The Safeguards Rule requires tax preparation firms to keep a written information security program. Most firms built theirs from the IRS template. That template has not been revised since August 2024, so it says nothing about AI tools, which is now one of the main ways client data leaves the office. We wrote the part that is missing, and the rest of the plan around it.
Not our interpretation. The FTC's own guidance for businesses, which names tax preparation firms as covered financial institutions. ftc.gov
A covered firm must develop, implement and maintain a written information security program. Among the elements the rule names:
Three of those six are documents that must physically exist. If someone asked your firm for its written risk assessment this afternoon, could you produce it?
Nine documents, about 12,600 words. Editable Word files and PDFs. Instant download.
| No. | Document | What it does |
|---|---|---|
| 00 | Start Here | What to work through, in what order, and what you must customise |
| 01 | WISP Core | The written plan itself, structured to the elements above |
| 02 | AI Use Policy | Approved and prohibited tools, an absolute bar on client data in consumer AI tools, vendor review criteria, training opt-out requirements, human review obligations, staff attestation |
| 03 | Risk Assessment Workbook | The written risk assessment, with worked examples |
| 04 | Incident Response Plan | Detection through recovery, including IRS Stakeholder Liaison breach reporting and an incident log |
| 05 | Qualified Individual Designation | The designation letter and the duties that come with it |
| 06 | Staff Training Acknowledgement | One page, signed, covering security basics and the AI policy |
| 07 | Implementation Checklist | Downloaded to documented, with honest time estimates per step |
| 08 | AI Tool Approval Request Form | What a staff member fills in before using a new AI tool, routed to the Qualified Individual |
The AI Tool Approval Request Form is one page and useful entirely on its own. If your firm adopts nothing else from us, adopt this: it is the difference between an AI policy that gets read once and one that actually governs what staff do. Look at the quality, then decide about the rest.
If nobody at your firm has used an AI tool on anything touching client information, IRS Publication 5708 is a reasonable starting point and you should keep your money. We are not going to pretend otherwise to make a sale.
There is also a well-made WISP pack on the market at around $59. If a WISP is genuinely all you need, buy that one. We are four times that price for exactly one reason: the two AI documents, which as far as we can find nobody else sells at any price. That is the whole argument, and if it does not apply to your firm then neither do we.
Limited to three of these a week, because the calls are done by a person and we would rather say no than run late.
Firms with three or more offices: $599 for a multi-office licence. Same documents, broader use rights.
November to January is when firms do compliance housekeeping. Doing it now beats doing it in filing season, which is the only honest piece of urgency here.
Get the pack — $24930-day refund, no questions and no form.
One firm, one licence, yours to adapt however you need.
No, and anyone telling you a document pack does is selling you something. Compliance means having the written program, actually following it, and keeping evidence that you did.
This gives you the written program and a checklist for following it. The following is yours. We would rather say that plainly up front than have you discover it later.
Yes. It is roughly eight hours of their time at their rate, plus the reading to know what the rule requires. That is the entire value proposition and we are comfortable saying so. If eight of their hours cost less than $249, write it yourself.
No. These are templates for your firm to adapt to its own circumstances, and that disclaimer appears in all nine documents, not just in the footer. We are not a law firm and we are not your counsel. If your situation is unusual, have a lawyer read it.
A small independent team. Every document is original prose written against the published rule text, not copied from the IRS template or from any vendor.
We are new and we have no client list to show you. That is exactly why document 08 is free with no email required: look at the actual work and judge from that rather than from anything we claim about ourselves.
30 days, full refund, no questions and no form to fill in. Email and we send the money back.