Written Information Security Plan (WISP)

I. Objective

Our objective, in the development and implementation of this comprehensive Written Information Security Plan (WISP), is to create effective administrative, technical, and physical safeguards for the protection of the Personally Identifiable Information (PII) retained by Bluebonnet Tax Service (sample firm) (hereinafter known as the Firm). This WISP is to comply with obligations under the Gramm-Leach-Bliley Act and the Federal Trade Commission Financial Privacy and Safeguards Rules (16 CFR Part 314) to which the Firm is subject as a tax and accounting practice. The WISP sets forth our procedure for evaluating our electronic and physical methods of accessing, collecting, storing, using, transmitting, and protecting PII retained by the Firm.

For purposes of this WISP, PII means information containing the first name and last name or first initial and last name of a Taxpayer, Spouse, Dependent, or Legal Guardianship person in combination with any of the following data elements retained by the Firm that relate to Clients, Business Entities, or Firm Employees:

• Social Security number, Date of Birth, or Employment data
• Driver's license number or state-issued identification card number
• Income data, Tax Filing data, Retirement Plan data, Asset Ownership data, Investment data
• Financial account number, credit or debit card number, with or without security code, access code, personal identification number, or password(s) that permit access to a client's financial accounts
• E-mail addresses, non-listed phone numbers, residential or mobile or contact information

PII shall not include information that is obtained from publicly available sources such as a mailing address or phone directory listing, or from federal, state or local government records lawfully made available to the general public.

II. Purpose

• Ensure the security and confidentiality of all PII retained by the Firm.
• Protect PII against anticipated threats or hazards to the security or integrity of such information.
• Protect against any unauthorized access to or use of PII in a manner that creates a substantial risk of identity theft or fraudulent or harmful use.

III. Scope

The scope of the WISP related to the Firm shall be limited to the following protocols:

• Identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of any electronic, paper, or other records containing PII.
• Assess the potential damage of these threats, taking into consideration the sensitivity of the PII.
• Evaluate the sufficiency of existing policies, procedures, customer information systems, and other safeguards in place to control identified risks.
• Design and implement this WISP to place safeguards to minimize those risks, consistent with the requirements of the Gramm-Leach-Bliley Act, the FTC Safeguards Rule, and National Institute of Standards and Technology recommendations.
• Regularly monitor and assess the effectiveness of these safeguards.

The Firm maintains customer information concerning fewer than 5,000 consumers. Under 16 CFR 314.6, the written risk assessment (314.4(b)(1)), penetration testing and vulnerability assessment schedule (314.4(d)(2)), written incident response plan (314.4(h)) and annual written report (314.4(i)) are not strictly required at this size. The Firm includes them anyway as good practice, and will treat them as required if it reaches that number.

IV. Identified Responsible Officials

Bluebonnet Tax Service (sample firm) has designated Maria Lopez (Owner, EA) to be the Data Security Coordinator (hereinafter the DSC). The DSC is the Firm's Qualified Individual under 16 CFR 314.4(a): the responsible official for the Firm's data security processes, who will implement, supervise, and maintain the WISP. The DSC will be responsible for:

• Implementing the WISP, including all daily operational protocols.
• Identifying all of the Firm's repositories of data subject to the WISP and designating them as Secured Assets with Restricted Access.
• Verifying that all employees have completed recurring information security training.
• Monitoring and testing employee compliance with the plan's policies and procedures.
• Evaluating the ability of third-party service providers to implement and maintain appropriate security measures for the PII to which the Firm has permitted them access, and requiring them by contract to do so.
• Reviewing the scope of the security measures in the WISP at least annually, or whenever there is a material change in business practices that affects the security or integrity of records containing PII.
• Conducting an annual training session for all owners, managers, employees, and independent contractors, including temporary and seasonal staff, who have access to PII. All attendees certify attendance using Attachment D.
• Reporting in writing at least annually to the Firm's owner on the status of the program (Section IX).

Bluebonnet Tax Service (sample firm) has designated Maria Lopez to be the Public Information Officer (hereinafter the PIO). The PIO is the Firm's designated spokesperson. All outward-facing communications about a security matter are approved by the PIO, including client communications, statements to law enforcement agencies, releases to news media, and information released to business associates, neighboring businesses, and trade associations.

IRS Pub 5708 recommends that, in firms of two or more practitioners, the DSC and PIO be different individuals. Consider assigning the PIO role to a second person.

V. Risk Assessment

This section is the Firm's written risk assessment under 16 CFR 314.4(b). It is re-performed at each annual review and whenever operations change materially.

Information the Firm handles

• Client tax return data and supporting documents (W-2s, 1099s, K-1s, identity documents, bank account numbers for refunds and payments).
• Client and employee PII as defined in Section I.
• Firm business and payroll records.
• Systems that hold it: Drake Tax (installed on office computers); Google Workspace email; paper files; backups.

Criteria used

Likelihood (how probable the threat is for an office like ours) and impact (harm to clients and the Firm if it happens) are each rated Low, Medium, or High. The overall rating is the higher of the two when either is High. Each risk is judged against confidentiality, integrity, and availability of client data. High risks are mitigated within 30 days; Medium risks within 90 days; Low risks may be accepted in writing by the DSC with a reason.

Identified risks and current controls

Monitoring and testing for new risks

• The DSC reviews this risk table at least annually and after any security event, new system, new office location, or change in staff.
• The DSC subscribes to IRS e-News for Tax Professionals and Security Summit alerts and reviews them for new threats.
• The Firm reviews system event logs and security software alerts at intervals not to exceed 90 days.

VI. Inside the Firm Risk Mitigation

To reduce internal risks to the security, confidentiality, and integrity of any retained electronic, paper, or other records containing PII, the Firm has implemented the following mandatory policies and procedures.

PII Collection and Retention Policy

• The Firm collects only the PII of clients, customers, or employees that is necessary to accomplish its legitimate business needs, while complying with all federal, state, and local regulations.
• Access to records containing PII is limited to employees whose job duties require it, and only for job-related purposes.
• PII is stored only in these designated locations: Drake Tax; Google Workspace (encrypted or password-protected attachments only); locked paper files at the office; encrypted external backup drive. Client PII is never stored on personal devices.
• Records containing PII are destroyed at the earliest opportunity consistent with business needs or legal retention requirements, and in no case kept longer than 7 years (Attachment A). Customer information is disposed of no later than two years after its last use for the client unless needed for business or legal reasons (16 CFR 314.4(c)(6)).

Personnel Accountability Policy

• A copy of the WISP is given to all current employees and to new employees on their first day. Each employee acknowledges in writing (Attachment D) that they received it and will abide by it.
• New employees, including seasonal staff, are trained before PII access is granted, and background checks are conducted on new employees who will have access to PII.
• Employees may not leave files containing PII open on their desks when away. Computers lock when unattended. At the end of the day all PII records are secured.
• Any employee who willfully discloses PII or fails to comply with these policies faces disciplinary action up to and including termination.
• At separation, the Firm disables the person's logins to Drake Tax, email, remote access and any portal the same day, collects keys and badges, and changes any shared lock combinations. The DSC keeps a secured master list of access rights (Attachment F).

PII Disclosure Policy

• No PII is disclosed without authenticating the receiving party and securing written authorization from the individual whose PII is disclosed, except as required by law.
• Visitors are escorted in any area where PII is stored.
• When records must leave the office, only the minimum necessary is taken, and it is never left unattended in a car, home, or other insecure place.
• The Firm may share client PII with federal and state tax authorities, its tax software vendor (Drake Tax), and service providers in the normal course of business: Google Workspace (email), AnyDesk (remote access). Access by third parties is the minimum required, and each provider must maintain safeguards at least equal to this WISP.

Reportable Event Policy

• After any data security incident, the DSC conducts a post-incident review and records changes to this plan as an addendum.
• The DSC is responsible for obtaining and maintaining any data theft liability insurance the owner decides is prudent.
• The DSC notifies the IRS Stakeholder Liaison and law enforcement in the event of an incident and is the sole point of contact with outside organizations other than law enforcement.

VII. Outside the Firm Risk Mitigation

Network Protection Policy

• Firewall protection, operating system security patches, and all software are kept up to date on every computer that accesses, stores, or processes PII, including any third-party devices on the network.
• Anti-virus and anti-malware software is installed and kept current on every such computer.
• Workstations have the operating system firewall enabled; the office router/firewall firmware is updated per vendor recommendations.
• Event logging stays enabled on systems containing PII, and logs and security alerts are reviewed by the DSC at intervals not to exceed 90 days (16 CFR 314.4(c)(8)).

User Access Control Policy

• Multi-factor authentication is required for any individual accessing any information system containing customer information, including Drake Tax, email, and remote access (16 CFR 314.4(c)(5)). Any exception must be approved in writing by the DSC with an equivalent control.
• Every user has a unique login; there are no shared accounts or passwords. Access is limited to the client data each person needs for their duties (16 CFR 314.4(c)(1)).
• Passwords follow NIST guidance: at least 12 characters, not reused across sites, and changed when there is any sign of compromise. Firm passwords are never used for personal accounts.
• If a password manager is used, the DSC confirms it encrypts stored credentials and requires MFA for new devices.

Encryption Policy

• Customer information is encrypted in transit over external networks and at rest (16 CFR 314.4(c)(3)).
• Laptops and desktops that store PII use full-disk encryption (BitLocker or FileVault). USB drives used for PII are encrypted.
• If encryption is infeasible for a system, the DSC documents and approves an effective compensating control.

Electronic Exchange of PII Policy

• PII is never e-mailed in plain text. Files containing PII are sent only through an encrypted method or password-protected file, with the password sent by a separate channel (phone call or text).
• The Firm may adopt a password-protected client portal after the DSC approves its security.

Wi-Fi Access Policy

• Office Wi-Fi uses strong encryption (WPA2 or WPA3) and a non-default password.
• Any guest Wi-Fi offered to clients must run on a separate network from the Firm's private network.
• Default passwords on printers, copiers, routers, and smart devices are changed or the device's wireless capability is disabled.

Remote Access Policy

The DSC approve all remote access utilities. Remote access uses AnyDesk that encrypts both traffic and authentication, and requires MFA in addition to username and password. Remote access is not available unless the office is staffed and systems are monitored; nights and weekends are high-threat periods for remote takeover.

Connected Devices Policy

• New devices and software undergo a security review by the DSC before they are connected to the network or installed (change management, 16 CFR 314.4(c)(7)).
• AutoRun is disabled for USB ports and optical drives.
• Drives and memory devices removed from service are wiped or physically destroyed so no data can be recovered.
• Approved anti-virus software runs on all computers with definitions updated continuously.

Service Provider Oversight Policy

The Firm selects service providers capable of maintaining appropriate safeguards, requires them by contract to maintain those safeguards, and periodically assesses them based on the risk they present (16 CFR 314.4(f)). Current providers with access to client data:

Information Security Training Policy

All employees are trained on keeping the Firm's PII private and confidential. The DSC conducts training on paper record handling, electronic record handling, phishing, and Firm security procedures at least annually and before each filing season, and before seasonal staff receive access (16 CFR 314.4(e)). Training is recorded with Attachment D.

Testing and Monitoring

The DSC regularly tests the effectiveness of key controls: confirming MFA is on for every account, checking that backups restore, reviewing user access lists, and reviewing security software alerts, at least every 90 days (16 CFR 314.4(d)(1)).

VIII. Incident Response and Breach Notification Plan

This is the Firm's written incident response plan under 16 CFR 314.4(h).

Who the Firm notifies

• The IRS Stakeholder Liaison for the Firm's state, to report a tax professional data breach.
• The Federal Trade Commission, through its online Safeguards Rule reporting form, as soon as possible and no later than 30 days after discovery, if the unauthorized acquisition involves unencrypted information of 500 or more consumers (16 CFR 314.4(j)).
• The Texas Attorney General, through the Attorney General's online form, as soon as practicable and no later than 30 days after determining the breach occurred, if it involves at least 250 Texas residents (Tex. Bus. & Com. Code 521.053, as amended by SB 768, 2023).
• Affected individuals, without unreasonable delay and within the deadline set by Tex. Bus. & Com. Code 521.053 (not later than 60 days after determining the breach occurred).
• State tax agencies (see the Federation of Tax Administrators' Report a Breach page).
• The FBI Internet Crime Complaint Center (ic3.gov) for a cyber-crime, and local law enforcement.
• The tax software vendor (Drake Tax), which can help with next steps.
• The Firm's insurance carrier, if any, and legal counsel.

Immediate checks after a suspected breach

• Check the EFIN activity report in IRS e-Services for more returns filed than the Firm transmitted.
• Look for returns submitted at odd hours (overnight or weekends) or transmitted early Monday or Tuesday after a weekend.
• Check for unexpected email forwarding rules, new remote access software, and unknown user accounts.

IX. Annual Report to the Owner

At least once a year the DSC reports in writing to Maria Lopez (Owner, EA) on the overall status of the information security program and the Firm's compliance with the Safeguards Rule, and on material matters such as the risk assessment, risk decisions, service provider arrangements, test results, security events and responses, and recommended changes (16 CFR 314.4(i)).

X. Implementation

Effective November 9, 2026, Bluebonnet Tax Service (sample firm) has created this Written Information Security Plan in compliance with the requirements for a written information security program in the Gramm-Leach-Bliley Act and the Federal Trade Commission Financial Privacy and Safeguards Rules, and with regard to the Texas Identity Theft Enforcement and Protection Act (Tex. Bus. & Com. Code chapter 521).

Attachment A: Record Retention Policy

• It is Firm policy to retain no PII records longer than required by current regulations, practices, or standards. In no case shall paper or electronic records containing PII be kept longer than 7 years.
• Paper-based records are securely destroyed by cross-cut shredding or incineration at the end of their service life.
• Electronic records are securely destroyed by deleting and overwriting, reformatting the drive, or destroying the drive when it reaches the end of its service life.
• The DSC reviews this retention policy at each annual review to minimize unnecessary retention (16 CFR 314.4(c)(6)(ii)).

Attachment B: Rules of Behavior and Conduct Safeguarding Client PII

• Be careful of email attachments and links. Do not open an attachment or link you were not expecting; call the sender at a known number to confirm. Report phishing attempts to the DSC.
• Use separate personal and business computers, devices, and email accounts. Never send client information to a personal email address.
• Do not connect personal or untrusted USB drives or hardware to Firm computers.
• Do not download software unless the DSC has approved it.
• Never give out usernames or passwords, and never answer unsolicited calls asking for client or business information.
• Do not click OK on unexpected pop-up windows; close them and report them.
• Use strong passwords of at least 12 characters, never reuse Firm passwords, and use MFA wherever it is offered.
• Lock your screen when you leave your desk, and keep a clear desk at the end of the day.

Attachment C: Security Breach Procedures and Notifications

Follow Section VIII. Keep this page with the contact details filled in so they are ready before an incident.

Attachment D: Employee/Contractor Acknowledgement of Understanding

I, ____________________, do hereby acknowledge that I have been informed of the Written Information Security Plan used by Bluebonnet Tax Service (sample firm). I have undergone training conducted by the Data Security Coordinator, and I have been able to have all questions regarding procedures answered to my satisfaction so that I fully understand the importance of maintaining strict compliance with the purpose and intent of this WISP. I understand that there will be periodic updates and training if these policies and procedures change. I understand that non-compliance with the WISP may result in disciplinary action up to and including termination. I understand the importance of protecting the Personally Identifiable Information of our clients, employees, and contacts, and will diligently monitor my actions, as well as the actions of others, so that Bluebonnet Tax Service (sample firm) is a safe repository for all personally sensitive data necessary for business needs.

Attachment E: Firm Hardware Inventory Containing PII Data

Attachment F: Firm Employees Authorized to Access PII

Attachment G: Gap Checklist and Implementation Schedule

These items come from your answers. A plan only protects the Firm when its safeguards are actually in place, so complete each item and record the date.

Attachment H: FTC Safeguards Rule Element Map

About this document

This plan was generated from the answers you gave, using the structure of IRS Publication 5708 and the elements of the FTC Safeguards Rule (16 CFR 314.4). It is a documentation template, not legal advice, and it does not by itself make your firm compliant: compliance comes from actually carrying out the safeguards it describes. Review it, correct anything that does not match your office, and have it reviewed by a qualified professional if you are unsure.

• IRS Publication 5708 (Rev. 8-2024), Creating a Written Information Security Plan for your Tax & Accounting Practice: https://www.irs.gov/pub/irs-pdf/p5708.pdf
• FTC Standards for Safeguarding Customer Information, 16 CFR Part 314: https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314
• IRS Publication 4557, Safeguarding Taxpayer Data: https://www.irs.gov/pub/irs-pdf/p4557.pdf