WISP Encryption, MFA & Backups: How to Document Controls That Pass FTC Review

Consider a firm that lists “encrypt sensitive data” in its Written Information Security Program, files the document with its PTIN renewal, and considers the matter settled. Then an FTC examiner asks which algorithm the firm uses, whether encryption is applied at rest or in transit, and who verified the configuration last quarter. The firm has no answer. The WISP, technically present, is functionally useless.

This is the gap between policy and practice that regulators have learned to exploit. The Safeguards Rule does not ask for intentions. It requires specific administrative, technical, and physical safeguards, each one documented with enough precision that an outsider could verify its implementation. Encryption, multi-factor authentication, and backup procedures are among the most commonly cited controls in WISPs—and among the most frequently hollow when tested.

The question is not whether your WISP mentions these controls. The question is whether it describes how they operate, who maintains them, and how the firm confirms they still work. A regulator reading your program should find answers, not aspirations.

The gap between listing controls and describing them

A tax preparer searching for WISP help will encounter no shortage of documents promising to solve the problem in an afternoon. The IRS Publication 4557 template, the NATP and AICPA frameworks, the offerings from Tech 4 Accountants and Rush Tech Support—each provides a foundation. Yet most arrive at the same impasse: a page that announces the firm will encrypt data, enable multi-factor authentication, and maintain backups, then moves briskly to the next topic. The document exists. Whether it functions is another matter.

The FTC Safeguards Rule requires a written program, a distinction that separates a policy from a prayer. The IRS PTIN renewal asks whether you have a WISP, which creates the impression that possession alone satisfies the obligation. It does not. The genuine exposure lies in an FTC examination following a complaint, or in the frantic hours after a ransomware incident when a forensic auditor asks precisely how your encryption was configured and who verified it last quarter.

Consider a firm that discovers its template WISP states “we use encryption” without specifying whether this means full-disk encryption on office workstations, file-level encryption for client tax returns stored in cloud software, or TLS for data in transit between applications. The distinction matters when a laptop is stolen from a car, or when a browser-based tax program transmits data across jurisdictions. Key management—who holds the recovery keys, how they are stored, what happens when an employee departs—typically goes unmentioned. MFA fares no better: “enabled where available” avoids the harder question of which systems require it, which authentication methods are permitted, and whether hardware tokens are treated differently than SMS codes. Backups, meanwhile, are declared “regular” without addressing retention periods, encryption of backup media, or the tested interval between backup completion and verification of restore capability.

An MSP can draft these controls with technical specificity, though the quality varies with the engagement. The preparer who treats the WISP as a compliance checkbox, however, retains the liability when the checklist fails under pressure.

What a defensible control description actually requires

A regulator reading your WISP does not want poetry. They want coordinates: what, where, by what means, and who verifies. The difference between a passing audit and a follow-up letter often comes down to whether your controls could actually be executed by someone other than the person who wrote them.

Consider encryption. A defensible entry specifies which data categories are covered (client tax returns, bank account numbers, EFIN credentials), where that data resides (local workstations, cloud storage, email in transit), and where it travels (portal uploads, e-file transmissions, backup replication). The standard matters: AES-256 at rest, TLS 1.2 or higher in transit. Most critically, who holds the encryption keys—your firm, your cloud provider, or a third party—and how key access is governed when employees depart. A WISP that states merely “data is encrypted” documents a wish, not a control.

Multi-factor authentication demands similar precision. The method matters: TOTP applications, hardware security keys, or SMS with documented acknowledgment of SIM-swapping risks. Which systems require it—email, tax software, remote access, cloud storage—and which, if any, carry exemptions with written justification. A principal who disables MFA on the server “just for now” and forgets to re-enable it has created a gap that a vague policy cannot explain away.

Backups, too, collapse under generality. Frequency (continuous, daily, weekly), retention periods, testing schedules, offline or air-gapped copies, and recovery time objectives—each element must be stated and assigned. A backup that has never been restored is a hypothesis.

No control prevents all breaches. Documentation quality determines whether your cyber insurer pays, whether the FTC accepts your corrective plan, and whether you can demonstrate due diligence. Templates from IRS Publications 4557 and 5708 provide frameworks but leave implementation specifics to the firm. MSP-written policies vary widely in specificity. Tech 4 Accountants and Rush Tech Support templates approach this with different levels of prescriptive detail. The question is not which template you purchased, but whether your finished document could guide a stranger through your actual environment.

How EEZY WISP structures these three controls

EEZY WISP is a Written Information Security Program—the security policy document a business is required to keep, written and maintained. On the three controls that regulators scrutinize most closely, it takes a particular approach: pre-drafted language that compels specificity without fabricating answers.

For encryption, the document does not declare that data is “encrypted” and move on. It provides control language requiring the firm to name its encryption software, identify who holds the keys, and state where encryption applies in transit versus at rest. The same structure governs multi-factor authentication: the firm must specify which systems require MFA, which factors it accepts, and who enforces exceptions. Backups follow suit—interval, retention period, offsite location, and test frequency are all fields the firm completes with its own operational specifics. Blank spaces would invite procrastination; false specifics would invite worse. The product demands the middle ground.

This distinguishes EEZY WISP from template approaches that leave firms to improvise. The IRS Publication 4557 and 5708 templates, NATP and AICPA offerings, and the policy your MSP might draft all vary in prescriptiveness; some stop at principle, others at checklist. EEZY WISP’s control language is designed to produce a document that answers the follow-up question before it is asked.

The document is maintained as regulations and firm practices change. Sites are hosted on Microsoft Azure. For firms that need to update these controls—say, after switching backup providers or rekeying encryption—the EEZYVERSE family centralizes access: one login across products, with billing at eezycloud.com/account/. Support hours are Monday through Friday 9 AM to 8 PM and Saturday through Sunday 9 AM to 12 PM Eastern, which covers most business-day scenarios where a policy revision cannot wait.

Pricing and what the commitment involves

Pricing is on the site. What merits scrutiny is not the figure itself but what the commitment actually purchases. A WISP that treats encryption, MFA, and backups as check-box items is a document that ages poorly, and aging poorly in this context means becoming evidence against the firm that adopted it.

The obligation is ongoing. Encryption standards advance; what satisfied NIST guidance three years ago may not now. MFA methods deprecate—SMS-based verification, once commonplace, now carries documented vulnerabilities that regulators have noticed. Backups without periodic tested restoration are merely hopeful gestures, and the testing must itself be documented. The WISP must describe not merely that these controls exist but how they are validated, by whom, and on what schedule. A regulator’s follow-up question is never “Do you encrypt?” It is: “Show me the last review of your encryption standard, and who signed off.”

Consider the alternatives. Drafting from IRS Publications 4557 or 5708 templates demands substantial labor to operationalize—the templates provide a skeleton, not the muscle of specific procedures and review cycles. An MSP-written policy may suffice initially, though experience suggests uneven quality and no guarantee of annual revision; the MSP’s incentive is technical service, not regulatory maintenance. Products from Tech 4 Accountants and Rush Tech Support offer structured approaches, as do templates from NATP and AICPA. Each requires the same evaluation: does the commitment include update cadence, or does it terminate at purchase?

EEZY WISP is maintained as a living document, which is to say it is revised to reflect current standards rather than left to fossilize. For firms already using other EEZYVERSE products, the arrangement is consolidated: one login, one central bill at eezycloud.com/account/. Support runs Monday through Friday 9 AM to 8 PM and Saturday through Sunday 9 AM to 12 PM Eastern, hours published at eezycloud.com/support. These are conveniences, not substitutes for the substantive question: whether the WISP you buy today will still defend you when the examiner arrives tomorrow.

The first week: from account to auditable descriptions

Consider a firm that has listed “encryption, MFA, backups” on a prior compliance questionnaire but lacks written specifics. The regulator’s next question—how, specifically, and who checks—would meet silence or improvisation. This is not an uncommon position. Many practices have satisfied initial inquiries with bullet points, only to discover that the FTC Safeguards Rule and IRS scrutiny require documentation that could survive follow-through.

The first week with EEZY WISP involves logging into the EEZYVERSE system and accessing the pre-structured WISP template. The encryption, MFA, and backup sections are not blank pages awaiting aspirational language. They are structured fields that prompt for software names, responsible parties, frequencies, and verification methods. A firm might enter that BitLocker encrypts local drives, that Microsoft Authenticator handles MFA with enforcement through Azure AD conditional access policies, that Veeam runs nightly backups to an offsite repository with monthly restoration tests assigned to a named technician. The template insists on specificity; it will not accept “industry standard” as an answer.

This discipline transforms the document from a one-time exercise into a maintainable record. When the software changes, the responsible employee departs, or the backup frequency shifts, the WISP is amended. The alternative—starting from an IRS Publication 4557 template or a generic policy from an MSP—often produces a document that sits untouched until the next compliance event, at which point its contents may no longer describe actual practice.

Support is available during published hours if questions arise on how to describe a particular control. For firms using multiple EEZY products, central billing is handled through eezycloud.com/account/. The point, however, is not administrative convenience. It is that a WISP worth keeping is one that accurately reflects what the firm does, who does it, and how anyone would know.

The honest alternatives and their tradeoffs

The IRS offers Publication 4557 and its companion 5708 templates at no cost. They are, by design, frameworks—useful for orienting a firm to the Safeguards Rule’s categories, but they leave the operative specifics of encryption protocols, MFA implementation, and backup verification procedures as exercises for the reader. A practitioner with both the time and the security fluency to draft these sections competently will find them adequate starting points. Most tax preparers, one suspects, do not.

NATP and AICPA templates serve their respective memberships with industry-appropriate scaffolding. They address the vertical’s particular risks more directly than the IRS publications, though they may bundle with membership dues or continuing education offerings. The specificity of their technical controls varies; some editions handle encryption and MFA with reasonable granularity, others with a discretion that leaves the same implementation gaps.

Tech 4 Accountants and Rush Tech Support each market WISP templates as commercial products, and their approaches to the encryption-MFA-backup triad differ in instructive ways. Tech 4 Accountants tends toward prescriptive detail—specific tool categories, configuration standards, verification cadences—while Rush Tech Support’s template structure emphasizes assignable responsibility and procedural workflow. Neither approach is inherently superior; the fit depends on whether a firm lacks technical guidance or operational discipline.

The MSP-written policy occupies its own category, and it is the most uneven. A capable managed services provider may produce a document that accurately reflects the firm’s actual controls, with encryption standards, MFA scope, and backup testing procedures specific to the environment they manage. The hazard is conflation: too many MSP policies read as service descriptions with security language grafted on, documenting what the vendor does rather than what the firm must govern. When the regulator asks who checks, the answer becomes circular—the MSP checks themselves, and the WISP records their assurance.

The honest tradeoff, then, is between labor and precision. Free templates demand more of the former; paid alternatives offer varying degrees of the latter; MSP policies risk substituting vendor convenience for institutional accountability.

Where a WISP lives in the firm’s operational stack

A Written Information Security Program is not a piece of software you install. It is a document that sits between your firm’s operational reality and the regulator’s expectation that you can explain it. This distinction matters because a WISP that merely names encryption, multi-factor authentication, and backups without connecting them to actual tools and actual people is a promise without plumbing.

Consider a firm that prepares returns in Drake Tax, stores client documents in a practice management system with optional MFA, and runs backups to a cloud service with its own encryption claims. The WISP must specify which of these systems handles data at rest versus in transit, whether MFA is required for all users or only some, how often backups are tested, and who verifies that the configurations have not drifted. The document does not replace the tax software’s encryption or the backup provider’s infrastructure; it describes how the firm ensures those controls remain active and appropriate.

This is where many template-based approaches falter. The IRS Publication 4557 template, the NATP or AICPA frameworks, and policies drafted by an MSP may list the right controls in the abstract but leave the firm to map them to its specific stack. A firm using Tech 4 Accountants or Rush Tech Support templates faces the same translation problem: the WISP must be reconciled with whatever combination of Drake, Lacerte, QuickBooks Online, SharePoint, or local servers the firm actually operates. If the stack changes and the WISP does not, the document becomes a historical curiosity rather than evidence of a living program.

For firms using multiple EEZY products, the EEZYVERSE single login and central billing at eezycloud.com/account/ reduce the administrative friction of managing several tools, though each product including EEZY WISP is also sold on its own site. The practical requirement remains: the WISP must accurately describe controls the firm actually operates, updated when the stack changes, with support available during the hours a small firm might need to make those updates—Monday through Friday 9 AM to 8 PM and Saturday through Sunday 9 AM to 12 PM Eastern, as published at eezycloud.com/support.