract actually commits it to safeguards, and a reassessment date (314.4(f)).
Roles, steps, and the real notification clocks, including pre-drafted FTC notification content and a matrix for the states your clients live in (314.4(h), (j)).
A session outline tied to your firm's own risks, a plain-English rules-of-behavior sheet your staff will actually read, and signed acknowledgment forms (314.4(e)(1)).
Your owner designated as Qualified Individual, with duties spelled out and an annual-report template (314.4(a), (i)).
An indexed file behind the plan, so each element can be produced on request.
Everything not yet in place, each item with a fix and a date. We don't write aspirations into your plan as facts.
Ongoing · Keeps the program current under 314.4(g)
The rule requires the program to stay current (314.4(g)) — a plan written once and shelved ages out fast. Safeguards Year includes:
Free to join · No obligation
Pricing
No per-seat fees. Optional extras — for example, notification matrices for firms with clients in many states, or extra training sessions for new staff — are priced before any work starts.
The full build for a solo preparer or a small team of up to three: plan, risk assessment, verification, incident plan, training pack, and evidence binder.
The same complete build, sized for a firm of four to ten — more devices, more users, more vendors, all documented the same careful way.
Keep the program current: annual re-issue before PTIN season, quarterly briefs, rule-change amendments, and incident support while you work your plan.
Accuracy commitment: if any citation, deadline, or rule statement in your plan is wrong as of its issue date, we correct it and re-issue free; if we can't, we refund the build fee. That's a promise about our work — the only kind of promise a document service can honestly make.
How it works
Your only job is the questionnaire. Your intake is personally reviewed by a Client Verification Specialist in-house, and your plan is delivered within two business days (Monday–Thursday) of your submission.
Operational facts only: staff, software, devices, vendors, office setup — answered firsthand, by whoever knows each part of your firm. The form itself tells you what never to send — no client data, no credentials. When you submit, your confirmation is instant.
Your intake is personally reviewed by a Client Verification Specialist — a person, not a program — who checks every answer we received against the Safeguards Rule and your firm's own facts. If anything needs clarifying, we reach out by email. Nothing unconfirmed is written into your plan as fact; it goes on the gap list with a fix and a date.
We write your plan around your firm — the plan itself, the incident response plan, the evidence binder, and your gap list — and deliver it within two business days of your submission. A Friday submission is delivered by Tuesday.
You review the finished plan and sign its adoption page as your firm's Qualified Individual — that's what puts it in force. If you choose Safeguards Year, the annual review cycle starts from your signing.
A sample plan from a fictional firm — yours is built from your firm's own answers.
You've seen what it costs and how it works — the questionnaire is step one, about 30 minutes.
Another kind of financial institution — finance company, collection agency, check casher, auto dealer? More doors are coming. Email wisptrust@gmail.com and tell us your industry.
Straight answers, with the citations, so you can check every claim yourself.
WispTrust builds Written Information Security Programs for tax firms, operated by MVP Forge LLC. Our work is verification: you submit your firm's information on the intake form, and a Client Verification Specialist reviews every answer in-house — a person, checking your answers against the FTC Safeguards Rule — before your plan is built. If anything needs clarifying, we reach out by email; nothing is written into your plan as fact that your answers don't support, and anything unconfirmed goes on the gap list instead. The plan itself is built clause-by-clause against the FTC Safeguards Rule (16 CFR Part 314), following the outline in IRS Publication 5708 — your firm's verified information, structured to the federal rule. It is not a template pulled from a database. We are not a law firm, a tax advisor, or a security firm; we do not design your security, and we never receive or hold your client data. You review the finished plan and sign it as your firm's own Qualified Individual.
Yes — the requirement does not have a size floor. Preparers are financial institutions under the GLBA because of the work itself (16 CFR 314.2(h)(2)(viii)), and IRS Publication 5708 states the WISP requirement applies regardless of size. What size changes is narrower: firms maintaining information on fewer than 5,000 consumers are exempt from four paragraphs of 314.4 (the written form of the risk assessment, the penetration-testing regime, the written incident-plan requirement, and the QI annual report). The program itself, and elements like MFA, encryption, training, vendor oversight, and FTC breach notification, apply to you in full. We explain your exact position in writing as part of every build — and we document the exempt elements anyway, because your program still has to be based on a risk assessment and the notification duties still run on incident day.
Publication 5708 includes a sample plan, and it's a reasonable starting outline — we build from it. But the publication itself warns it is “not intended to serve as a substitute for developing your own plan based upon the specific needs and requirements of your business,” and that there is no one-size-fits-all WISP. The difference between the sample and this service is the work: a real risk assessment, in-house verification of your actual answers and settings, a vendor contract check, an incident plan with your real contacts and clocks, and an evidence file. A filled-in sample describes a firm that may not be yours.
No one can promise that, and you should be suspicious of anyone who does. Compliance is your firm's conduct plus its controls, every day — no document confers it. What we can promise is narrower and checkable: your plan will be built from your firm's actual facts, mapped to the current rule text, with every unverified item on a gap list instead of written in as fact, and any citation or deadline we get wrong corrected and re-issued free (or your build fee refunded). Whether the program is operated is, and remains, your firm's responsibility.
Banks follow a sister rulebook. The same federal law — the Gramm-Leach-Bliley Act — requires every financial institution to maintain a written information security program. Banks answer to the Interagency Guidelines enforced by their own regulators (the OCC, Federal Reserve, or FDIC; credit unions follow the NCUA's version), so they're exempt from the FTC's rule. Your firm isn't a bank, so the FTC Safeguards Rule is your version of that same requirement — and it's the one WispTrust builds your plan to.
The build is $549 (solo / 1–3 people) or $749 (4–10 staff), one-time. Keeping it current is $49/month or $490/year if you want us to run the annual cycle with you — optional, and you can do the annual review yourself with the checklists in your binder. There are no per-seat fees. Optional extras exist (for example, notification matrices for firms with clients in many states, or extra training sessions for new staff) and are priced before any work starts.
Your time: about 30 minutes on the questionnaire — there is no call. Your submission confirmation is instant. A Client Verification Specialist reviews your intake within one business day, and your plan is delivered within two business days of submission — business days are Monday–Thursday, so a Friday submission is delivered by Tuesday. If anything needs clarifying, we email you within that first business day, and the delivery clock resumes when you answer. Then you sign the plan's adoption page. That's the whole timeline.
No — and we will refuse them if offered. We never receive taxpayer data, client lists, returns, or passwords. We work from your submitted answers only — we never log into your systems, and credentials are never typed or sent. If a setting needs confirming, we ask you about it by email. This protects you under the tax law restrictions on sharing return information (IRC §§7216 and 6713), and it protects the engagement: a plan service that holds no client data has no client data to lose.
You are. The rule (314.4(a)) requires a designated individual responsible for overseeing and enforcing the program; in our builds that's the firm's owner, designated in writing with duties spelled out. We provide QI support — we prepare the risk assessment, draft the annual QI report, and keep the review calendar — for the QI's review and signature. We do not act as your Qualified Individual.
You work your incident response plan: it has the contact card, the containment steps, and every notification clock pre-drafted. Safeguards Year clients can reach us by email for help executing the plan's checklists. Two things we are not: a forensic firm and a law firm. Your first calls in a serious incident are your attorney and your insurer — the plan says so, in that order.
No. We provide general information, documentation, and facilitation based on the published rule and IRS guidance. We don't advise whether a specific firm is compliant as a matter of law, and we don't make breach-notification decisions — those go to your attorney. We recommend every client have their attorney review the finished plan for their circumstances.
Final word
Every PTIN expires December 31, and line 11 of the renewal asks about the plan. Build it now, while the build can still be done carefully — and start January with a plan that's already true.
Write to wisptrust@gmail.com — tell us your firm size and we'll hold your place.