Incident response plan: definition for WISP compliance
16 CFR 314.4(h) requires a written incident response plan for non-exempt firms, and 314.6 identifies when that written-plan subpart is exempted. An incident response plan is the written process for detecting, containing, investigating, escalating, and recovering from a security event. Tax and financial firms need fast decision records because IRS, state, insurer, and customer notice duties can overlap.
Key facts
- An incident response plan is the written process for detecting, containing, investigating, escalating, and recovering from a security event.
- Tax and financial firms need fast decision records because IRS, state, insurer, and customer notice duties can overlap.
- The term should be used consistently in the WISP, incident response plan, and access control policy.
Key takeaways
- Definitions are operational: they should help a small firm decide what to do and what evidence to keep.
What does incident response plan mean under the FTC Safeguards Rule?
16 CFR 314.4(h) requires a written incident response plan for non-exempt firms, and 314.6 identifies when that written-plan subpart is exempted. An incident response plan is the written process for detecting, containing, investigating, escalating, and recovering from a security event.
Tax and financial firms need fast decision records because IRS, state, insurer, and customer notice duties can overlap.
Worked example
A collection agency's plan routes a placement-file breach through containment, client notice, forensic preservation, regulator/counsel review, consumer-count analysis, and evidence collection.
The example belongs in the policy packet only if it matches the firm's actual systems, vendors, and evidence records. Otherwise, it should become a remediation or counsel-review note.
What small firms get wrong
Small firms often keep a generic breach checklist without names, decision owners, vendor contacts, state-review triggers, or evidence of when the clock started.
The fix is to tie the term to a concrete record: a system inventory, access list, vendor list, incident log, training record, or dated control screenshot.
| Where it appears | Why it matters | Proof example |
|---|---|---|
| WISP | 16 CFR 314.4(h) requires a written incident response plan for non-exempt firms, and 314.6 identifies when that written-plan subpart is exempted. | Annual review record |
| Access Control Policy | Connects roles to permissions | User access list |
| Incident Response Plan | Guides escalation and notice decisions | Incident log |
FAQ
Is this legal advice?
No. Policywright is a documentation product, not a law firm, and nothing here is legal advice. A qualified lawyer should review state-law reliance or breach-notification decisions.
Does a small firm still need a written plan?
Yes. The Safeguards Rule requires a written information security program for covered financial institutions, and IRS guidance tells paid tax preparers to maintain a written data security plan.
What if a control is not in place yet?
A serious WISP should not pretend. It should identify the gap, assign an owner, set a target date, and preserve a dated remediation record.
Explore this cluster
Sources
- FTC Safeguards Rule, 16 CFR Part 314 (eCFR)
- FTC, Safeguards Rule: What Your Business Needs to Know
- FTC, Safeguards Rule notification requirement now in effect (16 CFR 314.4(j), eff. May 13, 2024)
- IRS Publication 5708, Creating a Written Information Security Plan
- IRS Publication 4557, Safeguarding Taxpayer Data
- IRS Form W-12, PTIN Application and Renewal
- IRS Publication 1345, Handbook for Authorized IRS e-file Providers
Turn definitions into working policies.
Policywright uses clear terms and source-cited clauses across the full policy packet.
See a sample