Written Information Security Program (WISP)

A Written Information Security Program (WISP) is the documented plan describing how an organization identifies the sensitive information it holds, the risks to that information, and the controls it maintains to protect it. For most firms the WISP is not optional paperwork. It is the specific artifact a regulator or examiner asks for first, and the document that determines whether a firm’s actual security practices can be credited at all.

Who Is Required to Have a WISP

The obligation reaches further than most firms expect:

• Tax preparers and CPA firms — the FTC Safeguards Rule treats tax return preparers as financial institutions, and IRS Publication 4557 states plainly that a written plan is required. A Preparer Tax Identification Number renewal asks preparers to confirm awareness of this duty.
• Non-bank financial institutions — mortgage brokers, collection agencies, investment advisers not registered with the SEC, and others covered by 16 CFR Part 314.
• Registered investment advisers and broker-dealers — through Regulation S-P and FINRA supervision expectations rather than the Safeguards Rule itself, but the practical deliverable is the same document.
• Firms bound by state law — several states require a written program independently of federal rules.

What a WISP Must Contain

Under the Safeguards Rule, a compliant program addresses nine areas. A WISP that omits any of them is incomplete on its face:

• Designation of a Qualified Individual accountable for the program
• A written risk assessment identifying foreseeable internal and external threats
• Access controls limiting who can reach customer information, and periodic review of those permissions
• A data inventory recording what is collected, where it lives, and why it is retained
• Encryption of customer information in transit and at rest
• Secure development practices for any in-house or customer-facing applications
• Multi-factor authentication for anyone accessing customer information
• Secure disposal of customer information no longer needed, generally within two years
• Change management, activity monitoring and logging, penetration testing and vulnerability assessment, staff training, service provider oversight, a written incident response plan, and an annual written report to the governing body

The Qualified Individual Requirement

Someone must be named. The role can sit with an employee, or with an external provider, but accountability cannot be delegated away: where a firm uses an outside provider, it must still designate a senior member of its own staff to oversee that provider. Naming an IT vendor and stopping there does not satisfy the rule.

In practice this is why firms without internal security leadership engage a vCISO. The function is the same — own the risk assessment, approve exceptions, review access, and report annually to ownership — and it produces the records an examiner expects.

Why a Template WISP Fails

Downloadable templates are common and they are where most firms go wrong. A template describes a generic organization. The rule requires a program appropriate to the firm’s size, complexity, and the sensitivity of the information it holds, grounded in that firm’s own risk assessment.

The tell is specificity. A WISP that does not name the firm’s actual systems, its actual vendors, its actual data locations, and the person actually accountable reads as aspiration rather than practice. Examiners test it by asking for the evidence behind it: show the access review, show the training log, show the penetration test result, show the annual report. A template has nothing behind it.

How a WISP Gets Used After It Is Written

The document is a reference, not a filing. It should be reviewed and updated when the risk assessment changes, when systems or vendors change, and after any security incident, with the review dated and recorded. A WISP last touched three years ago is evidence of a lapsed program rather than a live one.

The most common failure is not an absent control. It is a control the firm genuinely operates but cannot evidence — multi-factor authentication enforced everywhere, with no policy stating so, no record of exceptions, and no periodic review. That firm is written up alongside one that never enabled it.

Why a WISP Matters for Investment & Professional Firms

For CPA, tax, legal, and advisory firms across DFW, the WISP is the document that carries the rest of the program. It is what the FTC expects, what the IRS references, what cyber insurers ask for at renewal, and increasingly what institutional clients request in security questionnaires before they will sign. DKBinnovative has built and maintained these programs for compliance-intensive firms since 2004, for clients in Frisco, Plano, Irving, and Las Colinas — written against the firm’s own risk assessment, with the access reviews, training logs, and annual reports attached so the program can be evidenced rather than asserted.

Related DKBinnovative Resources

• Managed IT for Investment & Professional Firms
• Managed IT for Accounting & CPA Firms
• Glossary: FTC Safeguards Rule
• Glossary: IRS Publication 4557
• Glossary: vCISO
• Glossary: Incident Response Plan

External references: 16 CFR Part 314 (Safeguards Rule) · FTC Safeguards Rule guidance · IRS Publication 4557 · NIST Cybersecurity Framework