Tax office written information security plan (WISP) checklist

Tax Office with Hired Preparers | PublicProof Academy working document

Build and review the written information security program the FTC Safeguards Rule and IRS Publication 5708 describe.

Business

State or jurisdiction

Prepared on

Owner

Official source saved

Next review

Program basics

Qualified Individual named in writing
Written risk assessment completed (date)
Inventory of systems and places where client data is stored
WISP adopted and signed by owner

Safeguards

MFA on tax software, email, e-Services and client portal
Full-disk encryption on every computer
Encrypted, tested backups
Access removed the day a seasonal employee leaves
Clean desk and shredding rule posted
Vendors reviewed for their own security programs

Incident response

Breach steps written
IRS stakeholder liaison contact saved
State tax agency contacts saved for every state you file in
Annual report to owner on the program

Use rule: Education and organization only. Record the agency, official source, checked date, cost, proof saved and responsible person for every consequential requirement. Unknown means stop and confirm. Example rows are labeled EXAMPLE and are not your data.