Hand-drawn security objects frame the title

Written Information Security Program: What to Put in One

October 28, 2026

A written information security program, often called a WISP, is a document that states how your business protects the sensitive data it holds: who is responsible, what risks you have found, which safeguards you use, and what happens when something goes wrong. Some businesses must have one by law. Every business that stores customer, patient or client data should.

If you run a small firm, here is the uncomfortable truth. A breach rarely asks whether you were ready. It asks whether you can show what you did, and when. A WISP is how you show it.

tekrescue

mytekrescue.com

Strengthen Your Business Security

tekRESCUE provides cybersecurity and managed IT services, with expertise in compliance and security for businesses handling sensitive data.

Explore security services

Table of Contents

TL;DR

A WISP is a written plan of administrative, technical and physical safeguards for the personal information you keep.
Tax preparers, mortgage brokers and other financial institutions must have one under the FTC Safeguards Rule. Healthcare entities face a parallel duty under HIPAA.
The core is a written risk assessment, a named qualified individual, access controls, multi-factor authentication, encryption, vendor oversight and an incident response plan.
A shelf document protects no one. Test it, train staff on it and update it when your systems change.

What a written information security program is
Who is required to have one
What to include in your WISP
How to build and keep a WISP current
Perspective: the document is the easy part
Get help building one that matches how you work
FAQ
Sources

What a written information security program is

The IRS describes a WISP for tax practices as a written plan setting out administrative, technical and physical safeguards to protect the personal information a firm retains, guard against anticipated threats and prevent unauthorized access or use that could lead to identity theft or fraud.

Those three safeguard types are worth separating:

Administrative: policies, assigned roles, training, vendor reviews, the incident response plan.
Technical: passwords, multi-factor authentication, encryption, firewalls, patching, backups, logging.
Physical: locked file rooms, screen privacy, device disposal, visitor control.

The word “program” matters. A WISP is not a one-time memo. It is the written record of an ongoing process: assess, protect, train, test, fix, repeat.

Who is required to have one

No single federal law covers every business. The duty depends on what you do and what data you hold.

Financial institutions under the FTC Safeguards Rule

The FTC says businesses covered by the Safeguards Rule, including tax preparation firms, mortgage brokers and payday lenders, must maintain a written information security program. The rule implements the Gramm-Leach-Bliley Act, and the program must be appropriate to the size and complexity of the firm.

For tax preparers this is not optional guidance. The IRS treats a WISP as a legal requirement for the profession and publishes a template in Publication 5708. If you run a CPA or tax practice, our walkthrough on whether your CPA firm is FTC Safeguards compliant covers the practical gaps we see most.

Healthcare and HIPAA

HIPAA does not use the word WISP, but the substance overlaps. The Security Rule requires covered entities and business associates to conduct an accurate and thorough risk analysis of risks to electronic protected health information. HHS also says it does not prescribe one methodology, since the right approach depends on the organization’s size, complexity and capabilities.

Enforcement shows what regulators look for. HHS Office for Civil Rights settlements with small providers have stressed written policies and procedures, risk analyses and risk management plans. A practice with a clinic full of patient records and no written analysis is exposed. See our HIPAA compliance overview for how this maps to day-to-day IT.

State laws

Some states name the document outright. Massachusetts is the best-known example: its 201 CMR 17.00 checklist asks whether a business handling Massachusetts residents’ personal information has a comprehensive, written information security program. That reaches out-of-state businesses that hold those residents’ data.

Texas takes a general approach. Section 521.052 of the Business and Commerce Code says a business shall implement and maintain reasonable procedures to protect sensitive personal information it collects or maintains. The statute does not dictate a document, but a written program is the clearest way to show your procedures are reasonable. Our guide to the Texas data breach law explains what happens after something goes wrong.

State laws — overview diagram

Professional duties

Lawyers face duty-of-competence rules too. The State Bar of California’s data breach opinion says lawyers must make reasonable efforts to understand technology risks and put security measures in place, and that managers should set policies and procedures and monitor technology and outside vendors. The opinion describes reasonable security as a fact-specific process of assessing risk and acting on it, not a checklist of tools. That is also a good description of a WISP.

What to include in your WISP

There is no universal template, but the FTC’s Safeguards Rule gives a strong spine. It is the clearest published list of what a regulator expects, and it is a sound baseline even if you are not a financial institution.

1. A designated qualified individual

Name one person accountable for the program. In a small firm that may be an owner or office manager supported by an outside IT provider. Write the name and role into the document, plus who steps in when that person is out.

2. A written risk assessment

List the systems and places where sensitive data lives, what could go wrong with each, and how likely and damaging it would be. Under the FTC rule this assessment must be written. It drives everything else, so do it first. Our cybersecurity risk assessment checklist lays out eight steps.

A practical starting point is a data inventory:

What you hold	Where it lives	Who can reach it
Client Social Security numbers	Tax software, scanned folders	Preparers, admin staff
Patient records	EHR system, email attachments	Clinical and billing staff
Payment details	Processor portal	Owner, bookkeeper
Employee files	HR folder, payroll vendor	Owner, HR

If you cannot fill in the third column honestly, you have found your first risk.

3. Access controls and multi-factor authentication

The FTC lists access controls and multi-factor authentication among its requirements. Write who gets access to what, how access is granted and removed when people change roles or leave, and where MFA is required. We cover the priorities in MFA for small businesses.

4. Encryption and data handling

The rule calls for encrypting customer data. Document what is encrypted at rest and in transit, how laptops and phones are protected, how long you keep records and how you dispose of them. HHS makes the same point for ePHI, recommending encryption at rest and in transit where appropriate, along with audit controls and user authentication. Backups belong here too, and our piece on encrypting data and backups under a managed IT plan goes deeper.

5. Technical safeguards in practice

Firewalls, patching, endpoint protection, logging and secure remote access belong in the document as commitments you can verify. Include the human layer. Attackers often call your staff, pose as a client or a vendor and ask for a reset or a record. A short procedure for identity verification by phone that staff must follow before releasing information closes a gap that firewalls never will. If your team works from home, add rules for personal devices and home networks; see our policies for remote employees.

6. Service provider management

Your cloud vendors, IT provider, payroll company and software hosts all touch your data. The FTC rule requires you to manage service providers. Record who they are, what data they see, what security you expect from them and when you last reviewed that.

7. Training

Staff are the most common way in. Write down when new hires are trained, how often refreshers happen and how you handle phishing reports. Keep attendance records.

8. An incident response plan

The FTC requires a written incident response plan. Cover who decides a breach has occurred, who isolates systems, who calls legal counsel and insurers, and who notifies clients and regulators. As of May 2024, financial institutions must tell the FTC no later than 30 days after discovering a breach involving unencrypted information of at least 500 consumers. Put the notification steps in the plan before you need them, and know your state’s separate deadlines. Our incident response service exists for the day this plan gets used.

9. Testing, monitoring and reporting

The rule expects you to regularly test safeguards and report to your board or senior management. For a small firm, that means a written note to the owners at least once a year covering what you tested, what failed and what you fixed.

How to build and keep a WISP current

The FTC’s own sequence is a good order of work: write a risk assessment, design and implement safeguards, train staff, monitor and test, keep the program current, and document security events and your response.

Appoint the qualified individual. Do this before anything else so someone owns the project.
Inventory your data and systems. Use the table above.
Assess risk in writing. Rank findings by likelihood and impact.
Draft the safeguards. Map each high risk to a control, an owner and a date.
Train everyone. Have staff sign that they read the program.
Test. Restore a backup. Run a phishing exercise. Review who has access.
Review on a schedule and after changes. A new software platform, a new office, a vendor switch or a breach all justify an update.

Scale it to your size

The IRS Security Summit stresses that data security is not one-size-fits-all and should match a firm’s size, activities and the sensitivity of its data. A five-person office does not need a 90-page binder. It needs an accurate document that describes what it actually does.

That is the trap with free templates. A template filled in with controls you do not run is worse than no document, because it records promises you did not keep. Write only what is true, then close the gaps.

Use a framework as a backbone

NIST’s Cybersecurity Framework 2.0 is voluntary guidance that helps organizations of any size, sector or maturity understand, assess, prioritize and communicate their cybersecurity efforts. Its small business quick-start guide is a sensible way to organize a WISP if no rule dictates the structure. Our list of five cybersecurity controls every small business needs is a short place to begin.

Keep the evidence

When a regulator, insurer or client asks, they want proof. Keep:

The current WISP with version dates and who approved it.
Each written risk assessment.
Training rosters.
Access review records and MFA coverage.
Vendor reviews.
Test results, including backup restores.
Incident logs and the response taken.
Reports to owners or management.

Perspective: the document is the easy part

We write and review these programs for small businesses, and the pattern repeats. Owners treat the WISP as paperwork to finish, then discover the real work is in the systems it describes. The weak link is almost never the template. It is the infrastructure underneath: unpatched machines, shared logins, no MFA on email, backups nobody has restored.

Perspective: the document is the easy part — overview diagram

Threats are also moving faster than annual review cycles. Attackers now use automation to probe small networks around the clock, and a program reviewed once a year can be stale within months. So we tell clients to tie the WISP to change events, not the calendar alone. New tool, new vendor, new hire with admin rights: update the document the same week.

If you are a CPA firm or healthcare practice, assume you will be asked to produce this document. Build it so you would be comfortable handing it over.

— Randy Bryan

Get help building one that matches how you work

A WISP is only as good as the technology behind it. tekRESCUE supports small and mid-sized businesses in Austin, San Marcos, Kyle and nearby Central Texas communities with cybersecurity and risk assessment services, HIPAA and FTC Safeguards compliance, and managed IT to keep controls running after the paperwork is signed. If you want a second set of eyes on a draft, or a risk assessment to start from, talk to our team.

FAQ

Is a WISP the same as a written information security plan?

Yes. Plan, program and policy are used interchangeably, and the acronym WISP covers all of them. The FTC rule uses the term program, while the IRS template uses plan. What matters is that it is written, specific to your business and actually followed.

Does my small business legally need a WISP?

It depends on your industry and the data you hold. Tax preparers and other financial institutions must have one under the FTC Safeguards Rule, and states such as Massachusetts require one for businesses handling their residents’ data. In Texas the statute requires reasonable procedures, and a written program is the strongest way to demonstrate them.

What is the difference between a WISP and HIPAA documentation?

A WISP is a general program for protecting personal information. HIPAA requires covered entities and business associates to analyze risks to ePHI and maintain written policies and procedures. A healthcare practice can fold both into one program, as long as the HIPAA risk analysis and required policies are complete.

How often should a WISP be updated?

Review it on a regular schedule, at least yearly, and again whenever your systems, vendors, staff roles or risks change. The FTC’s process includes keeping the program current and testing safeguards regularly. Record each review with a date.

Can I use a free template?

Yes, as a starting structure. The IRS publishes one in Publication 5708 for tax professionals. Fill it in with what you really do, remove controls you do not run, and assign dates to the gaps.