What is a WISP?

A WISP outlines your organization's security policies, controls, and procedures.

Note: the WISP requirement has been in effect since June 9, 2023. Non-compliance may result in fines of up to $100,000 imposed by the IRS, along with potential legal actions from both the FTC and affected consumers.

What are the objectives of the WISP?

A. Ensure the Security and Confidentiality of all PII retained by the Firm. 

B. Protect PII against anticipated threats or hazards to the security or integrity of such information. 

C. Protect against any unauthorized access to or use of PII in a manner that creates a substantial risk of Identity Theft or Fraudulent or Harmful use.

Why is important?

• Increasing cybercriminal activity in the accounting industry makes accountants prime targets for identity theft and sensitive information theft.

• Weak password management, such as sharing passwords in unsafe ways, increases the risk of breaches.

• 90% of cyber breaches are caused by human error, highlighting the importance of proper security practices.

• Multi-factor authentication (MFA) reduces vulnerability by adding a layer of protection to email platforms and sensitive accounts.

• Implementing a Written Information Security Program (WISP) ensures that firms have documented procedures to protect client data.

• WISP helps enforce security policies, mitigating risks related to human error and unsafe password practices.

• A strong WISP can protect sensitive client data, like banking logins and passwords, from being compromised.

• Regularly updating and training staff on the WISP reinforces awareness of cybersecurity threats and best practices.

Status Assessment Toolkit

Is the Written Information Security Plan (WISP) actively implemented and maintained to protect customer data?

Who is designated as the Data Security Coordinator (DSC), and are they effectively overseeing the WISP?

How regularly are risk assessments conducted, and what measures are taken to address identified vulnerabilities?

Are employees receiving ongoing security training to stay compliant with WISP and protect customer information?

Do all service providers handling customer data follow appropriate security safeguards, and is their compliance regularly monitored?

While IT departments are highly skilled in managing technology infrastructure, they may not always have the cross-departmental oversight required to address PII breach risks that can arise from human error.

Ensure breach tests are conducted regularly to verify the effectiveness of your WISP plan and protect customer data.

There’s no time to wait—gain peace of mind with a complete WISP plan and IT that works with you. At EB DevTech, we’re here to help you enhance efficiency, boost productivity, and make a lasting impact. Connect with us today to explore your options.