845-210-1677Book intro call
CPA & Tax Firm WISP Kit

Your written security plan.
A practical starting point.

CPA & Tax Firm WISP Kit (FTC Safeguards Rule)

A fill-in Written Information Security Plan (WISP) for small CPA and tax practices, organized around the FTC Safeguards Rule (16 CFR Part 314), with references to IRS Publications 4557 and 5708.

Editable DOCX + PDF. Helps you document your program. Using it doesn’t make you compliant. Not affiliated with or endorsed by the IRS or the FTC.

See what’s included
Who it’s for

Built for small
tax & accounting practices.

For solo tax preparers and small CPA, bookkeeping and accounting firms, roughly 1–25 people, that want a fill-in starting point for documenting their information security program. Customize the plan to your firm’s people, systems, risks and actual practices.

Inside the document

One WISP.
The working sections together.

The risk register, vendor register, incident-response plan and annual report are sections inside the WISP. They are not separate DOCX or spreadsheet files.

Program ownership & risk

  • Qualified Individual
  • Information and systems inventory
  • Risk assessment template with risk register

Safeguards & day-to-day work

  • Access controls, encryption and multi-factor authentication
  • Disposal, monitoring, backups and email
  • Physical security and client identity
  • Testing and monitoring, staff training and remote work

Vendors, incidents & review

  • Vendor oversight and vendor register
  • Incident-response plan
  • Annual owner report
  • Optional New York SHIELD addendum

Appendices & final check

  • 12-month calendar
  • Staff acknowledgment
  • Offboarding checklist
  • Incident log
  • “Am I done?” checklist
Digital delivery

A digital ZIP.
No physical shipment.

Right after checkout, Lemon Squeezy emails your receipt with a download link. You can download again anytime from My Orders (the link is in that email).

What's in the download

An editable DOCX WISP, a PDF with the same content, a README and the kit license.

Important to know

A template needs your work.

Templates only, not legal, tax, accounting, or financial advice. Have your own attorney or CPA review the documents before you rely on them. FIX256 LLC is not affiliated with the IRS or the FTC.

Using the kit doesn't make your firm compliant with the FTC Safeguards Rule, IRS requirements or any other law. It's not an audit or a compliance certification.

Section 7216 note: nothing in this kit is a taxpayer consent form, and it does not by itself satisfy IRC §7216 or Treas. Reg. §301.7216. Confirm with your own tax professional what consents you need before using or disclosing client tax return information.

Completing a document does not replace implementing, maintaining and reviewing your firm’s security practices.

Kit License, Disclaimer & Refund Policy

Questions about the kit?

Talk with FIX256.

Email info@fix256.com or call 845-210-1677 (Mon–Fri, 9am–5pm ET).

Rather have a person help? Book a Free Business Automation Fit Call.