What the rules mean, where firms fall short, and what to do next.
Coming next: plain guidance on AI use, note-takers, and client data.
Educational only, not legal advice.
The IRS states that tax professionals are required by law to maintain a WISP. A template alone does not create the controls it describes.
A useful WISP matches your real:
The FTC Safeguards Rule applies to covered financial institutions under the Gramm-Leach-Bliley Act. IRS guidance states that federal regulations require professional tax preparers to create and enact security plans protecting client data.
Depending on applicability, the program may include:
Some elements, including a written incident response plan and annual leadership reporting, may not apply under the Rule's fewer-than-5,000-consumers exception.
The real question is whether the firm can show a program exists, matches its environment, and is maintained.
A capable IT provider runs devices, accounts, backups, and support. That alone does not create:
We make sure the security program exists around your IT.
A suspected compromise raises many questions at once:
An incident response plan settles contacts, authority, and first steps before the pressure hits. Exact legal and notification duties depend on the incident, the data, jurisdictions, contracts, and professional advice.
Only if it reflects your real systems, vendors, and workflows. Foundation builds documentation around what you actually run.
We help turn requirements into an operating program. We do not promise audit outcomes or compliance certifications.
Yes, as a document. Foundation builds it, and Managed keeps related procedures current.
Not by default. IR as a service, retainers, and forensics are scoped separately, and we do not replace counsel or carriers.
No. Managed includes a named security contact for program coordination, not a monitoring center.
Your IT keeps systems running. We add the security program around it and work alongside them.
In Managed we operate the security controls, such as MFA, access policies, and endpoint security. General admin, helpdesk, and devices stay with your IT.
Free Security Snapshot, then Accounting Security Foundation (typically 2 to 6 weeks), then Build Your Security Baseline where gaps need closing, then Managed Accounting Security, a monthly program under an annual engagement.
Fees are set before work begins. We do not publish a price list.
Major changes wait until after peak where practical. Urgent risks still get fixed.
Nobody expects partners to know every detail. The exposure is having no one assigned to find out.
Avery reviews what's public about your firm and follows up with plain next steps.
Get a Free Security Snapshot