WISP WorkbookFree · No account · Save as you go
Build Your Written Information Security Plan
Fill in the blanks. It’s a workbook, not a quiz. What you type here becomes the actual text of your plan, and anything you leave blank becomes an honest gap with a date against it.
🔒 Everything you type stays on this device
Your plan is built in this browser, on your machine, and downloaded straight to your disk. Your answers are never transmitted, never stored by us, and never seen by us.
When you click Build, we receive three things and nothing else: your name, your firm, and your email. Nothing about your security.
Your plan is never emailed, because emailing it would mean uploading it to us. It downloads to your machine, and it stays there.
Don't take our word for it. Check. Open developer tools, watch the Network tab, and fill this in. You'll see your answers go nowhere.
Section 1
Your firm
⚖️ The law: §314.4(a) — you must designate one named individual to oversee and implement the program.
💬 In plain English: Security that is everyone's job is nobody's job. When a staffer sees something odd at 4pm on a Friday, they need to know whose problem it is. This person does not need to be technical. It can be you.
💬 In plain English: Security that is everyone's job is nobody's job. When a staffer sees something odd at 4pm on a Friday, they need to know whose problem it is. This person does not need to be technical. It can be you.
Under 5,000 and §314.6 exempts you from four requirements. We'll apply that automatically.
Section 2
What you hold — and where
⚖️ The law: §314.4(c)(2) — identify and manage the data, devices and systems that enable your business.
💬 In plain English: Not "the cloud" — name the systems. The tax software. The accounting platform. The email. The shared drive. The laptop in someone's spare room. Almost every firm doing this finds something it forgot. That forgotten thing is usually the one that gets you.
💬 In plain English: Not "the cloud" — name the systems. The tax software. The accounting platform. The email. The shared drive. The laptop in someone's spare room. Almost every firm doing this finds something it forgot. That forgotten thing is usually the one that gets you.
| System / place | What client data is in it | Who can access it | Where | MFA on? | |
|---|---|---|---|---|---|
Quick add:
Examples: tax software · accounting platform · email · document storage · payroll · staff laptops · phones · backup service.
Section 3
Who else can see your clients' data
⚖️ The law: §314.4(f) — you must select service providers capable of appropriate safeguards, require them by contract, and periodically assess them.
💬 In plain English: Your data path is rarely one hop. Every hop is a company holding your clients' financial information. Sooner or later a client will ask, in writing, "which companies have access to our financial information?" That is a completely reasonable question, and "I don't know" is a bad answer.
💬 In plain English: Your data path is rarely one hop. Every hop is a company holding your clients' financial information. Sooner or later a client will ask, in writing, "which companies have access to our financial information?" That is a completely reasonable question, and "I don't know" is a bad answer.
| Vendor | What they hold or touch | Contract requires safeguards? | Last assessed | |
|---|---|---|---|---|
Quick add:
Ask each one for their subprocessor list. Reputable ones publish it.
Section 4
Multi-factor authentication
⚖️ The law: §314.4(c)(5) — MFA is required for any individual accessing any information system. Not "where practical." Not "encouraged."
💬 In plain English: This is the single most important page in this workbook. Firms are not destroyed by anything exotic. Someone's password turns up in a breach dump, an attacker walks in the front door of the email account. MFA stops nearly all of it. It is usually free. It takes an hour.
💬 In plain English: This is the single most important page in this workbook. Firms are not destroyed by anything exotic. Someone's password turns up in a breach dump, an attacker walks in the front door of the email account. MFA stops nearly all of it. It is usually free. It takes an hour.
Section 5
Encryption, access and disposal
⚖️ The law: §314.4(c)(3) encryption in transit and at rest · §314.4(c)(1) access controls · §314.4(c)(6) secure disposal · §314.4(c)(8) logging.
💬 In plain English: The one everybody forgets is laptops. A stolen laptop with an unencrypted drive is a data breach with a police report attached — and BitLocker and FileVault are free and take ten minutes.
💬 In plain English: The one everybody forgets is laptops. A stolen laptop with an unencrypted drive is a data breach with a police report attached — and BitLocker and FileVault are free and take ten minutes.
Section 6
Backups — and the question nobody asks
⚖️ The law: Availability of customer information is part of a comprehensive program under §314.3.
💬 In plain English: A backup is not a restore. An untested backup is a hypothesis, and the day you discover the hypothesis was wrong is the day you needed it to be true.
Your clients' books live in QuickBooks Online or Xero. If a client's ledger were deleted, corrupted or encrypted tomorrow — who restores it?
💬 In plain English: A backup is not a restore. An untested backup is a hypothesis, and the day you discover the hypothesis was wrong is the day you needed it to be true.
Your clients' books live in QuickBooks Online or Xero. If a client's ledger were deleted, corrupted or encrypted tomorrow — who restores it?
Section 7
Your people
⚖️ The law: §314.4(e) — security awareness training for personnel, kept current. Not exempt for small firms.
💬 In plain English: Go back through every real-world failure. Not one of them was a firewall problem. Every single one was a person, in a moment, doing something reasonable. Your people are your last line. Arm them.
💬 In plain English: Go back through every real-world failure. Not one of them was a firewall problem. Every single one was a person, in a moment, doing something reasonable. Your people are your last line. Arm them.
| Name | Role | Last trained | |
|---|---|---|---|
Section 8
Verifying money movement
⚖️ The law: Not a single line in §314.4 — but this is where the actual losses happen.
💬 In plain English: In 2024 a finance worker at Arup paid out about US$25 million after a video call with what he believed were his CFO and colleagues. Every person on that call was a digital fake. You will not out-perceive the fakes. You just have to move the last check onto a channel the attacker doesn't control.
💬 In plain English: In 2024 a finance worker at Arup paid out about US$25 million after a video call with what he believed were his CFO and colleagues. Every person on that call was a digital fake. You will not out-perceive the fakes. You just have to move the last check onto a channel the attacker doesn't control.
Section 9
AI — what is in your firm, and what can it DO
⚖️ The law: §314.4(c)(2) — your inventory must include all systems touching client information; an AI tool a staffer signed up for is a system.
💬 In plain English: The most important table in this workbook, and almost no firm can fill it in. There is a difference between a chatbot and an agent. A chatbot produces text. An agent produces text and does things. Every control you have ever relied on assumes a human is the last step. An agent is on the other side of that gate.
💬 In plain English: The most important table in this workbook, and almost no firm can fill it in. There is a difference between a chatbot and an agent. A chatbot produces text. An agent produces text and does things. Every control you have ever relied on assumes a human is the last step. An agent is on the other side of that gate.
Fill in the last two columns carefully.
For every AI that can move money, send externally, or change a record — is there a human approving that specific action, every time? If the answer is “never” or “I didn't know we had it” — remove it.
| AI tool / automation | Who uses it | What data goes in | Can it ACT? | Human approves each action? | Last used that power | |
|---|---|---|---|---|---|---|
Quick add:
Don't forget: meeting note-takers · browser extensions · AI baked into apps · personal ChatGPT/Claude accounts · Make/Zapier scenarios.
Section 10
AI — the rules you set
⚖️ The law: §314.4(c)(3). And if you prepare tax returns: IRC §7216 makes it an offence for a preparer to knowingly or recklessly disclose tax return information — a misdemeanor.
💬 In plain English: The likeliest way client data leaves your firm this year is not a hacker. It is a good employee at 9pm, under pressure, pasting a client's ledger into a free chatbot. That is a disclosure of client information to a third party.
💬 In plain English: The likeliest way client data leaves your firm this year is not a hacker. It is a good employee at 9pm, under pressure, pasting a client's ledger into a free chatbot. That is a disclosure of client information to a third party.
That last one matters more than it looks. If a document your AI reads can contain instructions — and it can — then a malicious invoice can carry instructions to the assistant that is able to pay it.
Section 11
AI — would you notice, and could you prove it?
⚖️ The law: §314.4(c)(8) — logging and monitoring of authorised users. An AI acting on your behalf is activity that must be visible.
💬 In plain English: Two things. Detect: does a named human see a list of what the AI actually did? An alert that goes to a shared inbox goes nowhere. Prove: if a client asked "that email on the 14th — where did that come from?", could you answer with a record rather than a recollection?
💬 In plain English: Two things. Detect: does a named human see a list of what the AI actually did? An alert that goes to a shared inbox goes nowhere. Prove: if a client asked "that email on the 14th — where did that come from?", could you answer with a record rather than a recollection?
Section 12
When something goes wrong
⚖️ The law: §314.4(h) — a written incident response plan covering roles, communications, remediation and post-incident revision.
💬 In plain English: You will not be thinking clearly on the day. That is the entire reason this gets written down now, while you are calm and nothing is on fire. Fill in the phone numbers. You will not be looking them up calmly at 4pm on a Friday.
💬 In plain English: You will not be thinking clearly on the day. That is the entire reason this gets written down now, while you are calm and nothing is on fire. Fill in the phone numbers. You will not be looking them up calmly at 4pm on a Friday.
Section 13
Has anyone actually tried to break in?
⚖️ The law: §314.4(d) — continuous monitoring, or annual penetration testing plus vulnerability assessments every six months.
💬 In plain English: A scan looks for known weaknesses. A penetration test hires someone to actually try to get in. Until somebody has actually tried, everything you believe about your defences is a belief.
💬 In plain English: A scan looks for known weaknesses. A penetration test hires someone to actually try to get in. Until somebody has actually tried, everything you believe about your defences is a belief.
Build your plan
0% complete. Fill in what you can — blanks become gaps, and that's the point.
Enter a valid email to build. Generated on your device — we never see your answers.
Your plan is never emailed. It is assembled on your device as a Word document and downloaded to your disk. The only thing we receive is a three-field note — name, firm, email — so we know a firm built a plan. Nothing about your security travels with it.