Get the WISP Builder

For tax preparers, EAs and small CPA firms

Your WISP in one place: organized, dated and signed

Answer simple questions about your practice. Get your plan, risk assessment, incident response plan, training log and staff sign-offs, with your own systems, gaps and dates. The Compliance Binder keeps the evidence with them, ready to hand over when an examiner, your insurer or the IRS asks.

Get it for $199 See what's included
  • Works offline: client details never leave your computer
  • Print to PDF or edit in Word
  • No subscription: you buy each year's edition
WISP Builder showing a firm's safeguards score and the documents it generates
Renewing your PTIN? Form W-12 asks you to confirm that you know you must have a written data security plan. That requirement comes from the FTC Safeguards Rule, which treats tax preparers as financial institutions. Firms without a plan face FTC enforcement and, after a breach, a much harder conversation with the IRS, your clients and your insurer.

The free IRS template is a start

IRS Publication 5708 is a good sample. But it is a generic document: you still have to rewrite it for your software, your people, your providers and the gaps you actually have.

The builder writes it for you

Your answers become a plan that names your Qualified Individual and your systems, with your providers in its provider register.

And keeps it current

Save your answers file, open it next year, change what changed, and print the updated plan, annual report and training log.

Seven documents, one set of answers

Each document cites the part of the rule it satisfies, so an examiner, auditor or insurer can follow it.

Written Information Security PlanScope, Qualified Individual, systems, safeguards, testing, training, providers, incident response and FTC notification (16 CFR 314.4).
Risk assessmentNine common risks for tax practices, rated for likelihood and impact, with residual risk based on your answers.
Incident response planRoles, decision authority and an 11-step data theft checklist: IRS Stakeholder Liaison, states, FBI, FTC 30-day notice, clients.
Service provider registerWho can reach client data, whether the contract requires safeguards, and when each provider is due for review.
Training logWho was trained, when, on which topics, and when they are due again.
Staff acknowledgmentsA signature page for every person who handles client data.
Annual report and review checklistThe Qualified Individual's yearly written report to the owner, plus a 10-point annual review.
Action planEvery "No" or "Partly" becomes a dated task with an owner, so your plan shows progress, not just intentions.

Included: the Compliance Binder. An encrypted evidence binder: a tab for each requirement shows what is on file and what is missing, staff training with certificates is filed automatically, and one click exports everything for an examiner. Each person gets their own login. Your access code comes with your download.

See a real sample (PDF)
Sample page of a generated plan showing the safeguards table with gaps highlighted
Sample page, for a fictional firm. Gaps are highlighted in red.

How it works

  1. Download and openUnzip and double-click. It opens in your browser.
  2. Answer 8 short stepsYour firm, your Qualified Individual, where client data lives, 16 safeguards, providers, people and incident contacts.
  3. Print, sign, keepSave as PDF or Word. Sign it, have your staff sign their acknowledgments, and file it with your records.

WISP Builder

$199 2027 edition

  • All seven documents plus the action plan
  • Unlimited updates of your own plan during 2027
  • Works on Windows and Mac
  • Download right after payment
Buy now · $199

Not sure? See a real sample for a fictional firm (PDF)

Secure checkout by Stripe: card, Apple Pay and more. Your download opens right after payment and your receipt arrives by e-mail. Digital product, all sales final; see the terms.

Read the rules first

All compliance guides

Questions

Is a WISP really required for my practice?

Yes. The FTC Safeguards Rule (16 CFR Part 314) applies to tax preparers as financial institutions under the Gramm-Leach-Bliley Act, and requires a written information security program. The IRS reminds preparers of this in Publication 4557, Publication 5708 and on Form W-12 when you renew your PTIN.

I'm a one-person practice. Is this overkill?

No. The builder adapts to your size. Firms that keep information on fewer than 5,000 consumers are exempt from some written parts of the rule (16 CFR 314.6); the plan says so, and still includes them as good practice.

Where is my data stored?

Only on your computer. The builder runs in your browser with no internet connection, and your answers stay in a file you save. The Compliance Binder works the same way: your documents are encrypted and kept on that computer, not in an online account. Nothing is sent to us or anyone else.