We read the rules so you don’t have to.
Policywright is a small, cybersecurity-trained team. We know a solo preparer or a three-person bookkeeping firm doesn’t have a compliance department — so we did the primary-source reading ourselves and turned it into a short questionnaire that hands you tailored, cited documents. No consultant’s bill, no generic template to decode.
Why we built it.
Under the Gramm–Leach–Bliley Act and the FTC Safeguards Rule, tax preparers, bookkeepers, and small financial firms are required to maintain a Written Information Security Plan, and the IRS says the same for paid preparers. But the real-world options are rough: a free government template you have to interpret and tailor yourself, or a consultant engagement that runs many hundreds of dollars and takes weeks. Most small firms end up with a document that’s either too generic to hold up — or nothing at all. We built the middle path we wished existed: tailored to your firm, grounded in the actual rules, and ready in minutes.
How the documents are built.
Every clause in every document traces to a primary source — the FTC Safeguards Rule (16 CFR Part 314), IRS guidance such as Publications 5708 and 4557, or a real cyber-insurance underwriting requirement. Each obligation is written in plain, eighth-grade language, carries a citation to the rule it comes from, and is paired with a “proof of implementation” line telling you what evidence an examiner or insurer will ask for. Your answers determine which sections and branches appear, so the result reflects your firm rather than a one-size-fits-all form.
Honest about what’s in place.
We think the most dangerous thing a compliance document can do is claim a control exists when it doesn’t. So where a safeguard — MFA, tested backups, training, a vendor review — isn’t yet in place, your plan says so plainly and records a dated remediation step with an owner, instead of an overstated claim. That is exactly what an auditor or carrier wants to see, and it is far safer for your firm.
What Policywright is not.
Policywright is a documentation product, not a law firm. The documents are a configurable template, not legal advice, and buying them does not create an attorney–client relationship. We do not guarantee that any regulator, examiner, or insurer will accept them. Review your plan, confirm it fits your firm, and put the controls it describes actually into place before you rely on it. Policywright is a product of Native Group LLC, Colorado.