WISP Weekly

From Password123 to Ironclad: Your WISP Blueprint for PTIN Renewal & FTC Compliance Hey there, tax pros—if your idea of security is “password123,” it’s time for an upgrade. The IRS now wants a proper Written Information Security Program (WISP) for your PTIN renewal, and the FTC’s Safeguards Rule is sharpening its teeth. Don’t sweat it—I’ve distilled the must-know into bite-size steps you can tackle between returns. 1. Latest & Greatest • IRS PTIN Renewal Upgrade: A WISP is now mandatory—no exceptions. • FTC Safeguards Rule 2.0: You need a “Qualified Individual” on duty, multifactor authentication, and annual staff training. • State-Level Sync: California and New York are eyeballing federal standards; expect more local mandates soon. 2. Expert Insights & Practical Moves • Kickoff with a Risk Assessment: List every way client data could leak—physical files, email attachments, even your USB drives. • Sort & Secure: Classify data by sensitivity (SSNs, tax returns, bank info). Encrypt at rest with AES-256 and in transit with TLS 1.2+. • Lock Down Access: Grant permissions on a need-to-know basis. Admins get admin rights; everyone else gets what they actually need. • Incident Response on Speed Dial: Write a one-page playbook—who calls whom, how you contain the breach, and when clients get the bad news. 3. Dodge These Common Pitfalls • “I’ll get to it after tax season.” Reality check: hackers don’t care about your schedule. Break your plan into 15-minute sprints. • Training That’s a Snooze Fest. Mix in real-world phishing drills and a dash of friendly competition (“Most Improved” award, anyone?). • Vendor Tunnel Vision. Your cloud host might be rock-solid—but what about your printer-as-a-service? Vet every third party, get written assurances. 4. Trends & What’s Next • Automated WISP Builders: Tools that spit out tailored policies in hours, not weeks. • Zero-Trust Creep: Continuous verification means checking IDs even if “Bob from accounting” is on the 10th login. • Privacy by Design: Clients are asking about data protection before you even mention it—get ahead of the curve. 5. Regulatory Cliff Notes • IRS: Document administrative, technical, and physical safeguards. Demonstrate annual reviews and updates. • FTC: Appoint your Qualified Individual, train staff yearly, test your plan with mock incidents, and monitor service providers. 6. Your Go-To Toolkit • WISP Template: Verito’s no-nonsense outline—customize in under a day. • Risk Assessment Checklist: A free download that walks you through every asset in your practice. • Phishing Simulator: Run quarterly campaigns that feel real (and measure who clicked). 7. Your 3-Step Action Plan (Today) 1. Block 15 minutes after lunch to draft your risk assessment roster. 2. Schedule a 30-minute “WISP kickoff” with your lead staffer and pick your Qualified Individual. 3. Download that WISP template and circle back—I’ll hold you to it. Take it from someone who’s seen practices thrive (and some that got burned). Nail these steps, and not only will IRS and FTC auditors leave you alone—they’ll wonder why you’re not charging more for this level of protection. Stay sharp, stay compliant, and let’s keep those client files off the “Help Yourself” table. —Your Trusted Compliance Wingman

May 17, 2025

The WISP Wingman The Compliance Wingman | May 2023 | Vol. 4, Issue 7 From Password123 to Ironclad: Your WISP Blueprint for PTIN Renewal & FTC Compliance Hey there, tax pros—if your idea of security is “password123,” it’s time for an upgrade. The IRS now wants a proper Written Information Security Program (WISP) for your… Read.