Your WISP, written and actually working
Federal law requires every paid tax preparer to keep a written information security plan, and your PTIN renewal asks you to confirm you know it. We write a plan that fits your office, based on the IRS's own template, and check that the safeguards behind it (MFA, encryption, backups) are really in place.
- Independent IT firm in Lawrenceville, GA · Gwinnett & Metro Atlanta
- In business since 1997
- Flat price, no contract
Why so many preparers are behind on this
Required regardless of size
The FTC Safeguards Rule, under the Gramm-Leach-Bliley Act, treats tax preparers as financial institutions, regardless of size. A written security plan is required.
You attest to it
Form W-12, line 11, has you confirm that you know preparers "are required by law to create and maintain a written information security plan."
The template sits unfinished
The IRS publishes a free 28-page sample (Publication 5708). Many busy preparers download it and never finish it, or fill in the blanks without the safeguards it describes.
Paper vs. reality
A plan that says "we use MFA" doesn't help if your email or tax software doesn't actually use it.
Three fixed-price options
WISP Essentials
$499
Solo preparer · up to 3 devices · remote
- A WISP tailored to your office, built from IRS Publication 5708 and mapped to the FTC Safeguards Rule
- Hardware, systems, authorized-user and vendor inventories
- Employee and contractor acknowledgment form
- Incident response outline: who to call, including the IRS Stakeholder Liaison, your state, and the FTC if 500 or more people are affected
- Annual review calendar reminders
- A 60-minute walkthrough of your own plan
WISP + Security Baseline
$699
Up to 3 staff · 8 devices · remote
- Everything in Essentials
- MFA checked and turned on for email, tax software, portal and cloud storage
- Disk encryption (BitLocker or FileVault) on computers with client data
- Backups checked, including a test restore
- Guest Wi-Fi separated from your work network
WISP + On-site
$899
Up to 5 staff · 12 devices · in Gwinnett
- Everything in Baseline
- On-site walkthrough of your office
- Router and firewall review
- Short staff training session with signed acknowledgments
Flat prices by office size: $499, $699 or $899. PTIN renewal season (October–December) is a natural time to finish your WISP, before filing season starts.
How it works
Send the short form
No client data, ever.
A 20-minute scoping call
Choose a tier and agree on a date.
A 30–45 minute intake interview
We ask about systems and habits, never client information.
9–10 checked: good shape. 6–8: fix gaps before filing season. 5 or fewer: start with MFA and a written plan this month.
Try it yourself first
This checklist comes from published requirements. If you can check every box, you may not need us. If you can't, we can fix it for you at a flat price.
Get my WISP scoped →Questions people ask
Is a WISP really required for a small or one-person practice?
Yes. IRS Publication 5708 says tax and accounting professionals are financial institutions under the GLBA and the Safeguards Rule "regardless of size." A sole practitioner can use a shorter plan.
Is your plan "IRS-approved"?
No one can offer an IRS-approved WISP, and we're not affiliated with the IRS. We build your plan from the IRS's own sample (Publication 5708) and the text of the FTC rule.
Do I need to give you client information?
Never. We only ask about systems and practices: which software you use, whether MFA is on, how many devices you have.
I have fewer than 5,000 clients. Does that change anything?
Yes. The FTC rule exempts firms with customer information on fewer than 5,000 consumers from a few items, such as the written risk assessment, penetration testing, a written incident response plan and the annual board report. The core plan, MFA, encryption, training and FTC breach notification still apply. We include the extra pieces as good practice.
What if I already have a template filled in?
Send it over. We can review it and handle only the gaps, usually for the Essentials price or less.
Can you be our "Qualified Individual"?
The rule allows a service provider to fill that role, but your firm stays responsible. We'd only do it under a separate written agreement. Most small offices name the owner.
Is this legal advice?
No. Green Orb is an IT firm. For legal questions, talk to your attorney.
Do you work outside Gwinnett?
Yes. Essentials and Baseline are fully remote anywhere in the US. On-site visits are in Gwinnett and nearby.
Get my WISP scoped
Two minutes. Please don't include client names, SSNs, EINs or any tax data.
Green Orb, Inc. isn't affiliated with or endorsed by the IRS, the FTC or the Security Summit. Our plans are adapted from IRS Publications 5708 and 5709 and refer to the FTC Safeguards Rule (16 CFR Part 314). This isn't legal, tax or accounting advice. Your firm remains responsible for its own compliance.