WardstepYour Written Information Security Plan, done in an evening and kept current all year.
The FTC Safeguards Rule requires tax offices to have a written security plan. Wardstep turns 15 plain questions into a finished plan that follows the IRS's own outline, then helps you train staff, keep proof, and know exactly what to do if client data is ever stolen.
How it works
Built for a solo preparer or a small office, not a company with an IT department.
- Answer 15 questionsPlain-English questions about how you sign in, store, send and dispose of client data, with how-to steps for anything you're missing.
- Get your planA finished WISP for your firm in the outline of IRS Publication 5708, ready to print or save as a PDF.
- Keep it current with ProTrain staff, collect proof, review yearly, and follow rule changes, so the plan stays true after day one.
Free: your plan, done
Everything you need to write the plan the FTC requires, free.
Safeguards checklist
15 plain-English questions about how you sign in, store, send and dispose of client data, with how-to steps for anything you're missing.
Your WISP
Generated in the outline of IRS Publication 5708, with wording you can edit, ready to print or save as a PDF.
Inventory and staff
Where client data lives and who can reach it, so your plan's inventory and authorized users are always current.
Wardstep Pro: keep it running all year
For offices that want to show their program is running, not just written down. Try every Pro feature free for 14 days with no card, then subscribe yearly.
Staff training
Send each person a private link from your own email. Five short lessons, quizzes graded on our server, and a signed acknowledgment.
Team logins
Invite up to four co-admins, each with their own login and authenticator app.
Compliance calendar
Every review, drill, training renewal and task in one list, with a calendar file for Google, Outlook or Apple.
Action plan
A readiness score and a task list that turns each gap into an owner and a due date.
Risk assessment
Rate each threat before and after your safeguards, with a heat map. The written risk assessment the Safeguards Rule requires flows into your plan.
Access reviews
Each quarter, confirm who can sign in to each system and record what you removed. Least privilege, kept true over time.
Policy library
Eight ready-to-use policies filled in with your details, acknowledged by staff from their training link.
Vendor oversight
Track the providers that touch client data and record a review of each at least yearly. The Safeguards Rule requires periodic oversight of service providers.
Evidence folder
Screenshots and documents that prove each safeguard is in place, private to your firm.
Disposal log
Record when files are shredded and drives are wiped, by whom and how, as proof of secure disposal.
Yearly review
A guided review checklist, staff sign-offs, and rule updates when the requirements change.
Signed plan versions
Each sign-off saves a copy of your plan that can't be changed, so you can show what was in place and when.
Security drills
Guided breach tabletops, phone pretext calls, lost-device drills and office walkthroughs, with a record of each.
Scans and tests
Track vulnerability scans and penetration tests, their findings and fixes, with reminders when they're due.
Breach kit and playbooks
Step-by-step response for ransomware, lost devices, hacked email and fake payment requests, plus IRS and FTC notice steps and a client letter.
Reports
A yearly security report for the owner and a client security statement that mentions only the safeguards you actually have.
Built like a security product should be
You're trusting us with your firm's security plan. We hold ourselves to the standard we help you meet.
- Every account uses multi-factor sign-in. No exceptions.
- Each firm's data is walled off in the database itself, not just in the app.
- We never ask for or store client tax data: no names, Social Security numbers or returns.
- No ads, no trackers and no third-party scripts on our site or app.
Get your plan done this week
Wardstep is new, and we work closely with our first tax offices. Tell us what would make it better.