Build your firm's WISP in ten minutes.

The Safeguards Rule calls the owner the Qualified Individual. Usually a partner or the firm administrator.

Changes: Fills the cover, the scope statement, the Qualified Individual designation, and the state notification appendix.

Please complete every field.

Changes: Sets how deep the roles section goes: a solo owner with a named backup, a roles table with training records from six people, a security committee from twenty-one.

Pick one.

Count people, not households. Spouses and dependents on a return each count.

Changes: Under 5,000, the written risk assessment, penetration testing, incident response plan, and annual report are labeled recommended under the Safeguards Rule’s small-firm exception; at 5,000 or more they are labeled required.

Pick one.

Pick everything that applies.

Changes: Builds the information inventory: returns and Social Security numbers, payroll and employee data, access to client systems, investment data, and a card-payment section when needed.

Pick at least one.

Changes: Own EFIN adds the section on protecting the EFIN, PTINs, and IRS e-Services access, watching return counts during the season, and reporting theft to the IRS.

Pick one.

Changes: Chooses the physical safeguards: office access, visitors, locked storage, and shredding; home-office standards; a site list with an owner for each office.

Pick one.

Changes: Adds the remote work and travel rules: how systems are reached, screen privacy, public Wi-Fi, and lost-device reporting.

Pick one.

Changes: Shapes the workforce section. Overseas or outsourced help adds Section 7216 consent requirements, access limits, and a consent checklist.

Pick at least one.

Changes: Picks the device standard: managed devices only, mobile management for personal phones, or a personal-device policy with limits and an action item.

Pick one.

Changes: Writes the service-provider oversight section for an IT provider, or assigns the technical duties to a named person, or flags the gap.

Pick one.

Changes: Picks the systems variant: cloud vendor oversight, hosting provider evidence, local installs with encryption and backup, or a server with patching, physical protection, and a retirement plan.

Pick one.

Changes: Writes the platform baseline: sign-in policies, audit logging, data loss prevention, email authentication, and encrypted email.

Pick one.

Changes: Sets the transmission rules: the portal as the standard, no unencrypted attachments with Social Security numbers, paper handling. Regular attachments become an action item.

Pick at least one.

Changes: Builds the data map, encryption-at-rest and backup scope, and the retention schedule. Files on individual computers become an action item.

Pick at least one.

Changes: Writes the retention and disposal schedule. No rule, or never deleting, means the plan sets a schedule and asks the firm to confirm it.

Pick one.

Changes: The MFA policy covers every system with client data, with phishing-resistant sign-in as the standard. Anything less than everything becomes a dated action item.

Pick one.

Changes: Writes the monitoring, logging, and patching section. Antivirus or less becomes an action item.

Pick one.

Changes: Writes the backup and recovery section with a restore-test schedule. Untested or worse becomes an action item.

Pick one.

Changes: Writes the AI acceptable-use section: approved tools, prohibited data, and the Section 7216 question. Personal accounts become an action item.

Pick one.

Changes: Puts the insurer and breach counsel first in the incident response plan. No, or not sure, becomes an action item.

Pick one.