Page 1 of 3

TaxFort WISP Self-Check

10 quick questions, about 2 minutes. See how your practice measures up against the security basics the FTC Safeguards Rule and the IRS expect from tax professionals.

Answer honestly. 'Not sure' is a fine answer, and usually a sign worth looking into. We never ask for client information.

1. Does your firm have a written information security plan (WISP)?

A
B
C

2. Is one specific person formally responsible for your firm's security program?

A
B
C

3. Does your business email require a second login step (a code, app, or security key)?

A
B
C

4. Are the hard drives on every computer used for client work encrypted (BitLocker or FileVault)?

A
B
C

5. Do clients send documents through a secure portal rather than as regular email attachments?

A
B
C

6. Is client data backed up somewhere outside your office, and have you tested restoring it in the past year?

A
B
C

7. Has everyone who touches client data, including seasonal staff, had security training in the past 12 months?

A
B
C

8. Do you have written steps for what to do if client data is lost or stolen, including who to notify?

A
B
C

9. When someone leaves or the season ends, is their access to every system removed right away?

A
B
C

10. Do you know which outside vendors (software, IT, payroll, cloud storage) can access your client data?

A
B
C