Your WISP should describe your office, not a template.
The FTC Safeguards Rule treats tax preparers and accounting firms as financial institutions. That means a written information security plan, one named person responsible for it, and controls that match what the plan says. Cybertitans writes the plan and runs the IT underneath it, so the two stay the same thing.
Small firms where IT is somebody’s side job.
- You downloaded IRS Publication 5708 and it’s still mostly blank.
- Client returns live in email attachments, a shared drive and someone’s laptop.
- Your cyber insurance renewal asked about MFA and backups, and you had to guess.
- Tax season is the worst time for anything to break, and it’s when everything does.
Plain English version.
A written plan. One Qualified Individual who owns it. A risk assessment. MFA for anyone who touches customer information, encryption, access limited to the people who need it, staff training, a look at your vendors, and a yearly report to the owner. Since May 2024, a breach involving 500 or more people has to be reported to the FTC within 30 days. Firms with fewer than 5,000 customers skip a few pieces, but not the plan, MFA or encryption. IRS Publication 4557 covers the same ground from the tax side.
We write it and we run it.
Scoping first: where client data lives today, and where it should live. Then the controls: MFA and conditional access on Microsoft 365, encrypted devices, backups you can actually restore, 24/7 detection on every computer, and access reviews. Then the WISP itself, written about your firm, with the evidence behind each line. We come back every year, because the plan has a date on it.
Best time to start is after a deadline, not during one.
How compliance work runsThe price is on the page.
Managed IT runs on TiTAN, and the price is published. TiTAN Core starts at $897 a month for up to ten people. Pro, where most firms belong, is $1,790 a month for up to ten and includes unlimited support. Every tier runs the same security stack: Huntress 24/7 detection, Microsoft 365 locked down properly, backup and patching. The WISP work is scoped once we know where your data lives.
See TiTAN and pricingGrab the template first. Free.
Our WISP template is free, no email required. If you want to know how exposed you are right now, run the Cyber Insurance Readiness Score. Want to talk it through after? It’s 20 minutes, or call (651) 300-7030.
Get the WISP template Book 20 minutesWhat tax and accounting firms ask first.
Does the Safeguards Rule really apply to a small practice?
Yes. The FTC counts tax preparation firms as financial institutions under the rule, whatever their size. Some requirements are lighter under 5,000 customers. The written plan isn’t one of them.
Can I just fill in Publication 5708?
It’s a good start. The gap is that a filled-in template describes what you intend, and an insurer or an investigator will ask what you actually do. That’s the part we close.
Do you certify compliance?
No, and nobody can. There’s no FTC certificate. We implement the controls and document them. Your attorney and your insurer are the ones who judge them.
Are you local?
Yes. Cybertitans is based in Woodbury, MN, and works with firms across the Twin Cities. Support is remote first; onsite visits are by appointment, with no travel charge within 30 miles of Woodbury.