Your written security plan, in about 15 minutes.

The FTC Safeguards Rule requires a written information security plan (a “WISP”). The IRS publishes a 28-page sample with blanks to fill in. Answer plain-English questions instead and get your plan filled in, with a to-do list for any gaps. Free, no signup, and your answers stay in your browser.

Start my plan Rather have it done for you?

1Your firm
2Who’s responsible
3Where data lives
4Safeguards today
5Vendors & contacts
6Your plan

Step 4 of 5Safeguards today

Be honest: the plan is only useful if it’s true. Anything not “Yes” becomes a to-do with the fix.

	Yes	Partly	No	Not sure
Multi-factor sign-in on everyone’s email	Yes	Partly	No	Not sure
Multi-factor sign-in on your main software, client portals and any remote access	Yes	Partly	No	Not sure
Every laptop and desktop is encrypted (BitLocker or FileVault)	Yes	Partly	No	Not sure
Everyone has their own login: no shared accounts or passwords	Yes	Partly	No	Not sure
Work passwords are kept in a password manager	Yes	Partly	No	Not sure
Automatic updates on every computer, the router and the firewall	Yes	Partly	No	Not sure
Antivirus or endpoint protection on every computer	Yes	Partly	No	Not sure
A separate guest Wi-Fi, and default passwords changed on the router and printers	Yes	Partly	No	Not sure
Automatic backups, with a test restore in the last 12 months	Yes	Partly	No	Not sure
Client files go through a portal or encrypted email, never plain email	Yes	Partly	No	Not sure
Access is removed the same day someone leaves	Yes	Partly	No	Not sure
Everyone had security-awareness training in the last 12 months	Yes	Partly	No	Not sure
Vendors who touch client data are required by contract to protect it	Yes	Partly	No	Not sure
Sign-in alerts or monitoring are on (yours or your IT provider’s)	Yes	Partly	No	Not sure
Old records are shredded or securely wiped on a schedule	Yes	Partly	No	Not sure
A written plan for what to do if client data is stolen	Yes	Partly	No	Not sure

Your password rule

Change when there’s any sign of compromise (current NIST guidance, with MFA)Change every 365 days (the IRS sample plan’s wording)

Your answers are saved only in this browser, so you can come back later.

What you get

A real plan, not a pile of blanks.

Built on the structure of the IRS sample plan (Publication 5708) and the nine elements of the FTC Safeguards Rule (16 CFR 314.4).

Objective, scope and the people responsible, including your Qualified Individual
A written risk assessment from your own answers
Your systems and data inventory
Safeguards policies: access, multi-factor sign-in, encryption, passwords, Wi-Fi, remote access, disposal
Vendor oversight, training and the annual review
An incident response plan with the right notifications (FTC, IRS Stakeholder Liaison, your state)
Attachments: retention policy, rules of behavior, breach checklist, staff sign-off, hardware and access lists
A to-do list for every gap, with the fix

This tool creates a starting document from your answers. It is general information, not legal advice, and doesn’t make a business compliant by itself: you need to make it accurate, put the safeguards in place and review it at least yearly. Nothing you type is sent anywhere unless you choose to request a review.

Your written security plan, in about 15 minutes.

We’ll tailor it, fix the gaps and stay on as your security lead.

Got it.

A real plan, not a pile of blanks.