Blog
A Written Information Security Plan Checklist for Small Firms
September 13, 2026
Most firms that search for a "WISP checklist" are looking for a shortcut — something to fill in once and file away. The problem is that a checklist treated as a form-filling exercise rarely holds up to how the FTC Safeguards Rule actually works: it wants a plan that matches your firm's real systems and workflow, not a set of boxes ticked off a generic list. Below is what an actually complete checklist covers, and where the generic version usually falls short.
The Checklist
- Designate a qualified individual. One named person (owner, office manager, or outside consultant) responsible for the security program — not a shared or unassigned responsibility.
- Inventory where client data actually lives. Every system, app, spreadsheet, and cloud folder that touches client tax returns, financial statements, or payroll data — including tools staff use informally that never made it into an official list.
- Document access controls. Who can see what, and why — reviewed whenever staff join, leave, or change roles.
- Require multi-factor authentication on every system storing client information, not just your primary practice management software.
- Confirm encryption for client data both in transit and at rest, across every tool in your inventory — not just the ones you think of first.
- Vet and document every vendor with data access, including a written agreement covering how each one safeguards it.
- Write an incident response plan describing exactly what happens in the first 24 hours after a suspected breach, and who is responsible for each step.
- Keep employee training records showing staff have actually been walked through the plan, not just told it exists.
- Set a review schedule. At minimum annually, and immediately after any change to your tools, vendors, or staff access.
Where Generic Checklists Fall Short
Every item above sounds straightforward in isolation, but the actual work is in the specifics — and that's exactly where a downloaded template runs out. "Inventory where client data lives" means something different for a firm running a single cloud accounting platform than for one juggling a client portal, a document intake tool, and a handful of spreadsheets staff built themselves. "Vet every vendor" is a five-minute task if you use one platform and a much longer one if you've stitched together several tools over the years. A checklist that doesn't force you to map your firm's actual data flow just gives you the illusion of completion.
Why This Isn't a One-and-Done Software Problem
It's tempting to look for a single piece of software that checks every box on this list automatically. In practice, no off-the-shelf product can, because your firm's specific mix of tools, staff, and client workflows is exactly what determines whether each item is actually satisfied. A tool built generically for "accounting firms" has no way of knowing whether your intake process routes documents through an unsecured inbox or a properly access-controlled portal — that's something a plan has to be built around, not assumed away. This is one of the reasons we build automation and security workflows around each firm's specific setup rather than shipping the same package to every client.
For the legal background behind this checklist, see our guides to the FTC Safeguards Rule and WISP requirements for tax preparers. This is also part of our complete guide to AI for accountants.
Frequently Asked Questions
What does a written information security plan checklist actually need to cover?
At minimum: a named qualified individual responsible for the program, an inventory of where client data lives, access controls and multi-factor authentication, encryption in transit and at rest, a vendor management process, an incident response plan, employee training records, and a defined review schedule. A checklist that's missing any of these isn't complete under the FTC Safeguards Rule.
Can I just fill in a downloaded WISP template and call it done?
You can fill in the template, but that alone doesn't make you compliant. The FTC Safeguards Rule requires the plan to reflect your firm's actual risk profile — the specific software you use, how client documents move through your systems, and who has access to what. A generic template checked off item by item still leaves the real work undone.
Who at a small firm should own the WISP checklist?
The rule requires a designated qualified individual, but at a small firm that's usually the owner or office manager, not a dedicated security hire. The checklist should assign a specific owner to each item rather than leaving it as a shared, ambiguous responsibility — that's usually where completed checklists quietly go stale.
How often does the checklist need to be reviewed?
At least annually, and again any time something material changes — a new software vendor, a new employee with data access, or a change in how documents are collected from clients. A checklist finished once during onboarding and never revisited doesn't hold up if a firm is ever audited or breached.
Does completing the checklist protect my firm if a vendor's software is compromised?
Partially. The Safeguards Rule requires you to vet and maintain written agreements with any vendor touching client data, which is one checklist item — but it doesn't transfer liability entirely. Your firm is still expected to have assessed that vendor's security practices before handing over data, which is exactly why a checklist item that just says "using software" isn't specific enough.
We build every security workflow around your firm's actual tools and data flow — never a generic checklist filled in from a template.
Book a Free Consultation