Your PTIN renewal asks if you have a security plan. Keep one you can prove.
When you renew your PTIN, you confirm you have a written information security plan, and you sign that renewal under penalty of perjury. The free IRS template gets you a document. WISP Manager keeps it alive: who's responsible, what you've done, the proof, and a reminder when it's time to review.
$59 a month per firm · all your staff included · month to month · 30-day money-back guarantee
- Qualified Individual namedaccepted
- Written plan approvedversion 2
- Two-step sign-in on every login4 of 4
- Staff training recorded3 of 4
- Service providers reviewed2 of 5
The plan is free. The proof is the work.
Anyone can hand you a template. Keeping it true is the hard part.
The IRS publishes a free WISP template, and plenty of people will fill it in for you. We start you with one too. But a plan you wrote once and filed away doesn't show that anyone is responsible, that the safeguards are really in place, or that you looked at it again this year.
A template on its own
Free from the IRS (Publication 5708)
- A document that says what you intend to do
- Filed once, rarely opened again
- Nothing to show it was done
- No one reminding you it's out of date
WISP Manager
$59 a month per firm
- The same starting plan, with versions and a recorded approval
- A checklist of safeguards with your proof attached to each one
- Training, service providers and incidents logged as they happen
- A reminder before your yearly review is due
What's included
Everything the plan says you do, in one place.
Built around the FTC Safeguards Rule and IRS Publication 4557, the two things a tax preparer's security plan answers to.
A named Qualified Individual
One person responsible for the program, with the say on approving the plan.
FTC 314.4(a)Your written plan, with history
Starts as a draft based on IRS Publication 5708. Every version is kept, with who approved it and when.
IRS Pub 5708Safeguards, with proof attached
24 safeguards, from two-step sign-in to encryption to backups. Mark each one done and upload the screenshot or document that shows it. Each file is fingerprinted when it's uploaded, so you can show it hasn't been changed since.
FTC 314.4(c) · IRS Pub 4557Risk assessment
What could go wrong with client data, how likely and how bad, and what you're doing about it.
FTC 314.4(b)Training, vendors and incidents
Who was trained and when. Which service providers touch client data and when you last checked them. Every incident, and what you did.
FTC 314.4(e), (f), (h)The FTC 30-day clock
Log a breach affecting 500 or more people and WISP Manager works out the date your FTC notice is due.
FTC 314.4(j)How it works
Three steps, then a little each month.
Subscribe
One price per firm, paid by card. Your firm's workspace is created in a minute, and you get a sign-in link by email.
Set up your login
Choose a password and add an authenticator app. Invite your staff and name your Qualified Individual.
Work the checklist
Fill in your plan, mark safeguards done and attach the proof. Your dashboard shows what's left, and we remind you when the yearly review is coming up.
The dates that matter
Deadlines someone else set.
PTIN renewal season
Renewing (Form W-12) includes confirming you have a written information security plan.
Every PTIN expires
Renew before the year ends to keep preparing returns for pay without a gap.
FTC breach notice
If unencrypted information of 500 or more people is exposed, the FTC must be told within 30 days of discovering it.
Pricing
One price per firm. Your whole team included.
No setup fee, no contract, no charge per person.
- Starter written plan based on IRS Publication 5708
- Safeguards checklist with evidence uploads
- Risk assessment, training log, vendor list and incident log
- A record packet you can print for your PTIN renewal
- Yearly review reminders
- Two-step sign-in on every login
- Support by email and phone, 8am to 6pm ET, Monday to Friday
One office per subscription · Billed monthly by card through Stripe
30-day money-back guarantee. If it isn't right for you, we refund your first payment.
More than one office? Talk to us and we'll set it up with you.
Straight answers
What you should know before you buy.
We'd rather tell you now than have you find out later.
01It's software, not legal advice
WISP Manager helps you do the work and keep the proof. Using it doesn't make you compliant on its own, and it doesn't replace advice about your firm's obligations.
02We don't write your plan for you
You start with a draft and fill in your firm's details. If you'd rather iTech put the safeguards in place and keep them running, that's a separate service. Ask us.
03Your records stay yours
If a payment fails or you cancel, your account turns read-only: you can still open and print everything. After cancelling you have 30 days before sign-in closes, and you can ask us for a copy any time.
04No badges, no promises we can't keep
We don't claim certifications we don't have or promise an uptime number. We run it on servers we manage, and we answer the phone.
Not ready to buy? Start with the checklist.
What a written information security plan covers, in plain English, on one printable page. Free, no email needed.
Isn't the IRS template free?
Yes, and we start you with a draft built on it. What you're paying for is keeping the plan current and keeping the proof behind it: who's responsible, which safeguards are in place, training, service providers, incidents, and a record of each yearly review.
Will this make me compliant?
No software can promise that. WISP Manager gives you the structure and keeps the records; you and your team do the work. If you want us to put the safeguards in place for you, that's a separate service we can talk through.
Who at my firm uses it?
Whoever you invite, at no extra cost. Usually the owner, the person responsible for security (your Qualified Individual) and each staff member, who records their own training.
Do I need to be technical?
No. It's a website with a checklist. You'll need an authenticator app on your phone for two-step sign-in, and we can walk you through that.
What if a payment fails, or I cancel?
Your account turns read-only, so you can still view and print everything. After cancelling, you have 30 days before sign-in closes. Ask us any time for a copy of your records.
We have more than one office.
Each subscription covers one firm at one office. Talk to us and we'll set up the others with you.
What if it isn't right for us?
Tell us within 30 days of your first payment and we'll refund it in full. We'd rather lose the sale than keep money for something that didn't help.
Who's behind this?
iTech Plus, an IT support company in Davenport, Florida. We run WISP Manager ourselves, on servers we manage.