The documents are the easy part.
A consultant-drafted WISP runs $749 to $999 for one document, and then sits in a folder going stale. Policywright gives you all four cited policies plus the thing nobody sells you: a dated record that you actually did what they say, for $149 a year. The documents on their own are $299 once.
Compliance Year
$149 / year
All four documents, plus a dashboard that tracks the eight duties the Safeguards Rule puts on you year after year: who your Qualified Individual is, when you last reviewed access, whether MFA is still on, who you trained, which service providers you assessed. Record each one as you do it and pull an evidence binder whenever you need it.
We watch 16 CFR Part 314 for changes and re-issue your documents when the rule or your firm changes. Cancel any time; the documents and your records stay yours.
14-day refund, no questions asked. If it isn’t what you needed, email us within 14 days and we’ll refund you in full. See Terms for how the license works.
Policy Pack
$299, one time
The same four documents: WISP, Incident Response Plan, Acceptable Use Policy, and Access Control Policy, each cited to 16 CFR Part 314 and IRS guidance, delivered as PDF and DOCX. No dashboard, no duty tracking, no evidence binder, no updates when the rule changes.
Pay once. The documents are yours to keep.
To be straight with you about the arithmetic: this costs twice as much as Compliance Year in year one, and works out cheaper from year three onward. If you want a document to file and nothing else, this is the honest choice. If you want to be able to show what you did, it is the wrong one.
When you want a person, not a page.
Two tiers above, for firms that would rather hand this to someone. Both are run by one person, so both say plainly what they do and do not include.
Compliance Year + Desk
$590 / year
Everything in Compliance Year, plus a direct line. Text or email a real person about anything inside 16 CFR Part 314, your documents, or your dashboard. First reply within one business day.
- Coverage questions and whether a duty applies to you
- Judgement calls: does our password manager satisfy the MFA duty, is our bookkeeper a service provider
- What an evidence record should say so it holds up
- What to do first when something goes wrong, and the 30-day clock in 314.5
What it is not. Not IT support, not tax advice, not legal advice, and not incident response. Twelve questions a year, one business day to first reply, business days only. Scheduled unavailable weeks are published in advance.
Managed
$1,900 / year
Policywright becomes your Qualified Individual. 16 CFR 314.4(a) allows this in as many words: the Qualified Individual may be employed by you, an affiliate, or a service provider. We run the year; you direct and oversee us, which the rule requires you to do.
- Kickoff call, documents, vendor register and access list built with you
- Month 3: access review, run and recorded. 314.4(c)(1)
- Month 6: service provider assessment. 314.4(f)
- Month 9: training delivered and logged. 314.4(e)
- Month 11: risk assessment, MFA check, retention review, evaluate and adjust, binder delivered
- Desk access throughout, same terms as above
Ten engagements a year. That is the whole capacity and it is not a marketing device. Managed takes five to six hours per firm per year and one person has a finite calendar. An eleventh would mean failing one of the ten.
It is not insurance, not a guarantee any regulator accepts your program, not IT or monitoring, and not incident response. You keep responsibility for compliance; that is the rule’s requirement, not our disclaimer.
Which of the four do you actually have to have?
One of them. If your firm keeps information on fewer than 5,000 consumers, which covers almost every solo preparer and small lot, 16 CFR 314.6 lifts four duties off you, including 314.4(h), the written incident response plan. The WISP is a different story: 16 CFR 314.3(a) requires a written program at any size, with no exemption.
So the honest version of this page is that you are buying one required document and three that are strongly advisable. Insurers ask for them, the exemption disappears the moment you cross 5,000 consumers, and an incident response plan is worth very little if you start writing it after the incident. We would rather tell you that before you pay than have you find out afterwards.