Incident Response for Small Firms: Who to Call and When

Consider a firm that discovers, on a Tuesday afternoon in February, that a laptop containing client tax files is missing from the office. The owner stands in the supply room, staring at the empty shelf where the machine should sit, and realizes she does not know whether to call her IT provider, her insurance carrier, or the IRS first. She is not alone in this paralysis. Most small firms have never rehearsed this sequence, and the absence of a plan turns a manageable incident into a week of improvised decisions.

The Federal Trade Commission’s Safeguards Rule requires every tax preparer to maintain a Written Information Security Program, and the IRS asks for one at PTIN renewal. A WISP is not merely a policy binder; it is the document that tells you, in the moment of discovery, which calls to make and in what order. Without that list, the owner of our hypothetical firm will likely spend her first hour searching for phone numbers instead of containing the damage.

The discipline matters more than the technology. A small firm does not need a war room, a forensics team on retainer, or a public relations strategy. It needs three or four names written down, a clear sense of who answers first, and the resolve to make the calls in sequence rather than simultaneously. The firms that handle breaches well are rarely the ones with the largest security budgets. They are the ones that decided, long before the laptop went missing, exactly what they would do when it did.

The Problem: You Suspect a Breach and Have No Idea Who to Call

Consider a firm that gets a login alert at 11:40 PM on a Tuesday in March. Or a client calls to say someone filed a return in her name. Or a laptop with last year’s client files disappears from a car during season. The first hour is not spent investigating. It is spent wondering who to call first — the IT person, the insurance carrier, the software vendor, a lawyer, the IRS, the state attorney general — and in what order.

That sequence matters more than the theory behind it. Call the wrong party first and you may void your insurance coverage, contaminate evidence, or miss a statutory deadline. Call the right party first and the rest of the list falls into place.

The FTC Safeguards Rule requires a written incident response plan as part of your Written Information Security Program. The IRS asks about your security plan on the PTIN renewal. Neither agency prescribes the phone tree; both expect you to have one. The gap between “have a plan” and “know who to call” is where small firms get stuck.

The stakes are concrete. Client data — Social Security numbers, bank details, prior-year returns — is the asset at risk. Preparer liability follows if the exposure traces back to weak controls. And if notification becomes necessary, you face a patchwork of state breach laws: roughly six states with materially different triggers, timelines, and recipient lists, a compliance problem that does not wait for you to feel ready.

A WISP template from Tech 4 Accountants, Rush Tech Support, NATP, or the IRS Publication 4557 materials can give you the document. A policy your MSP drafted can cover the technical half. Neither hands you a prioritized call list matched to your firm, your carrier, and your states. That list is the part you build yourself — before the Tuesday-night alert, not during it.

What an Incident Response Plan Actually Does (and What It Cannot)

An incident response plan is a decision tree, not a shield. It maps five moves: detect, contain, assess, notify, recover. Detection asks how you will learn something is wrong — a bank alert, a client complaint, a frozen workstation. Containment asks what you unplug and who has authority to unplug it. Assessment asks who decides whether this is a breach or a bad Tuesday. Notification asks whom you must tell, and when. Recovery asks how you return to normal operations and document what happened.

Be honest about limits. A plan does not stop an attack. It shortens the interval between suspicion and action, and that interval is where small firms bleed — in lost files, in missed regulatory clocks, in the client who learns about the problem from someone other than you.

A small firm has five roles to assign, and one person may hold several. The owner decides what the firm can tolerate and signs off on hard calls. The office manager runs the contact list and the log. The IT person or managed service provider contains the technical problem. Outside counsel advises on legal duties and privilege. The cyber insurance carrier controls which forensic vendors you may use — call before you hire anyone.

The order of calls matters more than the speed of any single call. A firm that phones its MSP first, then its carrier, may learn the MSP’s actions voided coverage. A firm that notifies clients before counsel reviews the duty to notify may create a record it cannot retract. The sequence — contain, then counsel, then carrier, then statutory notice — protects you more than any heroic speed.

Templates from the IRS, NATP, or AICPA, or a policy drafted by your MSP, can supply this structure. What they cannot supply is the discipline to rehearse it before you need it.

Who to Call, in Order, and What to Say

Keep the list short and the order fixed. Each call has a trigger and a first question.

1. The person your WISP designates to assess. Trigger: anything that looks like unauthorized access, missing data, or a compromised account. First question: “What do we actually know, and what do we merely suspect?” Separate the two before anyone else gets on the phone.

2. Your MSP or IT provider. Trigger: the assessment suggests a live incident rather than user error. Their job is containment: isolate the affected machine, disable the compromised account, preserve logs. First question: “What have you contained, and what is still exposed?”

3. Your cyber insurance carrier, if you carry a policy. Trigger: any incident that might lead to a claim. Many policies require pre-approval before you spend on forensics or recovery, and an unapproved invoice may go unpaid. First question: “What must you approve before I authorize any outside work?” If you have no policy, skip this and note the gap for later.

4. Outside counsel. Trigger: personal data may have been exposed, or you expect regulatory or client scrutiny. Counsel can retain the forensics firm under privilege, which keeps the findings from becoming discovery material. First question: “How do we structure the investigation so privilege holds?”

5. Law enforcement. Trigger: cybercrime, such as ransomware or business email compromise, goes to your FBI field office or IC3.gov; physical theft of devices goes to local police. First question: “What reference number will you assign, and what should we preserve for you?” The number matters for your insurer and your file.

6. The FTC and your state attorney general. Trigger: personal information was exposed. The FTC expects a report through its complaint portal; state attorneys general have their own notification statutes and deadlines. First question: “What are our notification deadlines in each affected state?”

7. Clients. Trigger: notification is legally required or the exposure touches their data. First question: “What exactly was exposed, and what should they do about it?” Tell them plainly; a vague letter helps no one.

How EEZY WISP Fits Into This

EEZY WISP is the written information security program document a business is required to keep, written and maintained. The incident response plan is a component of that program. It does not detect, contain, or respond to anything. It tells you where the extinguisher is and who is allowed to use it.

Tax preparers must have a WISP under the FTC Safeguards Rule, and the IRS requires one on PTIN renewal. The document is not optional. The discipline of keeping it current is where most firms fall short. A plan written once and filed away is a liability, not a safeguard.

Consider a firm that discovers unusual activity on a client account on a Tuesday afternoon. The first call is to the person named in the incident response plan. The second call is to the insurer, if the firm carries cyber coverage. The third call, if warranted, is to counsel. The plan in the WISP lists these names, in order, with contact details. The firm that lacks this document is improvising under pressure. The firm that has it is following a checklist.

Other sources exist. IRS Publication 4557 and the template in Publication 5708 provide a starting point. NATP and AICPA offer templates to members. Tech 4 Accountants and Rush Tech Support sell WISP templates. An MSP can draft a policy. Each approach has merit. The question is whether the resulting document names the people to call and the order in which to call them. If it does not, it is incomplete.

EEZY WISP is hosted on Microsoft Azure. Pricing is on the site. Support hours are published at eezycloud.com/support.

What It Costs

Pricing for EEZY WISP is published on the site. This article will not repeat figures that may change; the site is the authority.

The more instructive question is what a firm pays for doing nothing. Under the FTC Safeguards Rule, a tax preparer must maintain a written information security program and a documented incident response plan. A firm that cannot produce either has exposure that no template will excuse. The FTC has brought enforcement actions against preparers for failures of exactly this kind. The exposure is not theoretical, and it does not require a breach to materialize.

The alternatives carry their own arithmetic. IRS Publications 4557 and 5708 are free and useful as orientation, but they are not a program; a firm must still write, adopt and maintain the document. Templates from Tech 4 Accountants, Rush Tech Support, NATP or the AICPA price differently and offer different depth. An MSP will draft a policy as part of a broader engagement, which may suit a firm already paying for managed services. None of these options is wrong. Each simply shifts the work somewhere.

A WISP does not prevent an incident. It tells a firm, in advance, who to call and in what order. That document, kept current and actually used, is the difference between a bad week and a bad quarter.

Getting Started: The First Week

Consider a firm that suspects a data breach. The calls come first; the paperwork can wait. A week of preparation, done in short daily sessions, puts the list in order before it is needed.

Day one. Read the WISP. Find the incident response section and confirm the named contacts are current: the internal coordinator, the MSP, the insurance carrier, the attorney. If a name has left the firm or a number has changed, correct the document now, not during the incident.

Day two. Verify the MSP’s after-hours number actually reaches a person. Confirm the insurance carrier’s breach hotline and the policy number. If the firm carries cyber insurance through a broker, add the broker’s direct line; brokers answer at hours carriers do not.

Day three. Print the call sequence and post it where someone can find it at 11 PM: the server closet door, the reception desk, the inside of the tax-season binder. Save a copy to the shared drive and to one personal phone. Paper does not depend on the network.

Day four. Walk one staff member through the first two calls. The exercise takes ten minutes. The point is not rehearsal; it is discovering that the MSP’s emergency line goes to voicemail before someone discovers it at midnight.

Day five. Confirm client notification templates exist, or know who will draft them. The FTC Safeguards Rule expects a plan; state breach statutes expect letters. If no template exists, the attorney drafts. If the attorney has never drafted one, ask now, not after the fact.

Five days, perhaps two hours of work. The alternative is a firm that learns its call list during the incident, which is the wrong time for discovery.

If the document itself needs work, EEZY WISP support hours are published at eezycloud.com/support. For firms building from a blank page, the IRS Publication 4557 template and the NATP and AICPA versions offer a starting structure; a WISP from Tech 4 Accountants or Rush Tech Support serves the same purpose. The calls, however, are the firm’s own.

The Honest Alternatives and Your Wider Stack

Your options for a WISP are real, and each has a case. Tech 4 Accountants and Rush Tech Support sell templates built for tax practices; the IRS offers Publication 4557 and a 5708 template at no charge; NATP and AICPA members can use their associations’ versions; your own MSP can draft a policy for you. None of these is a wrong answer, and this page will not pretend otherwise.

The trade-offs are plain. A template gives you the document but not the contents: you fill in your own names, phone numbers, vendors, and timelines, and the quality of the finished WISP depends on the care you bring to that exercise. An MSP-written policy may be thorough, but it ties the document to that provider; if you change MSPs, you will likely need the policy rewritten. Pricing for all of these varies, so compare what each vendor publishes on its own site.

Whichever route you take, the WISP is one item in a larger stack. It sits alongside your tax software, your document portal, your email, and your insurance policy. Each handles a different exposure. The portal protects files in transit; the insurance policy answers after an incident; the WISP is the written record that you identified your risks and decided what to do about them. Regulators ask for that record. Clients increasingly do as well.

EEZY WISP is written and maintained for you, so the names and numbers are current without your chasing them. If you use other EEZY products, one login covers them and one central bill lives at eezycloud.com/account/. That is convenience, not strategy, and it should not be the reason you choose anything.