For tax preparers, EAs & CPA firms

A WISP that holds up, because the controls are actually on.

Every paid preparer needs a written information security plan. We write yours in a week, and we verify the MFA, encryption and backups it describes, on screen, with evidence.

Book WISP in a Week Free checklist (PDF)

Best done before filing season, while you have time and before seasonal staff log in.

Your WISPwritten + verified

MFA on email, tax software & portalVERIFIED
Disk encryption on every deviceVERIFIED
Backups, with a test restoreVERIFIED
Remote access locked downVERIFIED
Vendor list & contract checkDOCUMENTED
FTC + Florida breach playbookDOCUMENTED

Screenshots go into your evidence file, so the plan matches the office.

Why it matters

The requirement is already on the books.

There is no new deadline this season. The rule already applies to you, and the IRS reminds preparers of it every year.

16 CFR Part 314

FTC Safeguards Rule

Tax preparation businesses are "financial institutions" under the rule. You need a written information security program with a designated Qualified Individual, MFA for anyone accessing systems with client data, encryption, staff training and oversight of your service providers.

A breach involving 500 or more consumers must be reported to the FTC within 30 days.

Form W-12 · line 11

Your PTIN renewal

When you renew your PTIN, the form asks you to confirm you are aware that paid preparers are required by law to create and maintain a WISP.

That is an acknowledgment of awareness, not proof of a plan. If there is ever a breach, the first question is where the plan is.

Fla. Stat. 501.171

Florida breach notice

Florida requires reasonable measures to protect personal information. A breach affecting 500 or more Floridians must be reported to the Florida Department of Legal Affairs within 30 days. Your plan should cover both the FTC and the Florida notice.

16 CFR 314.6

Small office? Most of it still applies.

Firms holding information on fewer than 5,000 consumers are exempt from a few parts: the written risk assessment, the testing schedule, the written incident response plan and the annual report. They are not exempt from the Qualified Individual, MFA, encryption, training or vendor oversight. We will tell you which parts apply.

General information, not legal advice.

The difference

Plan written and controls verified.

A template that says MFA is on everywhere, when one tax software login is not, is worse than no plan at all after a breach. That gap is the first thing people ask about.

What you get	Template or docs-only WISP	Gill's IT World
A written plan mapped to 16 CFR 314.4 and IRS Pub 5708	Yes	Yes
MFA checked on email, tax software, portal and remote access	You check it yourself	Verified on screen with you
Disk encryption and backups confirmed	Assumed	Screenshots in your evidence file
External scan of your domain and public IPs	Not included	Included, with your written OK
FTC and Florida breach-notice playbook	Usually FTC only	Both
Someone who can fix the gaps	Not included	Fixed-price option

Fixed prices

Pick the level that fits your office.

All work is done remotely by screen share. You stay in control of your screen and your systems the whole time.

Front door

WISP in a Week

$995 fixed

1 to 5 people · +$125 per extra person up to 15
5 business days · one-time, not annual

Short online intake about your systems, software and vendors
45-minute screen share to verify MFA, encryption and backups
External scan of your domain and public IPs, with written authorization
WISP mapped to 16 CFR 314.4 and IRS Pub 5708
FTC and Florida 501.171 breach-notice playbook
Vendor list, staff acknowledgment sheet and ranked gap list
One-page memo for your PTIN line 11 file

Your plan describes what is really set up, not what a template assumes.

Book WISP in a Week

Fix it

WISP + Controls

from$2,950

up to 5 people · $4,500 for 6 to 15
fixed price

Everything in WISP in a Week
MFA enforced everywhere: email, tax software, portal
Disk encryption turned on, with recovery keys stored safely
Backups configured and test-restored
Endpoint protection deployed
Stale and seasonal accounts removed
Phishing training session with sign-in sheet
"Controls verified" evidence binder for insurance applications

For offices that want the gaps closed, not just listed.

Ask about Controls

Stay current

Qualified Individual support

from$395 / month

1 to 3 people · $695 for 4 to 10
$995 for 11 to 25 · 12-month term

Ongoing support for the person who oversees your security program
Quarterly external vulnerability scans
Monthly MFA, patch and backup evidence
Annual WISP update and staff training
Draft annual written security report to the owners
Vendor reviews
Incident help, including FTC and Florida notice drafting

Your firm keeps responsibility for its program. We keep the evidence current.

Ask about QI support

PDF

Free WISP Readiness Checklist

One page, with each item tied to the FTC rule or IRS guidance, and the small-firm exemptions marked. Check what is true and documented today.

Download the checklist

FAQ

Straight answers.

Is there a WISP deadline this season?

No new deadline. The requirement already applies to paid preparers. The practical window is before filing season, because nobody has time for a security project between February and April 15.

Will you just send us a template?

No. The plan is written around your office: your tax software, your portal, your email, your devices and your vendors. Then we check that the controls it describes are really turned on.

Do you need logins to our tax software?

No. We use a screen share where you drive. We look at settings with you and take screenshots for your evidence file.

We are a two-person office. Does this apply to us?

Yes. Small offices are exempt from a few parts of the rule, but not from the Qualified Individual, MFA, encryption, training or vendor oversight. We will mark exactly which parts apply to you.

Can you be our Qualified Individual?

The rule allows the Qualified Individual to work for a service provider, with a senior person at your firm overseeing them. We offer Qualified Individual support today and will talk through the right setup for your office.

Is this legal advice?

No. We handle the security and the documentation. Questions about your legal obligations should go to your attorney.

Next step

Get your WISP done before filing season.

Email to book WISP in a Week. Five business days, one 45-minute screen share, and a plan that matches your office.

Email to book Get the free checklist

or write to gill@gillsitworld.com