Client data map
Where returns, IDs, and bank details live, from intake and tax software to portal and backups.
The Problem
Your WISP Is a Template Nobody Has Opened Since Filing Season
It shows up when an insurer, a new hire, or a suspicious login asks what your written plan says, and the file still has blanks from the template.
Logins
Three preparers share one tax software login.
Logins
Named accounts for each preparer, with MFA on the tax software and email.
Template
The WISP template still has blank sections.
Template
Every section written for your office, from data inventory to incident response.
Email
Client returns sit in an inbox without MFA.
Email
MFA on email and a secure portal for sending returns to clients.
Breach plan
Nobody knows who to call after a data theft.
Breach plan
An incident section with IRS contacts, client notices, and the FTC 30-day step.
It's February, and three preparers share one login to the tax software. Client returns sit in an email inbox with no MFA. Last spring someone downloaded a WISP template, filled in the firm name, and saved it to the desktop. Then a client calls about an IRS letter for a return they didn't file. Now you need to know who to call, what to tell clients, and whether the FTC needs a notice. The template doesn't say.
We start with how your office really runs: which tax software, portal, email, and devices hold client data. Then we write the plan to IRS Publication 5708 and the FTC Safeguards Rule, naming a Qualified Individual and real procedures. Every safeguard the plan claims gets checked in the settings, from MFA to backups. You end up with a plan that matches your office, instead of one that only matches the template.
Written for your office
Your software, portal, devices, and staff roles are named, so the plan matches daily work.
Safeguards checked, not claimed
MFA, encryption, and backups confirmed in settings before the plan says they exist.
Breach steps ready early
Who to call, what clients hear, and when the FTC gets notice, written before you need it.
Our Written Information Security Plan Process
From a Blank Template to a Working Plan in Five Clear Steps
You answer questions about how the office works, approve each section, and confirm every safeguard change before staff see it.
We ask how many people handle client data, which tax software and portal you use, and where files are stored. You get a fixed quote and a short list of what to gather.
What's Included
What You Get With a Data Security Plan for Tax Preparers
Each project covers a data map, a written risk assessment, the full plan, the safeguard checks your plan includes, staff training, and a yearly review checklist.
Compare Options
DeveloperLook vs IRS Template vs Managed IT Provider
The free IRS template is a solid starting point, and your IT provider knows your machines. Here is where each one fits for a small firm.
| Feature | DeveloperLookBest fit | IRS template | Managed IT provider |
|---|---|---|---|
| Cost | Fixed price from $550 | Free to download | Often inside monthly fees |
| Fit to your office | Your software, roles, and devices | Blanks you fill in | Rarely writes the plan |
| Risk assessment | Written from a data map | Guidance only | Technical risks they see |
| Safeguard checks | Confirmed in your settings | Not included | Strong on devices they manage |
| FTC breach steps | Written into the plan | General guidance | Varies by provider |
| Staff training | Session plus sign-off records | Not included | Sometimes, as an add-on |
| Speed | 1 to 2 weeks for the plan | As fast as you write | Depends on their queue |
| Ongoing upkeep | Yearly review checklist | Your own reminders | Strong for device updates |
DeveloperLook
IRS template
- Cost
- DeveloperLook: Fixed price from $550IRS template: Free to download
- Fit to your office
- DeveloperLook: Your software, roles, and devicesIRS template: Blanks you fill in
- Risk assessment
- DeveloperLook: Written from a data mapIRS template: Guidance only
- Safeguard checks
- DeveloperLook: Confirmed in your settingsIRS template: Not included
- FTC breach steps
- DeveloperLook: Written into the planIRS template: General guidance
- Staff training
- DeveloperLook: Session plus sign-off recordsIRS template: Not included
- Speed
- DeveloperLook: 1 to 2 weeks for the planIRS template: As fast as you write
- Ongoing upkeep
- DeveloperLook: Yearly review checklistIRS template: Your own reminders
Projects We've Built
Accounting, Payroll, and Insurance Platforms We Have Built
Fiduciary, payroll, insurance, and HR platforms we designed and built. They're examples of our build work for firms that handle client money and records, not WISP projects.
Armada AG Fiduciary and Consulting Services Website
- Finance
- Business
- Website
Payrole Global Payroll Website Design & Development
- HR & Staffing
- Dashboard
- SaaS Platform
Dualcare Insurance App Design & Development
- Insurance
- Dashboard
- Mobile App
Upsen HR Management App Design & Development
- HR & Staffing
- Dashboard
- Mobile App
What Our Clients Say
What Clients Say After Launch
Feedback from teams we have built platforms, apps, and websites for.
We had a pretty specific idea of what we wanted our website to become, but I wasn’t sure how easily we could explain all of it to a development team. There were quite a few moving parts, and we were working toward a deadline, so I expected a few things to get lost along the way. That never really happened. They understood what we were trying to achieve, kept us updated throughout the process, and got everything ready within the agreed timeline. The final site feels much easier to navigate, works beautifully on mobile, and is noticeably smoother for our customers. It was a huge relief seeing the original idea actually turn into the website we had in mind.
The mobile experience is probably my favourite part of the new site. We had spent a lot of time making sure the desktop version looked right, and the team kept pushing us to think about how everything would actually feel on a phone too. They were right. The navigation is clean, the interactions feel natural, and everything we’ve tested so far works exactly as it should. They also went through the links, forms, integrations, and other details more than once before launch, which I really appreciated. And even after going live, we could still reach out when something came up. The whole process felt friendly, organised, and surprisingly straightforward.
What I appreciate most is that the website is actually easy for us to manage now. We can update content ourselves instead of sending a developer a message every time we need to change something small. They also paid attention to the technical SEO side, which mattered to us because we didn’t want a new website to create problems for the traffic we already had. I’ve probably asked more questions than I should have since launch, but every question has been handled patiently and without any fuss. The team is easy to work with, they explain things clearly, and when we need something changed, they focus on getting it done rather than making the process complicated.
1,250+
Projects shipped
10+
Years of experience
Top 3%
Upwork Top Rated Plus
5 stars
Average review score
1,250+
Projects shipped
10+
Years of experience
Top 3%
Upwork Top Rated Plus
5 stars
Average review score
Want results like these?
Tell us what you are building. You get a reply within 24 hours on business days, then a written estimate.
Work Culture
Why Tax and Accounting Firms Trust Us With Their WISP
Your plan only helps if staff can follow it during a busy season. These habits keep it short, true, and easy to update.
We check before we write
A safeguard goes into the plan only after we see it in the settings. Your WISP then describes your office, not an ideal one.
Planned around filing season
Training and changes happen outside your busiest weeks. Nothing new goes live on a preparer's machine in the middle of April.
Honest about the template
If the IRS template plus an hour of your time covers a two-person office, we'll tell you before we quote. You don't pay for a plan you could write yourself.
Plain language for staff
The plan uses the words your team uses, not legal phrasing. Staff can find the lost-laptop steps without asking anyone.
Client data stays put
We review settings and screenshots, not client returns. When we need access, it's read-only and removed once the check is done.
One fixed price per office
You get a fixed quote based on staff and offices. Extra locations or entities are priced before any work starts on them.
Overview
What is a written information security plan?
DeveloperLook writes a written information security plan for tax preparers, CPA firms, and small offices, then checks every safeguard in it. Each plan follows IRS Publication 5708 and the FTC Safeguards Rule, names a Qualified Individual, and covers MFA, encryption, backups, and breach notice. Projects start at $550 and take 1 to 6 weeks.
DEVELOPERLOOK
Project facts · Written Information Security Plan (WISP)
- Service
- Written information security plan (data map, risk assessment, WISP, safeguard checks)
- Typical timeline
- 1 to 2 weeks for the plan, 3 to 6 weeks with safeguards
- Platforms
- Microsoft 365, Google Workspace, Drake Tax, Lacerte, UltraTax CS, ProSeries
- Built with
- Microsoft Entra ID, Intune, BitLocker, Bitwarden, Backblaze
- Experience
- 10+ years of development experience and 1,250+ shipped projects
- Post-launch support
- 30 days of questions and plan updates
- Communication
- Calls in US, UK, and AU business hours
- Starting price
- From $550 USD, fixed scope after a free call
Reviewed 27 Oct 2026 by Saimul Islam
Good fit
Tax preparers and enrolled agents
Your preparers share a login to the tax software, and you want a data security plan for tax preparers that fixes that before next season.
CPA and bookkeeping firms
Your firm holds payroll files, bank details, and returns for hundreds of clients, and your insurer asked to see your written plan.
Firms after a data theft scare
Your client got an IRS letter about a return they didn't file, and you need incident steps written down before it happens again.
Owners of a new practice
Your new practice needs a WISP before its first season, and you'd rather follow the IRS WISP guidance properly than fill in a blank template.
Office managers keeping the plan current
Your WISP security plan was written three years ago, and since then you've changed tax software, hired staff, and moved files to the cloud.
Not a fit
Need a full policy library
You need a full set of security policies for SOC 2 or ISO 27001. Our security policy development service covers that broader library.
Two-person office, small budget
Your office has two people and a budget under $550. The free IRS Publication 5708 template, filled in carefully, is a reasonable start.
Need legal advice
You need advice on state breach notice laws or client contracts. A lawyer should handle that, and we can share the plan with them.
Want an ongoing security lead
You need an ongoing security lead to act as your Qualified Individual. Our vCISO Services page covers that monthly role.
Not sure we're the right fit?
Book a free call or message us. We'll tell you honestly whether we're the right team.
Pricing
Transparent Starting Prices for a Written Information Security Plan
These are starting points in USD. Your final price depends on your staff count, offices, and how many safeguards need fixing, and you get a fixed proposal after a free call.
For Agencies
White-Label WISP Plan Writing for IT Providers and Accounting Consultants
You own the client relationship. We supply the data maps, written plans, and safeguard checks under your brand, so your tax and accounting clients get a WISP that matches their office.
How the partnership works
White label: your client only ever sees your brand
Your clientSees only your brand
You, the agencyOwn the relationship
DeveloperLookBehind your brand
Share the client brief
Send the client's staff count, tax software, portal, and any insurer or IRS requests.
- Client needs
- You share the details
- Details received
We map and write
We run the data map and risk review, then draft the plan for your review.
- Scope and plan
- Proposal to resell
- Your quoteYOUR LOGO
Check and hand off
We check safeguards, train staff under your brand, and hand over the final WISP.
- Done by our team
- Your brand on it
- Handed to your clientDone
- Your client
- You, the agency
- DeveloperLook
Share the client brief
Send the client's staff count, tax software, portal, and any insurer or IRS requests.
- Client needs
- You share the details
- Details received
We map and write
We run the data map and risk review, then draft the plan for your review.
- Scope and plan
- Proposal to resell
- Your quoteYOUR LOGO
Check and hand off
We check safeguards, train staff under your brand, and hand over the final WISP.
- Done by our team
- Your brand on it
- Handed to your clientDone
Partner with DeveloperLookDelivered under your brand
The Right Technology for Your Project
Technology Stack
We secure the tax software, email, and portals your office already uses, and write the plan around them.
- Drake Tax
- Lacerte
- UltraTax CS
- ProSeries
- Microsoft 365
- Google Workspace
- SmartVault
- ShareFile
- Microsoft Intune
- Microsoft Entra ID
- BitLocker
- Bitwarden
- Backblaze
- Microsoft OneDrive
- IRS Publication 5708
- Microsoft Word
01 / 04
Related Services
Firms often add staff training, small business security basics, incident planning, and an outside security lead to keep the plan alive.
Cybersecurity Services
DeveloperLook provides cybersecurity services for businesses without a security team. We assess identity, email, devices, cloud, and web apps, fix the gaps you approve, and recheck every fix, so you get a cybersecurity service provider that does the work.
Information Security Policy Development
DeveloperLook provides information security policy development for growing companies. We write a short top-level policy plus the topic policies and procedures behind it. Then we check each one against your real settings, so your team can follow every cybersecurity policy.
Cybersecurity Services for Small Business
DeveloperLook provides cybersecurity services for small business teams with no IT staff. We switch on MFA, separate admin accounts, block email spoofing, secure laptops and phones, and set up backups we've test-restored, all in tools you already pay for.This page
Written Information Security Plan (WISP)
Pairs with the 6 services around it
Incident Response Plan Development
DeveloperLook provides incident response plan development for growing companies. We write the roles, first-hour checklist, and playbooks for your likeliest incidents, following the NIST incident response plan guidance, and set a testing schedule you can keep.
FTC Safeguards Rule Compliance
DeveloperLook provides FTC Safeguards Rule compliance for auto dealers, lenders, and other non-bank financial businesses. We check whether the rule applies, map customer data, and put each required safeguard in place, from MFA to the FTC breach notice.
Cybersecurity for Accounting Firms
DeveloperLook provides cybersecurity for accounting firms, tax practices, and bookkeepers. We check the IRS Security Six on every computer, put MFA on tax software and portal logins, and move client files out of email. It's cyber security for accountants, timed around filing season.FAQ
Frequently Asked Questions
Straight answers on cost, timing, what the plan must include, and how the IRS and FTC rules apply.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
A WISP with us starts at $550 for a firm of up to 10 staff. Adding safeguard checks, MFA, training, and a vendor list starts at $1,750 for up to 25 staff. Multi-office programs with device management and scans start at $3,600. You get a fixed quote after a free call.
The plan itself takes 1 to 2 weeks, mostly spent waiting on answers about your software and staff. With safeguard checks and fixes, expect 3 to 6 weeks. We schedule changes and training outside your busiest filing weeks, so preparers aren't interrupted in March or April.
Yes, if you prepare tax returns or provide accounting services. Under the Gramm-Leach-Bliley Act these firms count as financial institutions, and the FTC Safeguards Rule requires a written information security program. The IRS and its Security Summit partners remind tax professionals of this duty regularly.
A good WISP names a Qualified Individual, maps where client data lives, and records a risk assessment. It then sets safeguards: access control, MFA, encryption, secure disposal, training, vendor oversight, and monitoring. IRS Publication 5708 also asks you to cover employee management, information systems, and how you detect and handle system failures.
Start with a map of where client data lives, then write a risk assessment based on it. Next, choose safeguards for each risk, name the person responsible, and write incident steps. Finally, check each safeguard is really switched on, train staff, and set a yearly review. IRS Publication 5708 gives a sample structure to follow.
The IRS WISP (written information security plan) is the plan the IRS tells tax pros to keep. Publication 5708 is its guide and sample template. The legal duty comes from the FTC Safeguards Rule, which calls it a written information security program, and the IRS publication helps small practices meet that duty.
A WISP policy is the set of day-to-day rules inside your plan. It covers password and MFA rules, who can see which client files, how devices are locked, and how old records are destroyed. It isn't a separate document, and we write it in plain language so new hires can follow it.
Yes, and for a one- or two-person office it can be enough if you fill it in honestly. The template can't check your settings, though. The common WISP compliance gap is a plan that claims safeguards the office hasn't switched on yet, such as MFA on email.
If unencrypted information about 500 or more customers is acquired without authorization, you must notify the FTC within 30 days of discovery. Your plan should also cover telling the IRS and affected clients. We write these steps into the incident section with contacts, owners, and ready templates.
Review it at least once a year and after any big change, such as new tax software, a new office, or a breach. The FTC Safeguards Rule expects the program to be adjusted as your business changes. You get 30 days of questions and plan updates after handover, plus a yearly review checklist.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
Free 30-min callGoogle Meet
Book a call
Book a free 30-minute call
In 30 minutes on Google Meet we walk you through how we would build it, how long it takes and what it costs. Then you get a written estimate.
Calendar not showing? Book on cal.com or send a brief.