Service provider: definition for WISP compliance
16 CFR 314.2(l) defines service provider, and 314.4(f) requires covered firms to oversee providers that can access customer information. A service provider is a person or company that receives, maintains, processes, or otherwise can access customer information through services provided to the firm. This is narrower than the everyday business sense of the phrase. Under the Safeguards Rule the test is access to your customer information, not whether a company provides you a service: your landlord and your accountant's cleaner are service providers in plain English and are not service providers here. Cloud tax software, client portals, email platforms, payroll tools, and IT providers should be inventoried and reviewed.
Key facts
- A service provider is a person or company that receives, maintains, processes, or otherwise can access customer information through services provided to the firm.
- Cloud tax software, client portals, email platforms, payroll tools, and IT providers should be inventoried and reviewed.
- The term should be used consistently in the WISP, incident response plan, and access control policy.
Key takeaways
- Definitions are operational: they should help a small firm decide what to do and what evidence to keep.
What does service provider mean under the FTC Safeguards Rule?
16 CFR 314.2(l) defines service provider, and 314.4(f) requires covered firms to oversee providers that can access customer information. A service provider is a person or company that receives, maintains, processes, or otherwise can access customer information through services provided to the firm.
This is narrower than the everyday business sense of the phrase. Under the Safeguards Rule the test is access to your customer information, not whether a company provides you a service: your landlord and your accountant's cleaner are service providers in plain English and are not service providers here.
Cloud tax software, client portals, email platforms, payroll tools, and IT providers should be inventoried and reviewed.
Worked example
A tax preparer's vendor list includes tax software, client portal, cloud backup, email, e-signature, IT support, shredding, and offsite storage with contract-review notes.
The example belongs in the policy packet only if it matches the firm's actual systems, vendors, and evidence records. Otherwise, it should become a remediation or counsel-review note.
What small firms get wrong
Small firms often review the obvious software vendor but miss an MSP, copier lease, cloud backup account, payment processor, or document-destruction company.
The fix is to tie the term to a concrete record: a system inventory, access list, vendor list, incident log, training record, or dated control screenshot.
| Where it appears | Why it matters | Proof example |
|---|---|---|
| WISP | 16 CFR 314.2(l) defines service provider, and 314.4(f) requires covered firms to oversee providers that can access customer information. | Annual review record |
| Access Control Policy | Connects roles to permissions | User access list |
| Incident Response Plan | Guides escalation and notice decisions | Incident log |
FAQ
Is this legal advice?
No. Policywright is a documentation product, not a law firm, and nothing here is legal advice. A qualified lawyer should review state-law reliance or breach-notification decisions.
Does a small firm still need a written plan?
Yes. The Safeguards Rule requires a written information security program for covered financial institutions, and IRS guidance tells paid tax preparers to maintain a written data security plan.
What if a control is not in place yet?
A serious WISP should not pretend. It should identify the gap, assign an owner, set a target date, and preserve a dated remediation record.
Explore this cluster
Sources
- FTC Safeguards Rule, 16 CFR Part 314 (eCFR)
- FTC, Safeguards Rule: What Your Business Needs to Know
- FTC, Safeguards Rule notification requirement now in effect (16 CFR 314.4(j), eff. May 13, 2024)
- IRS Publication 5708, Creating a Written Information Security Plan
- IRS Publication 4557, Safeguarding Taxpayer Data
- IRS Form W-12, PTIN Application and Renewal
- IRS Publication 1345, Handbook for Authorized IRS e-file Providers
Turn definitions into working policies.
Policywright uses clear terms and source-cited clauses across the full policy packet.
See a sample