For tax preparers & financial advisors
A WISP for tax preparers, written from what's actually in your office.
If you asked an IT company about a WISP and they asked about your router, you're not the first. In their trade, those four letters mean a wireless internet provider.
A few computers isn't too small. It's the size this is built for.
I look at your office first, write down what's actually there, and build the plan from that. If you want, I can also run the IT that keeps it that way.
What turned up when someone looked
In a four-person tax office: a back-room PC that didn't come back on after a power outage, antivirus reporting to nobody, and a file server outside the backup. Nobody there had done anything wrong. Looking just wasn't anyone's job.
If you already wrote one from Pub 5708
IRS Publication 5708 has a real template, it's free, and preparers write serviceable plans from it every year. What a template can't do is check whether its sentences are true at your firm.
If you already wrote one, send me what you wrote at kendall@kovyr.com. I'll read it and tell you what's still open — and if it's fine, I'll say so. One free review per firm.
Your WISP packet
A findings report
The external scan — DNS, SPF, DKIM, DMARC, TLS, security headers, certificate-transparency inventory, credential-breach exposure — plus what we checked at your office (in person if you're between Richfield and Spanish Fork; by photo checklist and a phone call if you're farther out). In English, with the severity of each item and what it would take to fix.
The risk assessment
Written from those findings. This is the element the blank template leaves for you.
The WISP itself
With each section mapped to the element of 16 CFR §314.4(a)–(j) it answers — and where §314.6 lifts an element for your firm, we mark it covered, not required, rather than let you believe the rule demanded it of you.
An incident response plan
Who does what if data is exposed, including §314.4(j), which requires notice to the FTC within 30 days of a security event involving at least 500 consumers. §314.6 excuses the plan itself below 5,000 consumers; we include it anyway, at no extra cost.
A Qualified Individual designation letter
Naming both the QI and the senior person at your firm who oversees that role.
A vendor oversight addendum
You can send it to your tax software, portal, backup and hosting providers.
An evidence log
Every element tied to either a scan observation or a dated attestation from your intake, with the history kept.
What we are not
- Not IRS-approved. If a page tells you its plan is IRS-approved, ask it which office does the approving. There isn't one. That's a fair test to run on me too.
- Not legal advice.
- Not a penetration test.
- Not a compliance guarantee.
If you carry cyber coverage
Pull the application you signed and read what it says about your written security program and MFA. The plan we write should say the same thing, and be true.
The rule, read carefully
Under the FTC Safeguards Rule, every tax preparer and financial firm that handles client financial data must develop, implement, and maintain an information security program that is written down (16 CFR §314.3(a)) — and §314.2(i) defines that program as the safeguards you actually use.
IRS Publication 4557 is the IRS explaining that rule to preparers. Your PTIN renewal, Form W-12 Line 11, asks you to confirm you're aware it applies to you.
How it works
1 · Free scan
See what an attacker or an auditor can see from the outside — in seconds, no obligation.
2 · The WISP
We scan, look at your office (in person if you're between Richfield and Spanish Fork; by photo checklist and a phone call if you're farther out), ask only about what we couldn't see, and write the WISP from what we found. $897, five business days from completed intake; annual update $297/yr.
3 · Monitoring
Optional: recurring external monitoring with your documentation kept current — $1,497 with your WISP for the first year, then $99/mo. It is evidence toward §314.4(d)(1); it is not the “continuous monitoring” alternative in §314.4(d)(2).
Start with a free look at your firm
Free, instant, and passive — we only read what’s publicly visible about your domain: its email and DNS records, and its website if it has one.
One thing your security program probably doesn't cover.
Its vendor section assumes a company with a contract. A staff member pasting client information into a chatbot on a personal account isn't a vendor — so nothing in the program catches it. Our AI Readiness Assessment covers that gap — and credits in full toward the WISP ($897, or $1,497 with your first year of monitoring included) if you add it within 90 days.
Ready for your WISP?
$897, five business days from completed intake. Or call 435-201-2646.
Prefer to build it yourself? Try the free WISP Builder — answer guided questions, get a finished plan, and keep it current.
Kovyr produces compliance documentation reflecting your firm's information and our external observations. It is not legal advice, not a penetration test, and not a certification. The IRS does not endorse or approve any vendor. Kovyr does not carry bound errors-and-omissions coverage and is not SOC 2 audited.