WISP template: what your written information security plan must include

Who needs one

“develop, implement, and maintain a comprehensive information security program”

Every financial institution under the FTC's jurisdiction: tax preparers, auto dealers that arrange financing or lease, non-bank mortgage brokers and lenders, and the other businesses the rule names. The program has to be written down and fit your size, the complexity of what you do, and the sensitivity of the customer information you keep.

The ten parts a complete WISP covers

• (a) Your Qualified Individual: the one person who oversees, implements and enforces the program.
• (b) A risk assessment of what could go wrong with customer information, redone periodically.
• (c) The safeguards themselves: access controls, a data and systems inventory, encryption, secure development, multi-factor authentication, secure disposal, change management and activity monitoring.
• (d) Regular testing or monitoring that the safeguards work.
• (e) Training for everyone, and qualified people to run security.
• (f) Oversight of service providers: choose capable ones, require safeguards by contract, check on them.
• (g) Updating the program when your business, systems or test results change.
• (h) A written incident response plan.
• (i) A yearly written report from the Qualified Individual to your board or owner.
• (j) How you'll notify the FTC of a notification event within 30 days.

If you have fewer than 5,000 consumers

“Section 314.4(b)(1), (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers.”

Four of those items don't apply: the written risk assessment, continuous monitoring or annual penetration testing with twice-yearly scans, the written incident response plan, and the annual report. Your WISP still needs everything else. Many small offices keep the four anyway, because they're short and an examiner or insurer will ask.

Templates: the IRS sample and a faster route

Tax professionals can start from the IRS's sample plan, Publication 5708. It follows the same structure but leaves you with pages of blanks. Golden Rock's free WISP Builder asks plain-English questions instead and fills the plan in from your answers, with a list of gaps to fix. Nothing you type leaves your browser.

Keeping it current

A WISP isn't one-and-done. Training, vendor reviews, access reviews and the risk assessment come back every year or sooner, and the plan should change when your systems do. That is what Safeguards Tracker is for: every item on a schedule, a place for your proof, and a printable WISP draft built from your records.