For tax preparers, CPAs, EAs & small accounting firms
Build your WISP free — done in an afternoon, kept current all year.
The FTC Safeguards Rule requires your firm to have a Written Information Security Plan, and PTIN renewal asks you to attest that one exists (that's the data-security-plan attestation on Form W-12, line 11). Most firms open the free IRS template, stall, and quietly hope nobody asks. This builder — also free — walks you through plain-English questions about how your firm actually works and hands back a complete, honest WISP. Pay only if you want us to do it with you, keep it current for you, or serve as your Qualified Individual.
Honestly labeled: the builder isn't built yet. It gets built if enough firms sign up — your signup is the vote that decides, and the builder will be free when it opens.
Kovyr WISP Builder — document preview
Written Information Security Plan
- 1Risk assessment✓ Complete
- 2Safeguards in place — access, MFA, encryption✓ Complete
- 3Vendor & service provider oversight✓ Complete
- 4Employee training & acknowledgment log✓ Complete
- 5Incident response plan✓ Complete
Gaps — shown as a to-do list, never hidden
- ☐ Turn on MFA for the shared bookkeeping login — MFA isn't enabled on all accounts yetKovyr can close this gap
- ☐ Test one backup restore before January — backups run, but a restore has never been testedKovyr can close this gap
- ☐ Write the incident response plan — who calls whom, in what order, when something goes wrongKovyr can close this gap
- ☐ Remove access for last spring's departed employeeKovyr can close this gap
The builder never claims a safeguard exists that you said you don't have. Gaps become tasks, not fine print — and where Kovyr implements that safeguard, the item is tagged so you know it doesn't have to be your homework.
Mapped to the FTC Safeguards Rule (16 CFR 314.4) and IRS Publication 4557 guidance.
Why firms stall — in their own words
“People leave motivated, open a blank template, and stall somewhere around page two.”
“A WISP is not a document you write once. It is a document you keep writing.”
Software changes, staff turns over, someone starts working from home — and last year's WISP quietly stops describing your firm. If an examiner, a cyber-insurer, or a client ever asks, an out-of-date plan can be worse than an honest gap list. The builder handles the first draft; the subscription handles the drift.
What the questionnaire covers
Answer in plain English, at your own pace — progress is saved. No security jargon you have to decode first.
- Firm profile & Qualified Individual designation
- Staff, roles & who touches client data
- Systems & software inventory
- Where client data lives — and who can reach it
- Access controls, MFA & encryption status
- Backups & how you'd know they worked
- Email & web security
- Physical security — office, paper files, home offices
- Vendors & service providers list
- Employee training log
- Incident response plan
- Risk assessment with gaps flagged honestly
Out comes a printable WISP document: risk assessment, the safeguards you actually have, an honest gaps checklist with a plan to close them, incident response, vendor oversight, training log, and your review schedule.
How it works
- Answer the questions One sitting for most small firms — about an afternoon, coffee included. Every question explains why it's asked and what the Safeguards Rule expects. Prefer not to DIY? The $497 done-with-you tier is a call where we ask the questions for you.
- Get your WISP — free A complete document generated from your answers, free. Where you're covered, it says so. Where you're not, you get a checklist — not a fiction.
- Keep it current On the $49/mo plan, you re-answer only what changed each year and the document regenerates with a dated change log. Or, on the $249/mo Qualified Individual plan for offices of 1–5, Kovyr keeps it current for you.
Keep-It-Current — $49/mo
The subscription is the point.
A template gets you a document. This keeps the document true — the part firms actually fail at.
- Annual review reminder before PTIN renewal season
- Guided update flow — re-answer only what changed
- Regenerated document with a dated change log
- “What changed this year” FTC / IRS updates, in plain English
- Training & incident log templates that stay attached to your plan
Cancel anytime. Your last generated WISP is yours to keep either way.
Don't want to be your own Qualified Individual? The $249/mo plan below puts Kovyr in that role for offices of 1–5 — upkeep included.
Pricing — the builder is free
Start free and do it yourself. Pay only if you want us on the call with you, keeping the plan current, or standing in as your Qualified Individual. Nothing is charged today — paid tiers are interest only until launch.
WISP Builder
Free
no card · yours to keep
- Guided questionnaire in plain English
- Finished WISP document from your answers
- Risk assessment included
- Gaps shown honestly as a to-do list
Done-With-You
$497
one-time · we build it together
- A call where we ask the questions
- Finished plan & attachments delivered within 5 business days
- Prioritized fix list for your gaps
- For firms who'd rather not DIY
Keep-It-Current
$49/mo
add-on · cancel anytime
- Annual review workflow
- Change tracking & regenerated document
- Training & incident logs
- Rule-change updates in plain English
Qualified Individual plan
$249/mo
offices of 1–5 · by Kovyr Technology
- Kovyr serves as your outsourced Qualified Individual
- We keep the plan current for you
- Keep-It-Current upkeep included
- Option to bundle Kovyr security monitoring
Why free? A finished WISP is the starting line, not the finish — firms still need the plan kept true as staff, software, and rules change. The free builder earns the introduction; the paid tiers are where the ongoing work lives. And on the Qualified Individual plan, you can bundle Kovyr's security monitoring, so the plan isn't just a document — it's backed by someone actually watching the systems.
Kovyr closes the gaps
A gap list isn't homework — it's a work order, if you want it to be.
Many of the gaps a WISP flags are safeguards Kovyr Technology — managed IT & cybersecurity for small firms — implements every week: MFA rollout, encryption setup, backup configuration and testing, security monitoring, staff security training, vendor and service-provider security reviews, incident response planning, and access-control cleanup when someone leaves. Hand the list over, and items move from “gap” to “in place” in your plan — the document gets truer because the firm actually got safer.
Entirely optional, and separate from the builder: the free plan is yours either way. If you'd like to hear what closing your gaps would involve, there's a checkbox on the form below — that's the only time we'll bring it up.
You're on the list.
Thanks for signing up — your signup is a real vote: this only gets built if enough tax pros ask for it. You'll get one email when the free builder opens. If you picked a paid tier, nothing is charged now — paid tiers are interest only until launch, and you'll hear first when yours opens. And if you checked the gap-help box, we'll include information on having Kovyr close the gaps in your plan with that email.
Know another preparer who's been stalling on their WISP? Send them this page.
Get the free builder at launch
Two minutes. It saves your spot for the free builder, tells us your firm's situation (which shapes what gets built first), and — if you pick a paid tier — tells us you're serious. No card, no deposit, nothing charged.