Annual WISP Review: What the Safeguards Rule Requires Each Year
A WISP is not written once. The FTC Safeguards Rule sets requirements that recur, and IRS Publication 5708’s sample plan reviews the security measures at least annually, or whenever a material change in business practices affects the security of records.
Every year
- The written report. Section 314.4(i) requires the Qualified Individual to report in writing, regularly and at least annually, to the board or equivalent body, or to the senior officer responsible where there is no board. The report covers the overall status of the program and the firm’s compliance, and material matters: risk assessment, risk management and control decisions, service provider arrangements, results of testing, security events and management’s responses, and recommended changes.
- Penetration testing. Without effective continuous monitoring, section 314.4(d)(2) requires a penetration test of your information systems every year.
- Training. Publication 5708’s sample plan holds an annual training session for everyone with access to client information, and section 314.4(e) requires training updated as the risks change.
Every six months
Without effective continuous monitoring, section 314.4(d)(2) requires vulnerability assessments at least every six months, and whenever operations or business arrangements change materially.
Whenever things change
- Section 314.4(b)(2) requires periodic risk assessments that reexamine the risks to client information and reassess the safeguards.
- Section 314.4(g) requires you to evaluate and adjust the program after testing and monitoring, after material changes to operations or business arrangements, after each risk assessment, and whenever anything else may materially affect the program.
- Section 314.4(f) requires periodic assessment of service providers, and 314.4(c)(6) periodic review of the data retention policy.
Small firms
Section 314.6 exempts firms with information on fewer than 5,000 consumers from the annual written report and from the testing schedule in 314.4(d)(2). The other recurring duties apply to every firm. The full list is on the Safeguards Rule checklist.
Frequently asked questions
How often must a tax firm review its WISP?
The Safeguards Rule requires a written report on the program at least once a year (for firms with information on 5,000 or more consumers) and periodic risk assessments; IRS Publication 5708's sample plan reviews the security measures at least annually or after a material change.
How often are vulnerability scans required?
Without effective continuous monitoring, at least every six months, plus a penetration test every year, under 16 CFR 314.4(d)(2). Firms with information on fewer than 5,000 consumers are exempt from that paragraph.
Who receives the annual report?
The board of directors or equivalent governing body; where there is none, the senior officer responsible for the information security program.
More on the WISP
- What a WISP is and who must keep one
- The WISP template (Word), built on IRS Publication 5708
- The FTC Safeguards Rule as a checklist
- PTIN renewal: the WISP question on Form W-12