Your Written Information Security Plan, written for your firm — and a Qualified Individual to stand behind it.
We prepare your WISP and serve as your outside Qualified Individual under the FTC Safeguards Rule — fixed fee, fully remote, and done before the December 31 PTIN deadline.
Every PTIN expires on December 31, 2026.
When you renew, IRS Form W-12, Question 11 asks you to attest that you are aware you are required by law to create and maintain a Written Information Security Plan. That requirement comes from the FTC Safeguards Rule, which treats tax preparers as financial institutions. More than 886,000 PTIN holders face the same deadline — and filing season opens in late January, when there is no time left to write a plan. The window to get this done is now.
What you receive
A complete, working security program for your firm — not a template with your name dropped in.
A WISP written for your firm
Your Written Information Security Plan, drafted around how your firm actually works — your staff, your software, your client data — covering the elements the FTC Safeguards Rule requires.
Risk assessment
For firms above the 5,000-consumer threshold, a documented assessment of the risks to the taxpayer data you hold, and the safeguards in place for each one.
MFA, encryption & vendor oversight
A plain checklist of what to turn on and verify: multi-factor authentication, encryption of taxpayer data, access limits, and oversight of the software vendors who touch client information.
Incident response plan
A written plan for what your firm does in the first hours of a breach or a lost laptop — who acts, who gets called, and what gets documented.
Qualified Individual designation
The Safeguards Rule requires a named Qualified Individual responsible for your security program. We serve as that outside Qualified Individual for firms that don’t have one in-house.
Annual review
Your plan is reviewed and refreshed each year — new staff, new software, new threats — so the document you attest to stays true.
How it works
Four steps, all remote. Most firms take three to six hours of your time, total.
Intake call
A short call about your firm: size, software, how client data moves, and whether your PTIN renewal is done.
Remote review
We interview you and review evidence of your current setup — no site visit, no disruption to your workday.
Draft plan
You receive the draft WISP and checklist, with anything your firm needs to change flagged in plain language.
Final plan + QI designation
The final plan is issued and, if you choose the bundle, we are formally designated as your Qualified Individual.
A note on smaller firms: if your firm holds data on fewer than 5,000 consumers, the Safeguards Rule exempts you from a few elements — the written risk assessment, a testing schedule, a written incident response plan, and the annual written report. You still need the program itself, MFA, encryption, and training. We’ll tell you honestly which parts apply to you, and only build those.
Fixed pricing, published
No “call for a quote.” The price depends on the size of your firm, and the exact figure is confirmed on the intake call — before any work starts.
- WISP written for your firm
- MFA / encryption / vendor checklist
- Incident response plan
- Ready before the Dec 31 deadline
- Everything in WISP Only
- Risk assessment, where required
- Us named as your Qualified Individual
- Annual review included in year one
- We stay on as your Qualified Individual
- Plan kept current as your firm changes
- Annual review and refresh
- A named person to point to when asked
The honest version: the IRS publishes a free sample plan (Publication 5708). If you have time to fill it in yourself, use it. What you’re paying for here is a plan written for your firm, plus a named Qualified Individual who keeps it current.
What the rule actually requires
Two documents drive all of this. Here they are, without the sales pitch.
FTC Safeguards Rule (16 CFR Part 314)
Tax preparers count as financial institutions under this rule. It requires a written information security program with a designated Qualified Individual, safeguards such as multi-factor authentication and encryption, staff training, oversight of service providers, and a written incident response plan.
IRS Publications 4557 & 5708
The IRS’s own guidance on safeguarding taxpayer data — including a free sample WISP in Publication 5708. We cite these openly because they’re the standard your plan will be measured against, and because you should know the free option exists.
About Prepared Practices
We’re Certified Third-Party Risk Professionals (CTPRP), also holding CISM and CISSP certifications. Assessing security programs is our day job — it’s the work we do, not a sideline to selling software.
We independently assess the security programs of organizations across multiple frameworks — SOC 2, ISO 27001, and NIST. For tax and accounting firms, that same assessment discipline is what produces a WISP that reflects your firm as it actually operates.
We are independent assessors. We don’t sell IT services or tax software, and we don’t earn anything from the tools we recommend — so the plan we write has one job: to be accurate about your firm.
Book an intake call
Tell us a little about your firm and we’ll come to the call with the right price and a straight answer on what you do — and don’t — need.
The call is a working conversation, not a sales pitch: firm size, your renewal status, and what shape your current plan is in. If the free IRS sample is all you need, we’ll say so.
Prefer email? Write to us at info@preparedpractices.com. We reply within one business day.
Privacy Policy
Last updated: November 2026
What we collect
When you use the intake form on this site, we collect the information you submit: your name, your firm name, your contact details, your firm size, your PTIN renewal status, the state of your current WISP, and anything you type in the message field.
How we use it
We use that information only to respond to your inquiry and to provide the WISP and Qualified Individual services — nothing else.
Sharing
We never sell your information. We do not share it with third parties except for the service providers needed to operate this site and our email — for example, our website host and email provider — and only as needed for them to provide those services.
Please do not send client tax information through this form. Do not submit tax returns, client documents, or Social Security numbers here — the engagement process has a separate, secure way to exchange information.
Cookies and logs
We keep this minimal: this site uses basic hosting logs only, with no analytics cookies at launch. If analytics are added later, this policy will be updated.
Requesting deletion
To request deletion of information you submitted, email us at info@preparedpractices.com or use the intake form on this page, and we will delete it.