Free tool · FTC Safeguards Rule & IRS Pub 4557

CPA & Tax Firm WISP Checklist Calculator

Mark the 10 WISP technical and administrative controls, see your self-rated readiness and open items, then download or email your results.

Start the CalculatorBook a 30-Minute Risk Assessment
Your answers stay in this browser.

Nothing is sent anywhere unless you ask us to email your results, and then only your totals and the titles of open controls are sent. Owners, dates and notes are never sent.

IRS PUB 4557 • FTC SAFEGUARDS • PTIN RENEWAL
$53,088Max FTC Civil Penalty/Violation (2025)
4 MinutesEmry 24/7 MDR Host Isolation SLA
< 24 HoursRecommended KEV Edge Patch Target
100% PTINAudit-Ready Live WISP Evidence

How to use this checklist

  1. 1. Mark a status for each control. Pick In place, Partial, Gap or N/A for each of the 10 controls.
  2. 2. Assign the work. For anything Partial or a Gap, name an owner and a target date.
  3. 3. Note the evidence. Say where the proof lives (policy, screenshot, report, contract), so you can produce it on request. Owners, dates and notes stay in this browser.
  4. 4. Review your results. The results panel counts your answers, works out a self-rated readiness % and lists the open items.
  5. 5. Get a second opinion. Bring the results to a 30-minute risk assessment if you want an outside review.
In place: Implemented today and you can show evidence.Partial: Started, or covers only some users, systems or sites.Gap: Not in place yet.N/A: Does not apply to your firm. Left out of the readiness %.
01. Designated Qualified Individual & Live WISP Binder (16 CFR 314.4(a))

Appoint a named Qualified Individual and maintain a live, system-backed Written Information Security Program updated continuously rather than an annual static Word template.

02. Phishing-Resistant FIDO2 MFA on Tax & Hosting Portals (16 CFR 314.4(c)(5))

Enforce hardware-bound FIDO2/WebAuthn MFA across Microsoft 365, CCH Axcess, UltraTax CS, Lacerte, Drake, QuickBooks Enterprise, SafeSend, and Citrix/RDP remote gateways.

03. Sub-24-Hour Edge Gateway Patching for CISA KEV Flaws (Emry Recommended)

Patch internet-facing VPNs, firewalls, and remote desktop gateways within 24 hours of a CISA Known Exploited Vulnerability (KEV) listing to block 1-day ransomware entry. CISA's KEV deadlines (BOD 26-04, which replaced BOD 22-01) bind federal civilian agencies only; for private firms they are a recommended best practice.

04. 4-Minute 24/7 Human-Led MDR Host & Session Isolation

Replace 4-hour standard MSP ticket queues with 24/7/365 SOC monitoring and automated <4-minute endpoint quarantine and session-token revocation during tax season.

05. FTC 30-Day Breach Notification Readiness (500+ Consumers Rule)

Deploy centralized 365-day SIEM audit logging capable of proving whether unencrypted Taxpayer PII/SSN records were exfiltrated within the mandatory FTC reporting window.

06. Tax-Season Infrastructure Change Freeze (Jan 15 - Apr 15 & Sep 15 - Oct 15)

Lock production CCH/UltraTax/QuickBooks server schemas against disruptive maintenance windows while preserving emergency zero-day security containment.

07. Immutable Object-Locked Backups & 90-Day Verified Test Restores

Maintain air-gapped S3 Object-Locked backups immune to Domain Admin compromise, with timestamped bare-metal restoration certificates generated every 90 days.

08. Former Staff & Seasonal Preparer Zero-Minute Offboarding

Automate immediate credential revocation across tax portals, IRS e-Services, client portals, and M365 OAuth refresh tokens the moment a seasonal preparer departs.

09. Encrypted Taxpayer Data in Transit & At Rest (AES-256 / TLS 1.3)

Enforce BitLocker/FileVault full-disk encryption on all partner laptops and block unencrypted email attachments containing W-2, K-1, or 1040 schedules via automated DLP.

10. Annual Penetration Testing & Continuous Vulnerability Telemetry (16 CFR 314.4(d)(2))

Conduct annual third-party penetration testing plus continuous automated internal/external vulnerability scanning with documented remediation SLAs.

Your results and open items

CPA & Tax Firm WISP Checklist · Generated . Readiness is your own self-assessment, not a compliance determination.

0In place
0Partial
0Gap
0N/A
0Not yet marked
Readiness (self-rated)
–
Gaps and partials with no owner
0

Readiness = controls marked In place ÷ controls you have marked, excluding N/A. Partial counts as not yet in place.

Open items to close (Gaps first, then Partials)

ControlStatusOwnerTarget

Want a second set of eyes on your WISP?

Emry Networks helps CPA firms and tax practices turn a WISP into controls that are actually in place, with evidence for each one. Call (603) 202-3200.

EMRY NETWORKS • DEFENSIBLE IT, 24/7 MDR & LIVE COMPLIANCE ENGINEERING
Jacksonville, FL & Manchester, NH Operations Hubs • Serving Regulated SMBs Across All 50 States • (603) 202-3200 • www.emrynetworks.com/contact-us
Book a 30-Minute Risk Assessment

This checklist is an educational self-check, not legal advice, a certification, or a formal assessment. Confirm requirements against the current regulation, your contracts, and your assessor or counsel.

Rules and documents cited in this checklist

Official sources for the rules, standards and documents named in the controls above. Check them for updates before relying on any requirement.

Related Emry Networks resources
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Get audit ready now

Schedule your compliance readiness assessment with our team today.

Book a 30-Minute Risk AssessmentCall (603) 202-3200