Solutions / Tax preparers & CPA firms
Every return season, a plan that holds up.
Your practice needs a written information security plan under the FTC Safeguards Rule. We write yours, put the controls behind it in place, and review it every year before e-file opens.
- 9elements
- The Safeguards Rule expects in every plan. We cover all of them.
- 20min
- Is all we need from you to start writing.
- 30min
- Staff briefing, seasonal preparers included.
- $600/yr
- Solo practice up to 10 preparers. Yearly review included.
Your off-season
Done before the phones start ringing
Most of the work happens in November and December, when you have time to answer questions.
Your off-season plan
Ready before e-file opensLate Oct · now
20-minute call
How your office handles client data: software, email, files, staff.
November
Your WISP, written
In your words, following IRS Publication 5708. You sign it and keep it.
December
Controls in place
MFA on tax software and email, encrypted laptops, backups that restore.
January
Season-ready
A 30-minute staff briefing, then we watch quietly while you work.
Questions from tax pros
What preparers ask us first
I downloaded a WISP template. Isn’t that enough?
A template is a starting point. The plan has to describe what you actually do, and the controls it lists have to be real. If you’re ever breached, that gap is the first thing anyone looks at.
I’m a solo preparer. Does this apply to me?
Yes. The FTC Safeguards Rule covers paid preparers of every size, and the IRS reminds every preparer of it at PTIN renewal. A solo plan is shorter, but it still has to exist and match how you work.
Will you need access to client returns?
No. We look at how your office is set up: logins, computers, email and backups. We never need to open a client file or a return.
Does this work with my tax software?
Yes. We don’t replace it. We turn on the security settings it already has, like two-step login, and keep the computers that run it patched.
What happens if we have a breach mid-season?
Call us first. We help you contain it, and your plan already lists who else to tell, including your IRS Stakeholder Liaison, your state and your insurer.
Other businesses we look after
- Medical & dental practicesHIPAA Security Rule
- Contractors & home servicesWebsite leads and payment fraud
- Manufacturers & distributorsRansomware and supplier requirements
- Retail shopsPCI DSS for card payments
- Restaurants & cafésPCI DSS for card payments
- Consultants & agenciesClient security questionnaires
- Salons, spas & gymsBooking and payment data
- Auto dealers & repair shopsFTC Safeguards Rule for dealers
- Nonprofits, schools & childcareDonor, family and student data
- Real estateWire fraud at closing
- Law firmsDuty of client confidentiality
- Financial & insurance officesFTC Safeguards Rule and state insurance laws