The short version
WISP stands for written information security plan. It’s a document describing how your firm protects the client data it holds: what data you have, who can reach it, what safeguards are in place, who’s responsible, and what happens if something goes wrong.
Two things make it different from a general security policy. It has to be written, and it has to be specific to your firm. A generic template with your name on the front doesn’t meet the intent, and it won’t survive anybody looking closely.
Who it applies to
Broadly, firms that prepare tax returns or otherwise handle taxpayer data. That’s most accounting practices, many bookkeepers, and some financial advisors. The obligation sits with the firm, not with individual staff.
If you’re unsure whether it reaches you, that question is worth ten minutes with your professional association or your attorney. It’s a cheaper conversation than the alternative.
What actually goes in one
Firms expect this to be a technical document. It’s mostly not.
An inventory of what you hold. What client data the firm has, where it lives, and which systems and people touch it. Most firms have never written this down, and building it is the step that surfaces the surprises.
A named person who owns it. Someone at the firm is responsible for the plan. That person doesn’t have to be technical. They have to be accountable.
A risk assessment. What could go wrong, and how likely and serious each of those is. This doesn’t need to be elaborate. It needs to be honest and specific to how your firm works.
The safeguards you have in place. Access control, multi-factor authentication, encryption, backups, how you dispose of old equipment and paper, and how staff get trained.
Vendor arrangements. Who else touches your data, and what your agreements with them say about protecting it.
An incident response plan. Who gets called, in what order, and what you tell clients. Writing this while calm is dramatically easier than writing it during an incident.
A review cadence. The plan gets revisited, usually annually, and whenever something significant changes.
The part firms find hardest
It isn’t the writing. Once the decisions exist, the document comes together quickly.
The hard part is evidence. A plan that says you review access quarterly is worth very little if nobody can show the reviews happened. The firms that struggle at audit or renewal are the ones whose plan describes an aspiration rather than a practice.
The way through this is to build the plan around what your systems record automatically. If access changes, backup tests, and patch status are logged as a by-product of normal operation, the evidence is already there when someone asks. If they depend on a person remembering to write something down, the evidence won’t be there.
What it costs
Less than firms expect, and the cost is mostly front-loaded.
The inventory and the risk assessment take real time, usually a few sessions with whoever knows how the firm works. The safeguards are a mix: some are configuration changes that cost nothing, some need budget. The document itself is the quickest part.
After the first year it becomes a review rather than a project.
A sensible order
Start with the inventory, because everything else depends on knowing what you hold. Then look honestly at your current safeguards and sort the gaps into what closes cheaply and what needs planning. Write the plan once those decisions exist rather than before. Then set the review date and put it in the calendar.
Firms that try to write the document first almost always rewrite it.
Where we come in
Several FlexPath companies do this work for accounting firms in their markets, and it’s one of the most common reasons a firm calls us in the first place. We handle the inventory and the assessment with you, close the gaps that are configuration rather than purchase, and set the environment up so the evidence exists without anyone maintaining a spreadsheet.
If your firm’s plan doesn’t exist yet, or exists as a template someone downloaded, that’s a normal place to start from.
This is general information, not legal, tax, or compliance advice. Requirements change and vary by firm. Confirm your firm’s obligations with your professional association or your attorney.
