Clear Path step · Business · Your industry's rules and risks
Check the Safeguards Rule and write your WISP
Why it matters: The rule names tax preparers and many small financial firms, and the IRS expects tax professionals to have a written plan. It also gives your security work a clear structure.
On your path if you picked “Financial services” for “What's your industry?”.
Do it
- Read the FTC's Safeguards Rule guide and decide whether you are covered.
- Start from IRS Publication 5708 if you're a tax or accounting practice.
- Name the Qualified Individual and do the written risk assessment.
- Confirm MFA, encryption and service-provider oversight are in place.
- Report to the owner in writing at least yearly.
Check it worked: You've determined whether the FTC Safeguards Rule applies, and if it does you have a written information security plan, a named Qualified Individual and a yearly report to the owner.
Simply put
A written information security plan (WISP) is like a workshop's safety manual: who's in charge, the risks and what's in place. The Safeguards Rule names tax preparers and many small firms, and the plan gives your work a clear structure.
In detail
Firms holding information on relatively few customers are exempt from some parts, including the written risk assessment and yearly report; the FTC guide explains the threshold, and both are worth doing anyway. The rule's service-provider duties apply to AI vendors like any other: if one handles customer information, you must select it with care, bind it by contract and reassess it periodically.
If this is new to you: You don't have to start from nothing. IRS Publication 5708 is a template for tax and accounting practices, and the Federal Trade Commission's guide helps you check whether you're covered.
Points toward the Long View: a written plan that grows with new rules, including those for AI vendors.