-
×
ISO 45001 Toolkit - Comprehensive 50+ Templates
1 × $99.00
Subtotal: $99.00
ISO 45001 Toolkit - Comprehensive 50+ Templates
1 × $99.00 Subtotal: $99.00
Written Information Security Plan toolkit for US tax and accounting practices. 74 editable templates covering all 10 elements of the FTC Safeguards Rule, 16 CFR Part 314 — including the FTC notification obligation that took effect on 13 May 2024. Includes a 19-document fast path for practices holding information on fewer than 5,000 consumers, which 16 CFR 314.6 exempts from four of those ten. Instant download.
$99.00
✓ In stock — instant download after checkout
Federal law requires tax and accounting professionals to create and maintain a Written
Information Security Plan. The IRS says so in its own words, and the obligation comes from
the Gramm-Leach-Bliley Act by way of the Federal Trade Commission’s Safeguards Rule at
16 CFR Part 314 — tax preparers count as financial institutions, which puts them
squarely inside it.
This toolkit is 74 editable templates — 59 Word documents and 15 Excel
workbooks — organised into 14 sections that follow the structure of the Rule
itself, so that an examiner working through 16 CFR 314.4 can be handed the matching section.
16 CFR 314.6 disapplies four of those ten for a practice holding customer
information on fewer than five thousand consumers: the written risk assessment, penetration
testing and vulnerability assessments, the written incident response plan, and the annual
written report to a board.
Whether a given practice sits below that line is a question of counting, not of size — and the count is not the number of returns filed. So this pack ships two routes:
than from taste — one document per element §314.6 leaves mandatory, plus the framing
documents and the IRS reporting procedure;
The determination document comes first in the pack for exactly this reason. Getting it right
can be the difference between 19 documents and 74.
It also tells you what the exemption does not do. §314.6 removes the requirement to write
certain things down; it does not remove the duty to do them. A practice below the threshold
still has to base its programme on a risk assessment and still has to respond to a security
event. Reading the exemption as permission to skip the activity is the most common way a
small practice ends up non-compliant while believing itself exempt — and the pack says so on
the page where it matters.
16 CFR 314.4(j), the obligation to notify the Federal Trade Commission, took effect on
13 May 2024. Any WISP written before then is missing an entire element of the Rule. If
your practice already holds a plan, this is the part it does not have.
The pack covers the determination, the submission and the content checklist — and it is built
around the provision that catches people out. Under 16 CFR 314.4(j)(2) an event is discovered
on the first day it is known to the practice, and the practice is **deemed to know if it is
known to any employee, officer or agent** other than the person who committed the breach. The
30-day clock does not start when the Qualified Individual is told. It starts when the
seasonal preparer noticed.
| Section | Documents | Element of 16 CFR 314.4 |
|---|---|---|
| 01 WISP Core | 6 | The plan, its scope, the inventory, the §314.6 determination |
| 02 Qualified Individual | 4 | 314.4(a) |
| 03 Risk Assessment | 5 | 314.4(b) |
| 04 Safeguards | 13 | 314.4(c) |
| 05 Testing | 4 | 314.4(d) |
| 06 Personnel | 6 | 314.4(e) |
| 07 Service Providers | 5 | 314.4(f) |
| 08 Evaluation | 3 | 314.4(g) |
| 09 Incident Response | 6 | 314.4(h) |
| 10 Governance | 3 | 314.4(i) |
| 11 FTC Notification | 4 | 314.4(j) |
| 12 IRS Overlay | 5 | IRS obligations alongside the Rule |
| 13 Registers | 6 | The evidence |
| 14 Implementation | 4 | How to use it |
Three of the workbooks ship seeded rather than empty. The evidence register opens with all
56 identifiers of 16 CFR 314.4 already listed, each flagged as applying or as one of
the 4 the small-practice exemption removes. The document index carries all
74 documents with the fast-path column, so an exempt practice can filter to its
19 and work that list.
The risks the documents address are the ones this sector actually faces: credential phishing
that impersonates the tax software vendor, business email compromise and the mailbox
forwarding rule that signals it, callers asking to change refund bank details, the mailbox
that has quietly become an archive of returns, and seasonal accounts opened fast in January
and never removed in May.
Section 12 handles the obligations that sit alongside the FTC Rule: reporting client data
theft to the IRS Stakeholder Liaison, aligning to Publication 4557, client notification
letters drafted before they are needed, and a seasonal readiness checklist.
This pack gives you the structure completed, the exemption analysis, the 2024 notification
element, the registers and the evidence trail.
pointer only, because a state-by-state table goes stale and a stale one is worse than none.
engaged.
by the Rule will find most of it applies; section 12 will not.
01 WISP Core
02 Qualified Individual
03 Risk Assessment
04 Safeguards
05 Testing
06 Personnel
07 Service Providers
08 Evaluation
09 Incident Response
10 Governance
11 FTC Notification
12 IRS Overlay
13 Registers
14 Implementation
Reviews
There are no reviews yet