Free WISP starter checklist for tax preparers
What a written information security plan covers, in plain English. Print it, tick it off, keep it with your plan. It's a starting point, not legal advice.
1. People
- One person is named as your Qualified Individual, responsible for the security program.
- Everyone who handles client data has had security training, and you've recorded when.
- You know who has access to what, and you remove access the day someone leaves.
2. Your written plan
- A written information security plan exists. The IRS template, Publication 5708, is free.
- It lists your computers, software and where client data is kept.
- It has a risk assessment: what could go wrong with client data, and what you do about each risk.
- It has an incident response plan: who does what if data is lost or stolen.
- You review it at least once a year, and after any big change, and note the date.
3. Safeguards (IRS Publication 4557's "Security Six" and the FTC rule)
- Anti-virus software on every computer, kept up to date.
- A firewall on your network and computers.
- Two-step sign-in (multi-factor authentication) on email, tax software and anything with client data.
- Backups, with at least one copy kept separate from the office.
- Encryption on laptops, drives and anything client data travels on.
- A VPN or other secure connection when working away from the office.
- Old client data and devices are disposed of securely.
4. Proof
- For each safeguard, you keep something that shows it's in place: a screenshot, a receipt, a settings page.
- You keep a list of service providers that handle client data and when you last checked their security.
- You keep a log of security incidents, even small ones, and what you did.
- You know the FTC rule: a breach affecting 500 or more people's unencrypted information must be reported to the FTC within 30 days of discovery.
Sources: IRS Publication 5708 (Creating a Written Information Security Plan), IRS Publication 4557 (Safeguarding Taxpayer Data) and the FTC Safeguards Rule, 16 CFR Part 314. Some FTC requirements have exemptions for firms with fewer than 5,000 customers. This checklist is general information, not legal advice.