For tax preparers, EAs, CPAs, and small firms
Most written information security plans are a downloaded template with the firm name pasted into the header. ReadyWISP asks plain questions about how your office actually runs, then writes the plan and its eight attachments from your answers.
Private beta: you'll enter the beta password, then create your account.
Why it matters
Honest question: when was the last time you actually opened your WISP? I don't lead with fear and fines. Most tax pros already want to protect their clients. Here's where the obligation comes from, with the sources, so you can check them yourself.
Federal law
If you prepare tax returns for a fee, the FTC treats you as a financial institution under the Gramm-Leach-Bliley Act. The Safeguards Rule requires you to keep a written information security program, and 16 CFR 314.4 lists what that program has to include. There's no exception for being small.
[VERIFY: pin cite for the “written” requirement itself (believed to be 16 CFR 314.3(a)); wisp-final cites Part 314 and 314.4]
Source: 16 CFR Part 314
IRS guidance, not law
Publication 4557, Safeguarding Taxpayer Data, describes the baseline controls. Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice, is the IRS's sample WISP, revised August 2024. Translation: they show you what the IRS expects to see. They aren't the rule. ReadyWISP follows the Pub 5708 structure.
[VERIFY: Rev. 8-2024 is still the current Pub 5708 revision]
Source: Pub 4557 / Pub 5708
Your PTIN
The PTIN application and renewal ask you to confirm that you're aware of your obligation to have a written data security plan. Every time you renew, you check that box.
[VERIFY: still Line 11 on the current Form W-12, and the same wording in the online renewal]
Source: Form W-12
Your EFIN
If you e-file, IRS Publication 3112 sets out the rules for Authorized IRS e-file Providers, and protecting taxpayer information is part of them.
[VERIFY: Pub 3112 safeguarding language and section; Pub 3112 is not in wisp-final's citations yet]
Source: IRS Pub 3112
A plan you don't follow is worse than no plan. It's a written record of a standard you set for yourself and didn't meet. On the day something goes wrong, the plan is what your insurer, your clients, and the IRS read.
How it works
Five steps, from the first question to a signed plan.
Your tax software, who works there, where the paper files sit, whether the Wi-Fi has a guest network. Each screen tells you why it's asking and which rule is behind the question. “Not sure” is a real answer. Progress saves as you go. Plan on 2 to 4 hours over several sittings, and most of that is looking things up.
Say multi-factor authentication is off on your email. That shows up right next to the question: what's missing, why it matters, what to do about it, and the citation it comes from.
Your WISP and Attachments A through H, written from your answers, as editable Word files in one zip. A print-ready preview lets you save a PDF from your browser. Anything the interview couldn't fill in is marked so you can see exactly what's left.
A separate remediation plan ranks every gap from critical to low, with a rough time to close each one. It isn't part of the WISP, and you don't hand it out.
Check the citations yourself. Have your attorney, your cyber insurance broker, and your IT person read it. Then sign it, and have everyone sign Attachment D before their access is turned on.
Attachment C builds a breach-notification matrix from the states your clients live in, drawn from a 51-jurisdiction reference. It flags Massachusetts (201 CMR 17.00) and New York's SHIELD Act by name. Notification duty follows where the client lives, not where your office is. State statutes change, so verify each one before you rely on it.
The documents and findings come from plain rules over your answers. Same answers, same documents, same findings, every time.
Tell it your backups aren't encrypted and the plan says so, while the remediation plan says fix it. An overstated control is in writing, with your signature under it.
Each explanation and each gap finding carries its citation: the CFR section, the IRS publication, or the state rule. If it can't be cited, it isn't asserted.
The interview never asks for a client Social Security number, a bank account number, or any password, and none of those appear in the documents.
Editable .docx for every document, in a zip you keep. Nothing is locked behind a viewer.
Who it's for
If you prepare returns for a fee and hold client data, this is for you. Size doesn't change the obligation.
You're the owner, the IT department, and the Data Security Coordinator. The interview assumes no IT background.
Partners, staff, a portal, a few vendors. The plan names who's responsible and who can reach what.
Seasonal staff, a shared office, client files on paper and in the cloud. The plan describes the office you actually run.
Run the interview and compare. The gap list shows what your current plan is missing.
Who's building this
Non-attorney admitted to practice before the United States Tax Court
I'm an Enrolled Agent with more than 30 years in IT and cybersecurity. I founded The Youngblood Group, a nationwide tax firm focused on IRS representation, and I teach WISP and data security classes for other tax pros.
ReadyWISP is the method I use in my own practice, turned into an interview. It asks what you actually have, writes the plan from your answers, and tells you plainly where the gaps are.
Me? I'd rather you have an honest plan with a few holes in it than a polished one that isn't true.
ReadyWISP is built by Title 26 Labs, which also builds AskTomG.ai, tax research software made with Tom Gorczynski, EA, USTCP.
FAQ
No. Nothing on this site or in the documents ReadyWISP produces is legal, tax, insurance, or compliance advice, and using it doesn't create a professional relationship with Title 26 Labs LLC or with me. What you get is a starting point built from your own answers. Verify it, and have it reviewed by your attorney, your cyber insurance broker, and a qualified IT or security professional before you sign it.
No, and be suspicious of anything that says it will. A document can't make you compliant. Following it can. A plan you don't follow is a written record of a standard you set and didn't meet.
Pricing isn't set yet. [PRICING TBD]
The interview and the documents are built. ReadyWISP is in a private beta now. Choose Get started, enter the beta password, and create your account.
Yes. The Safeguards Rule has no carve-out for being small. There is partial relief: a firm with customer information on fewer than 5,000 consumers doesn't have to put its risk assessment in writing, and is excused from continuous monitoring or penetration testing, the written incident response plan, and the annual written report (16 CFR 314.6). Everything else still applies. The interview asks where you sit, so the plan reflects it.
IRS Publication 5708 is a good structure, and ReadyWISP follows it. But it's a sample. A sample with your firm name typed in describes a firm that doesn't exist. The parts you need on a bad day (your coordinator, your vendors, your devices, your insurer's breach hotline, the states your clients live in) are exactly the parts a sample can't supply.
No. The interview asks about your firm: your software, your staff and their roles, your devices and vendors, and which states your clients live in. It never asks for a client Social Security number, a bank account number, or a password.
Enter the beta password, create your account, and start the interview.
Private beta: you'll enter the beta password, then create your account.