Written Information Security Program
- Document ID
- PDC-WISP-SAMPLE
- Document version
- 1.0
- Template version
- v1.1.2
- Effective date
- October 2, 2026
- Next review
- October 2, 2027
1. Purpose and Legal Basis
This Written Information Security Program (the "program") describes how [Company Name] (the "company") protects the security, confidentiality, and integrity of customer information. It sets out the administrative, technical, and physical safeguards the company uses, who is responsible for them, and how they are tested, reported on, and kept current.
Legal basis. The company is a financial institution for purposes of the Gramm-Leach-Bliley Act because it is significantly engaged in financial activities. The FTC Standards for Safeguarding Customer Information (the Safeguards Rule, 16 CFR Part 314) require it to develop, implement, and maintain a written information security program appropriate to its size and complexity, the nature and scope of its activities, and the sensitivity of the customer information it holds. Each required element of the rule is addressed in a section of this program.
Tax and accounting practice. The Internal Revenue Service reminds tax and accounting professionals that federal law requires them to create and maintain a written information security plan. This program is designed to meet that expectation and to be consistent with IRS Publication 5708 (Creating a Written Information Security Plan for Your Tax and Accounting Practice) and Publication 4557 (Safeguarding Taxpayer Data).
2. Scope and Definitions
This program applies to all owners, employees, temporary staff, and contractors of [Company Name], to every system and location where customer information is stored, processed, or sent, in paper or electronic form, and to service providers that receive or can access customer information.
- Customer information
- Any record containing nonpublic personal information about a customer of the company, in paper, electronic, or other form, that the company or its service providers handle. Examples include tax returns and workpapers, Social Security numbers of clients and their dependents, bank account and refund deposit details, W-2 and 1099 forms, and engagement letters.
- Qualified Individual
- The person the company designates to oversee, implement, and enforce this program, as the Safeguards Rule requires.
- Information system
- Any computer, server, phone, application, cloud service, or network the company uses to access, collect, store, process, or send customer information, or that is connected to one that does.
- Multi-factor authentication (MFA)
- Signing in with at least two different kinds of proof, such as a password plus a code from an authenticator app, a security key, or a fingerprint.
- Encryption
- Scrambling information so it can be read only with the right key, both when it is stored (at rest) and when it is sent (in transit).
- Service provider
- Any person or company that receives, maintains, processes, or can access customer information through its services to the company, such as an IT provider, software vendor, cloud service, payroll service, or shredding company.
- Security event
- An event that results in unauthorized access to, or disruption or misuse of, an information system or the information on it.
- Notification event
- Acquisition of unencrypted customer information without the authorization of the person it is about. Information is treated as unencrypted if an unauthorized person accessed the encryption key.
3. Qualified Individual and Governance
Designation. The Information Security Coordinator is the company's Qualified Individual. The Information Security Coordinator oversees, implements, and enforces this program, leads the risk assessment, approves safeguards and exceptions, oversees service providers, and reports to the company's owners or partners as described in this program.
| Role | Responsibilities |
|---|---|
| Managing Partner | Approves this program, provides the resources it needs, receives the annual report, and accepts any significant risk that cannot be reduced. |
| Qualified Individual (Information Security Coordinator) | Runs the program day to day, keeps the risk assessment and inventory current, approves access to customer information, coordinates training, oversees service providers, and leads the response to security events. |
| IT service provider | Operates the technical safeguards it is responsible for, such as MFA, encryption, patching, monitoring, and backups, and reports problems and security events to the Information Security Coordinator immediately. |
| All staff | Follow this program, protect customer information in every form, complete training, and report suspected security events right away. |
4. Written Risk Assessment
The Information Security Coordinator prepares a written risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information, including risks that could lead to unauthorized disclosure, misuse, alteration, or destruction. It assesses whether the current safeguards are sufficient to control those risks. The written assessment includes:
- The criteria used to evaluate and categorize risks and threats, such as likelihood and impact on a simple high, medium, and low scale.
- The criteria used to assess the confidentiality, integrity, and availability of information systems and customer information, and whether existing controls are adequate.
- How each identified risk will be reduced, accepted, transferred (for example through insurance), or avoided, and who is responsible for each action.
Common risks to consider. Stolen passwords and fake sign-in pages, ransomware, impersonation of clients or executives by email or phone, lost or stolen laptops and phones, misdirected email, unsecured remote access, former staff who still have access, careless disposal of paper, weaknesses at service providers, and fire, flood, or power loss.
Reassessment. The risk assessment is repeated at least once a year, and whenever there is a material change to the company's operations, systems, or locations, or a security event, so that the safeguards can be adjusted.
5. Access Controls and Multi-Factor Authentication
Access on a need-to-know basis. Access to customer information and to the systems that hold it is limited to authorized users who need it to do their jobs, and to customers accessing their own information. Every user has a unique account; shared logins are not allowed. The Information Security Coordinator approves access and reviews who has it at least every six months, removing anything no longer needed.
Multi-factor authentication. MFA is required for any individual accessing any information system, including email, cloud storage, professional software, client portals, remote access, and administrator accounts. Authenticator apps with number matching, security keys, and passkeys are preferred over text message codes. Administrator accounts must use phishing-resistant MFA, such as security keys or passkeys. Any exception requires the Information Security Coordinator to approve, in writing, an equivalent or more secure control.
Passwords and departures. Passwords are long, unique to each system, and kept in a company-approved password manager. Default passwords on devices and software are changed before use. When someone leaves the company, their accounts and access are disabled no later than the end of their last working day, and company devices are collected.
Physical access. Offices, file rooms, and cabinets that hold customer information are locked when unattended. Visitors are escorted where customer information is visible, and screens lock automatically after a short period of inactivity.
6. Data Inventory, Encryption and Secure Disposal
Inventory. The Information Security Coordinator keeps an inventory of the data, people, devices, systems, and facilities that handle customer information, and updates it when anything changes. Customer information is currently kept in:
- Tax, accounting, loan origination, dealer management, or other line-of-business software, including its cloud-hosted versions.
- Company email and cloud file storage, such as Microsoft 365 or Google Workspace.
- Office computers, laptops, and any on-site server or network storage device.
- A client portal or secure file-exchange service used to send and receive documents.
- Paper files, printed returns and applications, and scanned images.
- Phones and tablets used to read company email or approve sign-ins.
Encryption. All customer information is encrypted when it is stored on computers, phones, servers, backups, and cloud services, and whenever it is sent outside the company's own network. Laptops and phones use full-device encryption. Documents are exchanged with customers only through the company client portal or encrypted email, never as ordinary email attachments. If encryption is not feasible for a particular system, the Information Security Coordinator must approve effective alternative controls in writing.
Secure disposal. Customer information is securely disposed of no later than two years after the last date it was used to provide a product or service to the customer, unless it is needed for business operations, is required to be kept by law or regulation (for example tax and lending record rules), or targeted disposal is not reasonably feasible because of how it is stored. Paper is cross-cut shredded or destroyed by a shredding company that provides a certificate of destruction. Devices and media are wiped or destroyed following NIST SP 800-88 media sanitization guidelines before they are reused, returned, or thrown away. The disposal schedule is reviewed at least once a year.
7. System Changes, Software and Activity Monitoring
Change management. Changes to information systems, such as new software, new devices, network changes, and new cloud services, are approved by the Information Security Coordinator or the IT provider, checked for their effect on security, and recorded.
Software and updates. Security updates for computers, phones, servers, network equipment, and applications are installed promptly and automatically wherever possible. Software that no longer receives security updates is replaced. Any application the company develops in-house follows secure development practices, and outside applications used to handle customer information are evaluated for security before use.
Monitoring authorized users. Sign-ins and activity in email, cloud storage, professional software, and administrator accounts are logged. The logs are monitored to detect unauthorized access to, use of, or tampering with customer information by anyone, including authorized users, and alerts are reviewed promptly.
Endpoint and email protection. Every company computer and server runs company-managed endpoint protection. Company email is filtered for phishing and malware, and any request to change where money or a refund is sent is confirmed by calling a phone number already on file, never one supplied in the request.
8. Monitoring and Testing
The company regularly tests or otherwise monitors the effectiveness of its safeguards, including the controls that detect actual and attempted attacks on information systems.
Continuous monitoring. Information systems are monitored continuously by a managed detection and response service or equivalent tool that detects, on an ongoing basis, changes that may create vulnerabilities and signs of attack, and alerts the company immediately.
Periodic testing. An independent, qualified tester performs a penetration test of the company's information systems at least once a year, based on the risks identified in the risk assessment. Vulnerability assessments, including system-wide scans for publicly known vulnerabilities, are performed at least every six months, and whenever there are material changes to operations or a security event.
Fixing what is found. Findings are recorded, assigned an owner and a due date, and tracked by the Information Security Coordinator until they are fixed or formally accepted.
9. Staff Training and Security Personnel
All staff complete security awareness training before or within 30 days of receiving access to customer information, and again at least once a year. Training is updated to reflect the risks found in the risk assessment and covers:
- This program and how to report a security event.
- Recognizing phishing, fake client and executive requests, fake software login pages, and phone and text scams.
- Never approving an MFA prompt you did not start, and never sharing passwords or codes.
- Sending customer information only through approved, encrypted methods.
- Clean desks, locked screens, and secure disposal of paper.
Practice phishing emails. Practice phishing emails are sent to all staff at least every three months, and anyone who clicks receives short follow-up training. They are a learning tool, not a disciplinary trap.
Security personnel. The company uses qualified staff or service providers to manage its safeguards, gives them the time and training to stay current on security threats and countermeasures, and the Information Security Coordinator confirms they are keeping current at least once a year.
10. Service Provider Oversight
The company takes reasonable steps to select and retain service providers that can maintain appropriate safeguards for the customer information they receive or can access. The Information Security Coordinator keeps a list of these providers and what each one can reach.
- Before a provider is given access, the company reviews its security, for example through a SOC 2 report, a security questionnaire, or a review of its MFA, encryption, and breach history.
- The contract requires the provider to implement and maintain appropriate safeguards, keep customer information confidential, notify the company promptly of any security event affecting it, and return or securely destroy the information when the contract ends.
- Provider access is limited to what the work requires, protected with MFA, logged, and removed when the work or contract ends.
- Each provider is reassessed at least once a year, and whenever it reports a security event, based on the risk it presents.
11. Incident Response Plan
Report immediately. Anyone who suspects a security event, such as a clicked phishing link, a lost phone, a misdirected email, unexpected MFA prompts, or a ransom note, reports it to the Information Security Coordinator immediately, even if unsure. Do not turn off, wipe, or try to fix the affected device unless told to.
Plan elements. The company keeps this written plan for responding to and recovering from any security event that materially affects customer information. It sets out:
- Goals: contain the event, protect customers, restore operations, and meet every legal obligation.
- Internal process: the Information Security Coordinator leads the response, the IT provider or staff contain and investigate, and the Managing Partner makes business decisions.
- Roles, responsibilities, and decision authority, including who may contact customers, regulators, law enforcement, and the press.
- Communication and information sharing, inside the company and with outside parties, using phone or a separate channel if email may be compromised.
- Fixing any weaknesses in systems and controls that the event revealed.
- Documenting and reporting the event and the response.
- Reviewing and updating this plan after each event.
Notify the FTC. If unencrypted customer information about 500 or more consumers is acquired without authorization, the company notifies the Federal Trade Commission as soon as possible and no later than 30 days after discovery, using the form on the FTC website. The notice includes the company's name and contact information, a description of the information involved, the date or date range of the event if known, the number of consumers affected, a general description of the event, and whether a law enforcement official has asked for a delay in public notice. Legal counsel confirms the notice before it is sent.
Other notices. Legal counsel also determines what notice is owed to affected customers and to state officials under the breach notification laws of North Carolina and every state where affected customers live, and under any contract.
Client tax data. If client tax data may have been stolen, the company reports it to its local IRS Stakeholder Liaison as quickly as possible so the IRS can help block fraudulent returns, contacts the state tax agencies where it prepares returns, and contacts the FBI and local police as IRS guidance recommends.
Cyber insurance. The plan lists the insurer's breach hotline. The Information Security Coordinator notifies the insurer as the policy requires, and before hiring outside response firms or counsel, because many policies require insurer-approved vendors.
12. Annual Report to Leadership
The Information Security Coordinator reports in writing, regularly and at least once a year, to the company's owners or partners. If the company has no board or equivalent governing body, the report goes to a senior officer responsible for the program. The report covers:
- The overall status of the program and the company's compliance with the Safeguards Rule.
- Material matters, including the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security events and how the company responded, and recommended changes to the program.
13. Program Review, Exceptions and Enforcement
Evaluate and adjust. The Information Security Coordinator evaluates and adjusts this program based on the results of testing and monitoring, any material change to operations or business arrangements, the results of risk assessments, and any other circumstances that may affect it. The program is reviewed no later than October 2, 2027, and changes are approved by the Managing Partner.
Exceptions. A requirement that cannot be met must be raised in writing with the Information Security Coordinator, with the reason, the risk, and the alternative control. Exceptions are approved by the Information Security Coordinator, recorded, and reviewed at least once a year. No exception may waive something the law requires.
Enforcement. Violations of this program may result in loss of access and disciplinary action, up to and including termination of employment or of a contract, consistent with applicable law. Promptly reporting your own mistake is always the right choice and is taken into account.
Records. Risk assessments, test results, training records, service provider reviews, incident records, and annual reports are kept for at least five years, or longer if a law, contract, or legal hold requires.
14. Protected Reports
Nothing in this document prohibits or restricts anyone from reporting a possible violation of law to, filing a charge or complaint with, communicating with, or taking part in an investigation by any government agency, including law enforcement, the U.S. Department of Health and Human Services, the Securities and Exchange Commission, the National Labor Relations Board, or a state attorney general, or from making any other disclosure protected by law. No approval is needed for these reports, and no one will be disciplined for making one in good faith.
15. Acknowledgment
I have read and understand the [Company Name] Written Information Security Program. I agree to protect customer information in every form, to use only approved systems and secure methods to send it, to complete required training, and to report suspected security events immediately. I understand that violations may result in disciplinary action.
Name
Job title
Signature
Date
16. Document Control and Revision History
| Field | Value |
|---|---|
| Status | Draft generated from a template. Not in effect until reviewed by your legal counsel and approved and signed below. |
| Document | Written Information Security Program |
| Organization | [Company Name] |
| Document ID | PDC-WISP-SAMPLE |
| Document version | 1.0 |
| Effective date | October 2, 2026 |
| Next scheduled review | October 2, 2027 |
| Policy owner | Information Security Coordinator |
| Approver (title) | Managing Partner |
| Source template | Preferred Data Corporation WISP (FTC Safeguards Rule) template v1.1.2 |
| Template content last reviewed | October 2, 2026 |
Approval. Sign below to approve this document for adoption by [Company Name] after it has been reviewed by your legal counsel. Until it is signed, it is a draft and is not in effect.
Name
Title
Signature
Date
Revision history. Record every change to this program below. Increase the document version and obtain approval again each time the program is revised.
| Version | Date | Description of change | Approved by |
|---|---|---|---|
| 1.0 | October 2, 2026 | Draft generated from template v1.1.2; pending legal review and approval | Blank |
| Blank | Blank | Blank | Blank |
| Blank | Blank | Blank | Blank |
17. Template Notice and Legal Disclaimer
This document was generated from a starter template provided by Preferred Data Corporation. It is general information only. It is not legal advice and it is not a substitute for advice from a licensed attorney. Using the template does not create an attorney-client, consulting, or other professional relationship.
Preferred Data Corporation is not a law firm or an insurer. It makes no representation that this document is complete, current, or suitable for any particular organization, industry, jurisdiction, or regulatory requirement. To the fullest extent permitted by law, it is not responsible or liable for any loss or damage arising from the use of this template or of any policy created from it. You are solely responsible for how you adapt, adopt, and enforce it.
Laws, regulations, insurance requirements, and contracts that apply to your organization may require different or additional terms. The facts, deadlines, and legal references in this template were checked against their sources on the date shown as "Template content last reviewed" in Document Control, not on the effective date, and may have changed since. Before you adopt, publish, or rely on this document, and in every case where you have a legal, regulatory, or contractual obligation, have it reviewed by qualified legal counsel.
In an actual security incident or data breach, contact your attorney, your cyber insurer, and law enforcement where appropriate. Do not rely on this template alone to decide whether, when, or how to notify anyone.
If Preferred Data Corporation prepared this document for you as part of its services, your service agreement governs those services. The content of this document is still general information and should be reviewed by your own counsel before you adopt it.
This template is provided "as is", without warranties of any kind, including accuracy, completeness, or fitness for a particular purpose. Links to laws, agencies, and other websites are provided for convenience and may change. Use of this template is also subject to the Website and Free Resources Disclaimer and the Terms of Service at preferreddata.com/legal/disclaimer and preferreddata.com/legal/terms-of-service.
To report an error, contact Preferred Data Corporation at preferreddata.com/contact or (336) 886-3282 and include the Document ID shown in Document Control. Corrections are listed in the template changelog on the template's page at preferreddata.com/policy-templates.
