SecurafyColumbus, Ohio, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for FTC Safeguards Rule, GLBA, ISO 27001, SOC 2, HIPAA and more.
- Standards
- Pricing
- Not published
Written Information Security Plan (WISP)
A WISP is the one document a tax preparer, CPA firm, or any business holding Massachusetts residents’ personal data must be able to produce on request. It names who is responsible, what data you hold, what safeguards protect it, and what happens when something goes wrong. Below: who requires it, what an examiner asks to see, and every tool, consultant and service in this directory that produces or maintains one.
Also called: Written Information Security Program Data Security Plan Safeguards Rule program
Share
Who requires a WISP, and what each one actually says.
Same document, three regulators, three slightly different lists. The ledger records the source, the trigger, and the last date this site confirmed the text.
| Source | Applies when | What it requires | Status | Confirmed |
|---|---|---|---|---|
| FTC Safeguards Rule 16 CFR Part 314 | You are a non-bank “financial institution” under GLBA. Tax preparers and CPAs doing tax work qualify. | A written program with a designated “qualified individual,” written risk assessment, specified safeguards (MFA, encryption, access controls), staff training, vendor oversight, written incident response plan, annual report to the board or senior officer. | Mandatory | Aug 28, 2026 |
| FTC breach notification amendment 16 CFR 314.4(j) | A “notification event” affecting 500 or more consumers. | Notify the FTC within 30 days of discovery. Your WISP’s incident response section should reference it. | Mandatory | Aug 28, 2026 |
| IRS Publication 4557 Safeguarding Taxpayer Data | You hold a PTIN or EFIN. | Points preparers to the Safeguards Rule and states a data security plan is required. Publication 5708 supplies a sample WISP template. | Mandatory | Sep 1, 2026 |
| PTIN renewal attestation | Annual PTIN renewal. | Preparer confirms awareness of data security responsibilities. Not a WISP upload, but an on-record statement. | Attestation | Sep 1, 2026 |
| Massachusetts data security regulation 201 CMR 17.00 | You own or license personal information of a Massachusetts resident, in any state. | The original “WISP” requirement: designated employee, risk identification, employee policies and discipline, third-party contracts, annual review, computer security requirements including encryption of portable devices. | Mandatory | Aug 20, 2026 |
| New York SHIELD Act GBL § 899-bb | You hold private information of a New York resident. | “Reasonable safeguards” with listed administrative, technical and physical measures. A WISP is the customary way to evidence them; not named as such. | Implied | Aug 20, 2026 |
| Cyber insurance applications | Applying for or renewing a cyber policy. | Most carriers’ questionnaires ask whether a written security policy exists and who owns it. Not law, but a “no” prices the policy. | Market | Jul 2026 sample of 6 forms |
Sources 16 CFR Part 314 §314.4(j) 86 FR 70272 IRS Pub 4557 IRS Pub 5708 PTIN requirements 201 CMR 17.00 GBL §899-bb
Further reading
- IRS and Security Summit remind tax pros they must have a WISPThe IRS states the mandate in plain words and points to the Pub 5708 template. Read this before the template itself.IRS newsroom
- Safeguards Rule notification requirement now in effectThe FTC’s own post on the 30-day breach notice, the section most WISPs written before 2024 are missing.FTC business blog
- NIST Cybersecurity Framework 2.0 for small businessIf you want the safeguards section of your WISP to follow a recognized structure, this is the shortest route in.NIST
The document, and the proof around it.
A WISP fails review more often on the evidence around it than on its content. Left: the sections every source expects. Right: what an FTC investigator, IRS agent or state AG asks to see, sorted by who in the market produces each item.
Required sections
Union of the FTC, IRS Pub 5708 and 201 CMR 17.00 lists. A section in only one source is marked.
- Named responsible individual (FTC: “qualified individual”; MA: “designated employee”)
- Inventory of the personal and taxpayer data held, where, and who can reach it
- Written risk assessment, repeated on a schedule
- Safeguards in force: access control, MFA, encryption at rest and in transit, secure disposal
- Employee policies, training, and discipline for violations (MA names discipline explicitly)
- Service-provider oversight and contract terms
- Incident response plan, including the 30-day FTC notice trigger
- Annual review, change log, and report to the owner or board (FTC)
- Staff acknowledgment of the plan (best practice in all three; required by none in those words)
Evidence requested
Four classes. The class tells you which lane of the directory you need.
1 Written planThe current WISP, its version history, who approved it, and the date of last annual review. Consultants write it policy tools control it
2 AttestationWhich named staff acknowledged which version, and when. Departed staff still on record. Policy tools
3 Operational recordsTraining completions, risk assessment reports, vendor contracts, the annual report to the owner. MSPs, LMS, the firm itself
4 Technical controlsMFA enforcement, encryption settings, backup logs, endpoint protection. MSPs and vCISOs compliance automation
Ad from the publisher
Policy Acknowledgment Proof
AcknowledgedWISP 2026by name, on record
Pub 4557 Handledwith AllyMatter
Plan It the Modern WayThe six-element plan, acknowledged by everyone with a client file
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every preparer and admin on record
Version-bound, re-collected each season
03
Produce the record for the IRS in one export
From $29/mo, 20 editors, unlimited staff (published)
Who helps with the WISP
Firms that name this framework in their own material. A listing is not a recommendation. Each firm can confirm its own.
Listed in random order, reshuffled each time the page loads. Firms that pay for a listing are shown at the top, labeled Sponsored.
TruvantisSan Francisco, CA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
Genius GRCWoodstock, GA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for FTC Safeguards Rule, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
TestprosSterling, Virginia
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
FRSecureEdina, Minnesota, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for FTC Safeguards Rule, GLBA, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
ConsilienTorrance, California, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for FTC Safeguards Rule, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
Atlant SecurityUSA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
Omega SystemsUSA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for FTC Safeguards Rule, GLBA, ISO 27001, SOC 2, HIPAA and more.
- Standards
- Pricing
- Not published
MeriplexHouston, TX, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for FTC Safeguards Rule, SOC 2, HIPAA, PCI DSS, CMMC and more.
- Standards
- Pricing
- Not published
IsecurionBengaluru, Karnataka, India
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for FTC Safeguards Rule, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
Compass IT ComplianceNorth Providence, RI, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, CMMC, NIST 800-171, PCI DSS, GDPR and more.
- Standards
- Pricing
- Not published
PCR Business SystemsAkron, OH, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, SOC 2, HIPAA, PCI DSS.
- Standards
- Pricing
- Not published
Vertex11Ashburn, VA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, SOC 2, HIPAA, CMMC, GDPR and more.
- Standards
- Pricing
- Not published
Integrate CyberAustin, TX, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Technology Response TeamDenver, CO, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, CMMC, NIST 800-171, PCI DSS.
- Standards
- Pricing
- Not published
Cyber Security Services (CSS)Westerville, OH, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, CMMC, PCI DSS, NIST CSF, ISO 42001 and more.
- Standards
- Pricing
- Not published
BD EmersonRichmond, VA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, SOC 2, CMMC, NIST 800-171, PCI DSS and more.
- Standards
- Pricing
- Not published
RB Advisory LLCWinter Park, FL, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
ArcherHall (formerly Vestige Ltd)USA, multiple offices
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Secured IT SolutionsNevada, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, HIPAA, CMMC, PCI DSS and more.
- Standards
- Pricing
- Not published
AiriamLewisburg, PA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, CMMC, NIST 800-171.
- Standards
- Pricing
- Not published
InTech PacificHawaii, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, HIPAA, CMMC, NIST 800-171, PCI DSS.
- Standards
- Pricing
- Not published
Alliant CybersecurityHouston, TX, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, HIPAA, CMMC, NIST 800-171, PCI DSS and more.
- Standards
- Pricing
- Not published
ThriveUSA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Cantey Tech ConsultingNorth Charleston, SC, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, HIPAA, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
CompassMSPWest Hartford, CT, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Deer Brook ConsultingNew Gloucester, ME, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, HIPAA, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
DenaliTEKAnchorage, AK, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, HIPAA, CMMC, NIST 800-171, PCI DSS.
- Standards
- Pricing
- Not published
DevilDog CybersecurityDenver, CO, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
First Class NetworksBoston, MA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, SOC 2, HIPAA, CMMC, PCI DSS.
- Standards
- Pricing
- Not published
Intech HawaiiHonolulu, HI, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, HIPAA, CMMC, NIST 800-171, PCI DSS and more.
- Standards
- Pricing
- Not published
Justice IT ConsultingBurleson, TX, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, HIPAA, CMMC, DFARS, SOX.
- Standards
- Pricing
- Not published
LaScalaTemperance, MI, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, HIPAA, CMMC, NIST 800-171, PCI DSS and more.
- Standards
- Pricing
- Not published
M3 Technology Consultants, Inc.Fairfax, VA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, SOC 2, HIPAA, CMMC, PCI DSS and more.
- Standards
- Pricing
- Not published
NetCov (Network Coverage)Danvers, MA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, HIPAA, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
NovacoastWichita, KS, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, HIPAA, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
NuViewPortsmouth, NH, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Ocean SolutionsAshburn, VA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Orion Network SolutionsNagpur, Maharashtra, India
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, HIPAA, CMMC, NIST 800-171.
- Standards
- Pricing
- Not published
Semel ConsultingSarasota, FL, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, HIPAA, CMMC, NIST 800-171, PCI DSS and more.
- Standards
- Pricing
- Not published
Systems EngineeringPortland, ME, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, HIPAA, CMMC, NIST 800-171, PCI DSS and more.
- Standards
- Pricing
- Not published
ThriveonEden Prairie, MN, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, SOC 2, HIPAA, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
VancordMilford, CT, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
WingSweptGarner, NC, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, SOC 2, HIPAA, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
46SolutionsLexington, KY, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, HIPAA, PCI DSS, SOX.
- Standards
- Pricing
- Not published
Advantage IndustriesColumbia, MD, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, HIPAA, CMMC, NIST 800-171, PCI DSS and more.
- Standards
- Pricing
- Not published
CISPoint (COMSO)Columbia, MD, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Cyber Security Solutions (CSS)Tampa, FL, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
DataSure24Buffalo, NY, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA / FTC Safeguards, SOC 2, HIPAA, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
Accent ConsultingLafayette, Indiana, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for FTC Safeguards Rule, HIPAA, CMMC, PCI DSS, NIST CSF and more.
- Standards
- Pricing
- Not published
Foresite Technologies IncOverland Park, KS, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for FTC Safeguards Rule, GLBA, ISO 27001, SOC 2, HIPAA and more.
- Standards
- Pricing
- Not published
Relic Law PLLCBrighton, Michigan, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA, HIPAA, CMMC, NIST 800-171, PCI DSS and more.
- Standards
- Pricing
- Not published
Flexible ITHauppauge, New York, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for FTC Safeguards Rule, ISO 27001, SOC 2, HIPAA, NIST 800-171 and more.
- Standards
- Pricing
- Not published
Impact Risk Advisor
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for FTC Safeguards Rule, GLBA, ISO 27001, SOC 2, HIPAA and more.
- Standards
- Pricing
- Not published
ForgePath SecurityNorfolk, Virginia, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for FTC Safeguards Rule, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Security PS
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for GLBA, ISO 27001, PCI DSS, NIST CSF, FFIEC and more.
- Standards
- Pricing
- Not published
Who assesses the WISP
Government enforcement only. The FTC investigates and brings enforcement actions; there is no certification or third-party audit requirement. Institutions may commission independent assessments voluntarily or under a consent order; No routine inspection or certification. The FTC enforces the Safeguards Rule; Form W-12 warns that false or misleading information may result in criminal penalties and the denial or termination of a PTIN. State boards of accountancy and licensing bodies may act on data security failures.
Assessors
Be the first the WISP assessor listed here
This page is read by the organizations looking for someone to certify them.
Tools for the WISP
Tools that name this framework in their own material.
Grouped by type. Inside each group the order is random, reshuffled each time the page loads. AllyMatter, the publisher of this site, is always first.
AllyMatterPolicy management tool, the policy and acknowledgment layerPublisher of this siteGRC and compliance automation2 tools
Controls, evidence and audit workflows, with a policy module inside.
Privacy and data governance2 tools
Consent, data maps and data subject requests under GDPR, CCPA and similar laws.
Change log for this obligation.
May 2024FTC breach-notification amendment takes effect: 30-day notice to the FTC for events affecting 500+ consumers.
Jun 9, 2023Amended Safeguards Rule fully in force after the extension: MFA, encryption, qualified individual, written incident plan.
2022 filing seasonIRS begins stating in Pub 4557 that a written data security plan is required for preparers; Pub 5708 template published.
Mar 1, 2010201 CMR 17.00 in force; the term “WISP” enters common use.
Subscribe to changes on this page →
Policies that usually travel with it.
Need a hand implementing it?
Find a Consultant for Written Information Security Plan (WISP)
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Manage This Document in AllyMatter
Route it for approval, keep every version, and record a named acknowledgment from everyone who has to read it.
See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff
Cost, ownership, and what counts.
Is the IRS Pub 5708 template enough on its own?
It produces the document. It does not produce a dated approval, an annual review record, staff acknowledgments, or proof the safeguards exist. An examiner asks for all of those. Most firms pair the template with either a consultant or a policy tool, often both.
How much does a WISP cost to get done?
Published prices in this directory run from free (the template) to about $1,800 one-time for a consultant-drafted plan, plus a managed retainer if the same firm implements the technical safeguards. Law-firm drafting for 201 CMR 17.00 is quote-only in every listing we hold.
Does a staff acknowledgment need to be a signature?
None of the three sources say “signature.” A dated, attributable acknowledgment of a specific version is the customary evidence. Some firms want an e-signature anyway for their insurer. Tool profiles state which of the two they capture.
We are not in Massachusetts. Does 201 CMR 17.00 apply?
If you hold a Massachusetts resident’s personal information, yes, regardless of where you are. A tax office in Ohio with one Massachusetts client is in scope.
Sources
- FTC, Standards for Safeguarding Customer Information, 16 CFR Part 314, as amended; final rule at 86 FR 70272. Fetched live at publish.
- IRS Publication 4557, Safeguarding Taxpayer Data; IRS Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice; PTIN requirements.
- Massachusetts 201 CMR 17.00, Standards for the Protection of Personal Information of Residents of the Commonwealth.
- New York General Business Law § 899-bb (SHIELD Act).
- Six cyber insurance application forms sampled July 2026. Held on file, not published, so no link.