Data Security Plan Guide for Small Accounting Offices

Consider a firm that loses a laptop holding four years of client returns. The owner spends the weekend changing passwords and drafting a letter to clients, then discovers the FTC Safeguards Rule already required a Written Information Security Program — a written document, kept current, describing how the firm protects client data. The rule did not ask whether the firm had time. It asked for the document.

The IRS asks for the same thing at PTIN renewal, and Publication 4557 tells tax professionals what a WISP must cover. This is not a standard that applies once a firm reaches a certain size or once an afternoon opens up. A solo preparer with a home office owes the same document as a forty-person firm, because the obligation attaches to the data, not to the headcount.

A data security plan, then, is closer to a filed tax return than to a strategic plan. It exists because an authority expects to see it, and it describes controls the firm actually runs — access limits, encryption, incident response — rather than controls the firm admires. Writing one is an act of compliance first and craftsmanship second, which is why the task so often waits until something goes missing.

The document the IRS and the FTC already expect you to keep

Your office holds Social Security numbers, bank records, and tax returns for every client you serve. That has always been true. What has changed, if you have renewed your preparer tax identification number lately, is the expectation that you can show how you protect those records. A Written Information Security Program is the document that answers that expectation, and the government treats it as a requirement rather than a courtesy.

Two instruments govern this. The FTC Safeguards Rule obligates tax preparers to maintain a WISP. The IRS, for its part, expects a security plan to be in place as part of PTIN renewal. The agency has published its own guidance for practitioners: Publication 4557, Safeguarding Taxpayer Data, and Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice. These are not obscure references. They are the IRS telling you, in plain terms, what it wants to see.

An office with two employees and a filing cabinet is held to the same standard as a national firm. The rule does not scale down for size, and the IRS does not grade on effort. Consider a firm that has operated for years on trust and a locked door: the obligation arrives all the same, and the absence of a written plan is the deficiency, not the absence of good intentions.

You have options for producing the document. The IRS publications themselves contain templates. Tech 4 Accountants and Rush Tech Support sell WISP templates aimed at practitioners. NATP and the AICPA offer templates to members, and a managed service provider can draft a policy for you. Each route can satisfy the requirement. The question is which one leaves you with a program you understand and can follow, rather than a binder that sits untouched.

What a WISP is, and what it is not

A Written Information Security Program is a document. It identifies the risks to client data your office holds, assigns responsibility for protecting that data, and sets out the procedures your staff follow. Under the FTC Safeguards Rule, tax preparers must have one, and the IRS asks for it at PTIN renewal. That is the whole category: a written policy, kept current, that describes how your office handles information security.

It is not software. It does not scan your network, encrypt your drives, or block phishing emails. It is not insurance; it will not pay a claim after an incident. It is not a guarantee against a breach, and no document can be. A WISP that promises otherwise is overselling its own merchandise.

The document must describe your office as it operates: your people, your systems, your vendors, your actual practices. A firm of two bookkeepers working from laptops has different risks from a ten-person CPA office with a server room and three cloud applications. A template that describes an imaginary operation—one with an IT department, a formal risk committee, and a budget neither exists—protects no one because no one can follow it. The IRS Publication 4557 and 5708 templates, the NATP and AICPA materials, and the WISP templates from Tech 4 Accountants and Rush Tech Support all supply a starting structure. None of them can assess your risks for you. That work belongs to the person who knows where the files sit and who opens them.

A policy nobody reads protects no one. The Safeguards Rule expects your WISP to reflect your real operations, and an examiner can tell the difference between a document your office lives by and one purchased to satisfy a checkbox. The honest test is simple: hand the document to a new hire. If they can follow it, it works. If it describes a firm that does not exist, it does not.

What EEZY WISP provides

EEZY WISP is a Written Information Security Program: the security policy document a business is required to keep, written and maintained. That is the product. It exists because the obligation predates the purchase.

Tax preparers must have a WISP under the FTC Safeguards Rule, and the IRS requires one at PTIN renewal. A firm without this document is not merely behind on paperwork; it is operating without something the government already expects to see. The document must exist, and it must reflect the office as it actually runs.

The maintained part matters. An office’s systems, staff, and obligations change, and a policy left static stops describing the firm it covers. EEZY WISP keeps the document current rather than treating it as a one-time exercise in compliance theater.

Firms that prefer other routes have them. Tech 4 Accountants and Rush Tech Support sell WISP templates. The IRS publishes 4557 and 5708 as guidance. NATP and AICPA offer templates to members. An MSP can write a policy. Each approach asks something different of the firm: time, judgment, or both.

Pricing is on the site. EEZY WISP is part of the EEZYVERSE family, with one login across the EEZY products a company uses and one central bill at eezycloud.com/account/.

The document is not a substitute for the firm’s own judgment. It records the program; it does not run the office. A firm that wants to treat security as a living practice will find the document useful. A firm that wants a talisman will find it insufficient.

What it costs

EEZY WISP publishes its price at eezywisp.com. That is the whole answer, and it is the point. A firm can open the site, read the number, and decide. No sales call, no demo scheduled to learn the price, no form that trades an email address for a quote.

This matters because the alternatives do not all work this way. A template from Tech 4 Accountants or Rush Tech Support may list a price on its own site, or it may route a firm through a checkout flow that asks for contact details first. The IRS Publication 4557 and Publication 5708 templates cost nothing to download, which is a genuine price, though the cost of assembling them into a working program is measured in hours rather than dollars. Templates from NATP or AICPA follow each organization’s own purchasing rules. An MSP will quote a WISP as part of a broader engagement, which means the price arrives attached to a conversation about managed services. None of these approaches is wrong. They differ in how much friction stands between a firm and a number it can act on.

The friction is not trivial for a small office. A sole practitioner reviewing compliance obligations between client appointments does not benefit from a pricing process that requires a phone call during business hours. The question “what does this cost” has a single correct answer at any given moment, and a firm ought to reach that answer in one step.

Pricing for EEZY WISP products, including this one, sits on the site. A firm that wants the current figure can find it there and weigh it against the alternatives on its own schedule.

Getting started and the first week

Consider a firm that has just obtained a WISP document. The first week is not glamorous, but it is manageable.

Day one: the owner reads the document cover to cover. Not to memorize it, but to understand what it expects. A WISP from a provider such as EEZY WISP, Tech 4 Accountants, or Rush Tech Support will outline procedures for access control, password management, and offboarding. The IRS Publication 4557 and 5708 templates cover similar ground in plainer language. The owner’s task is to compare each procedure to what actually happens in the office.

Day two: the audit begins. Who has access to client files? More people than expected, probably. How are passwords handled? If the answer involves a sticky note or a shared spreadsheet, that is a gap. What happens when an employee leaves? Here is where the hypothetical firm discovers something uncomfortable: a former employee’s credentials still work on the shared drive. Nobody revoked them. Nobody thought to do so. The WISP gives the firm a procedure to follow—deactivate accounts, revoke remote access, retrieve company devices—and the owner follows it that afternoon.

Day three and four: assign responsibility. The WISP names a qualified individual to oversee the program. In a small firm, that is often the owner. The document also specifies who handles what when something goes wrong. Staff need to know their roles, not in theory, but in writing.

Day five: put the finished plan where staff can find it. A shared drive, a printed binder, somewhere accessible. The WISP is not a trophy; it is a working document. Staff should be able to consult it when a question arises, and the owner should review it annually or whenever circumstances change.

By Friday, the firm has a document it can show the IRS at PTIN renewal, and more importantly, it has closed a hole it did not know existed. That is the point.

The honest alternatives

A small office has several defensible routes to a written security plan, and each has its merits.

The IRS publishes its own guidance. Publication 4557, Safeguarding Taxpayer Data, and Publication 5708, Creating a Written Information Security Plan for Your Tax & Accounting Practice, cost nothing and carry the authority of the agency that will accept or reject your renewal. They are thorough. They are also, by design, generic: the office must translate federal prose into its own procedures, name its own systems, and fill its own blanks. That work is not difficult, but it takes hours, and the result must satisfy an examiner who did not write it.

Professional associations offer another path. NATP and AICPA members receive WISP templates with their dues—policies drafted for the tax trade, closer to daily practice than federal boilerplate. The same trade-off applies in milder form: the office must still customize the document to its own hardware, software, and staff, and must trust its edits to hold up under review.

Tech 4 Accountants and Rush Tech Support sell WISP templates built specifically for preparers and CPAs. These arrive with industry language already in place, which saves drafting time. They still require the office to verify that every claim in the document matches every machine in the office.

Finally, the office’s managed service provider can write a policy from scratch. An MSP knows the network, the backup schedule, and which machines run which operating systems. That knowledge is genuine. A policy written by an outside technician, though, may reflect the MSP’s habits more than the firm’s obligations, and the office remains responsible for a document it did not draft.

Each route ends at the same place: someone in the office must read the result, adjust it, and stand behind it. The alternatives differ chiefly in who performs that labor and how much of it remains when the template arrives.

How a WISP fits with the rest of the office’s security practice

A WISP is a record, not a safeguard. The office still needs the safeguards themselves: a password manager, multi-factor authentication on every account that offers it, access controls that limit client files to the staff members working on them, encryption on laptops and portable drives, and a vendor list that someone reviews at least annually. The WISP’s job is to say which of these the office uses, who runs each one, and when the office last checked that they still work. An examiner from the IRS or the FTC does not test the office’s firewall. The examiner asks for the document that describes the firewall, the policy behind it, and the person responsible for it.

This distinction matters because some firms buy a template, file it, and assume the work is done. The document without the practice behind it is a liability, not a compliance shortcut. The reverse is also true: an office with strong habits but no written program has the same exposure, because the Safeguards Rule requires the written program and the IRS asks for it at PTIN renewal.

Firms that want a template rather than a blank page have several honest options. Tech 4 Accountants and Rush Tech Support sell WISP templates built for tax practices. The IRS publishes its own starting points in Publications 4557 and 5708. NATP and the AICPA offer templates to members, and some firms have an MSP draft a policy to order.

EEZY WISP belongs to the EEZYVERSE family of products, which share one login and one central bill at eezycloud.com/account/. Support hours are published at eezycloud.com/support: Monday through Friday 9 AM to 8 PM and Saturday through Sunday 9 AM to 12 PM Eastern. For a firm already using other EEZY products, that is context, not a pitch. The document still has to match the practice. No template writes that part.