For Small Accounting, Tax, and Bookkeeping Firms
Use this form to document the firm’s information security program, responsible personnel, risk assessment, hardware inventory, safeguards, and employee code of conduct. Complete it during WISP creation and update it at least annually or after material changes to systems, staff, vendors, locations, or incidents.
Identify the person responsible for implementing, supervising, reviewing, and enforcing the WISP. If an outside service provider serves in this role, the firm still retains responsibility and should designate a senior internal person to oversee the relationship.
List all devices that store, process, transmit, print, scan, back up, or secure confidential information. Include office-owned, employee-owned approved devices, network equipment, printers, copiers, backup drives, and mobile devices.
Each employee, contractor, temporary worker, or authorized user with access to firm systems or client information should acknowledge the following conduct expectations.
This checklist is designed as a practical WISP documentation aid for small accounting and tax firms. It should be reviewed against the firm’s actual regulatory obligations, contracts, state law, insurance requirements, and professional guidance. It is not legal advice.
Key references used: FTC Safeguards Rule, 16 C.F.R. Part 314; FTC business guidance on the Safeguards Rule; IRS tax professional WISP guidance and data security expectations.