Tailored to the practice. Not a template download.
A Written Information Security Plan, service-provider oversight, an incident-response plan, and a tabletop your management team actually attends.
Tax and accounting firms are being told to show a written security program. Financial firms are being asked how they would handle an incident. A downloaded policy that names no owner and ignores the MSP does not answer either question.
WISP means Written Information Security Plan. This engagement writes that plan for the practice in front of us. For the public IRS and FTC sources behind that request, see what accounting and tax firms need in a WISP.
CPA, accounting, and tax firms that need a plan matched to the practice, and financial-services firms with a genuine incident-readiness requirement. It also fits as an add-on when a baseline assessment has already shown how the environment actually works.
The IRS has stated that federal law requires tax and accounting professionals to create and maintain a WISP, including risk assessment, safeguards, and service-provider oversight, under the Gramm-Leach-Bliley Act and the FTC Safeguards Rule. Coverage for any specific firm depends on the work it performs. This page is not a legal determination.
The written plan names the safeguards the firm relies on. It does not create them. Multifactor authentication, mail controls, and recoverable backups still have to be configured and checked. Buying documentation does not establish compliance. When this work follows a baseline assessment, the plan is tied to those findings. When it is standalone, the workshop records what the firm believes is in place, and the document says where that belief was not technically verified.
Management names a program owner. Risks and control gaps are documented. Incident roles are assigned. The tabletop is completed and the action list is recorded. Mojave does not sign a certification, and the firm does not become "compliant" because the PDF exists.
A decision-maker in the workshop, access to current policies if any exist, and an honest list of service providers. The IT provider should attend the tabletop when they would be called during a real event.
Plan questions
A Written Information Security Plan, or WISP, is the firm’s written program for protecting client and customer information: who owns it, which risks matter, which safeguards are in place, and how service providers are overseen. The IRS tells tax and accounting professionals to create and maintain one. This engagement writes that plan for the practice in front of us. It is not a blank template purchase.
No. The IRS has stated that federal law requires tax and accounting professionals to maintain a WISP, because the Gramm-Leach-Bliley Act treats them as financial institutions for this purpose. The FTC Safeguards Rule expects a coordinator, a risk assessment, safeguards that are monitored and tested, and oversight of service providers. Whether a specific firm is covered, and which incident-notice duties apply, depends on the work it performs. Mojave does not provide a legal opinion on coverage.
No. Mojave does not issue a certification, a CPA attestation, or a statutory audit opinion. A written plan does not, by itself, establish that safeguards are operating or that a regulation has been met. Insurance eligibility and claim payment are decisions for your insurer.
No. The plan describes how the firm manages security. Technical safeguards, such as multifactor authentication, email controls, and recoverable backups, still have to operate. A document alone does not establish compliance. Where the firm has completed a baseline assessment, the plan is written against those findings.
Yes. Standalone work is $5,500. As an add-on to a baseline assessment, the fee is $3,500 to $4,500, depending on scope. The combined proposal states which price applies.
If you have not had an assessment, we will say so and recommend the order of work.