[Firm name] written information security plan
Replace everything in [square brackets].
1. Purpose and scope
This plan sets out how [Firm name] protects the confidentiality, integrity and availability of customer information: names, addresses, Social Security numbers, tax returns and return information, bank details, identity documents, and anything else our clients give us. It covers every person who works for or with the firm, every device and system that holds customer information, and paper records.
It is written to meet the FTC Standards for Safeguarding Customer Information (16 CFR Part 314) and follows IRS Publication 5708, Creating a Written Information Security Plan for your Tax and Accounting Practice. Effective date: [date].
2. Qualified Individual and responsibilities
| Role | Name | Responsibilities |
|---|---|---|
| Qualified Individual | [Name] | Oversees and enforces this plan, runs the yearly risk assessment, and reports to [the owners] at least once a year. |
| Outside IT provider (if any) | [Company, contact] | [What they manage: devices, backups, monitoring.] The firm stays responsible and the Qualified Individual supervises them. |
| Every team member | All | Follows this plan, completes security training, and reports anything suspicious to the Qualified Individual at once. |
3. Risk assessment
Reviewed [date] by [name]. Rate likelihood and impact as low, medium or high. Every gap goes on the action list in section 9.
| Risk | Likelihood | Impact | What we do today | Gap |
|---|---|---|---|---|
| Phishing email steals a login | Blank | Blank | [e.g. MFA on email and tax software, training] | Blank |
| Lost or stolen laptop or phone | Blank | Blank | [e.g. full-disk encryption, remote wipe] | Blank |
| Ransomware | Blank | Blank | [e.g. offline backups, patching, endpoint protection] | Blank |
| Client data sent by ordinary email | Blank | Blank | [e.g. client portal, encrypted file share] | Blank |
| Former staff keep access | Blank | Blank | [e.g. leaver checklist, access review] | Blank |
| A vendor is breached | Blank | Blank | [e.g. vendor review, contract terms] | Blank |
| Customer information pasted into an unapproved AI tool | Blank | Blank | [e.g. AI policy, approved tools list] | Blank |
| Paper records left out or thrown away unshredded | Blank | Blank | [e.g. clean desk, locked storage, shredding] | Blank |
4. Inventory: what we hold and where
| Item | What customer information it holds | Who has access | Protection |
|---|---|---|---|
| [Tax software] | [Returns, SSNs, bank details] | [Names] | [MFA, roles] |
| [Practice management / CRM] | Blank | Blank | Blank |
| [Client portal / file share] | Blank | Blank | Blank |
| [Email] | Blank | Blank | Blank |
| [Laptops and desktops: count] | Blank | Blank | [Encryption, screen lock, updates] |
| [Phones] | Blank | Blank | Blank |
| [Backups: where] | Blank | Blank | Blank |
| [Paper files: where] | Blank | Blank | [Locked cabinet] |
5. Safeguards
- Access: each person has their own login and only the access their work needs. Access is reviewed every [period] and removed the day someone leaves.
- Multi-factor authentication for anyone who accesses customer information on any system.
- Encryption of customer information on devices and in transit. No customer information in ordinary email attachments.
- Updates: operating systems, browsers and software update automatically; devices that no longer get updates are retired.
- Endpoint protection and a firewall on every device; the office Wi-Fi uses WPA2 or better with a strong password, and guests use a separate network.
- Backups: [daily] backups, one copy offline or immutable, restore tested every [period].
- Disposal: customer information is deleted or shredded no later than [period] after it is last needed, unless the law or a business need requires keeping it.
- Change management: new systems and changes are checked against this plan before they go live.
- Monitoring: logins and activity on key systems are logged and reviewed for anything unusual.
- AI tools: customer information goes only into tools on the firm’s approved list, under its AI policy.
6. Service providers
We choose providers that can protect customer information, require it in our contracts, and check them every [period].
| Provider | What they do | Customer information they hold | Security terms in contract | Last reviewed |
|---|---|---|---|---|
| [Provider] | [Service] | [Data] | [Yes / No] | [Date] |
7. Incident response plan
Anyone who suspects an incident tells [Qualified Individual] at once, on [phone]. Then:
- Contain it: disconnect affected devices, reset passwords, revoke access. Do not wipe anything that may be evidence.
- Report data theft to your IRS Stakeholder Liaison, who alerts IRS Criminal Investigation and the right IRS teams. Find the liaison for your state on irs.gov.
- If unencrypted information about 500 or more consumers is involved, notify the FTC as soon as possible and no later than 30 days after discovery, through the FTC’s online form.
- Check your state’s breach notification law, and notify affected clients and the state attorney general where it requires.
- Call your cyber insurer [policy and phone] and outside IT provider [phone].
- Write down what happened, what was affected and what was done, and update this plan.
8. Training
Every team member reads this plan and completes security awareness training when they join and at least once a year: [course or provider]. Training records are kept by [name].
9. Action list, review and sign-off
| Gap from section 3 | Fix | Owner | Due |
|---|---|---|---|
| Blank | Blank | Blank | Blank |
This plan is reviewed at least once a year and after any material change or incident. The Qualified Individual reports in writing to [the owners] at least once a year on the state of the program, the risk assessment, and any incidents.
Approved by [name, role] on [date]. Next review due [date].
Firms that hold information on fewer than 5,000 consumers are exempt from some Safeguards Rule requirements, including the written risk assessment, the written incident response plan and the annual written report. This template keeps them in, because the IRS recommends them and they cost little in a small firm.
This template is a starting point, not legal advice. Your obligations depend on where you practise, your professional body and your clients; take advice on anything you are unsure of.