See exactly what you get. All four documents.
Everything below came out of the actual generator, for an example firm: a one-person tax practice holding information on fewer than 5,000 consumers, with MFA still being rolled out. Nothing here is mocked up. Note the plain language, the citation under every provision, and the “proof of implementation” line that tells you which evidence an examiner or an insurer will ask to see.
Example firm: Mesa Tax Prep LLC. Not a real client. Your packet uses your firm’s name and your answers throughout.
1 of 4 · Written Information Security Plan
The one document the Safeguards Rule requires of every covered firm at any size. It opens by determining, in writing, why the rule reaches this firm at all.
Section 0. Authority, Coverage, and Scope Determination
Basis of coverage. The Safeguards Rule applies to institutions under Federal Trade Commission jurisdiction that are significantly engaged in activities that are financial in nature or incidental thereto. Coverage turns on what the Firm does, not on what it calls itself.
The Firm is a professional tax-return preparation practice. Tax preparation services are expressly identified as an example of a financial institution at 16 CFR 314.2(h)(2)(viii). The Firm is therefore a covered financial institution to which this Part applies.
Consumer-count basis. The Firm has determined, as of July 27, 2026, that it maintains information concerning fewer than 5,000 consumers.
When to re-count. Because the small-institution exceptions depend on what the Firm actually maintains, the Firm shall re-count at adoption, at least annually, and — once the count reaches 4,500 or more — at least quarterly and after any acquisition, data migration, client import, or material growth, before continuing to rely on any exception under 16 CFR 314.6.
Ref: 16 CFR 314.1; 16 CFR 314.2; 16 CFR 314.6
Proof of Implementation: the recorded consumer count, the counting method, and the date; and dated re-count records.
Section 3. Access Controls (including Multi-Factor Authentication)
Multi-factor authentication. The Firm shall implement multi-factor authentication for any individual accessing any Information System, unless the Qualified Individual has approved, in writing, the use of reasonably equivalent or more secure access controls.
Ref: 16 CFR 314.4(c)(1), (c)(5)
Proof of Implementation: access-control policy; user/role list export; dated access-review record; MFA-enabled screenshot from each admin console, or the Qualified Individual’s written approval of equivalent controls.
Control Status Summary
This summary reflects the answers the Firm provided. “In place” means the Firm reported the control as active; it is not independent verification. Before representing any control to a regulator, examiner, or insurer, confirm its actual status and record the evidence, owner, and date. Where a control is in remediation, assign an owner, a target date, an interim safeguard, and a verification date…
The full WISP for this example firm runs 491 lines across fourteen sections plus a tax-professional addendum and an IRS focus-area crosswalk.
2 of 4 · Incident Response Plan
Worth knowing before you buy: 16 CFR 314.6 exempts firms under 5,000 consumers from 314.4(h), so this document is not legally required of most of our buyers. It is included because insurers ask for it and because the exemption ends the moment you grow.
Section 2. Definitions and Severity Classification
Security Event — an event resulting in unauthorized access to, or disruption or misuse of, an Information System or the Customer Information stored thereon.
Incident — a Security Event that the Qualified Individual has confirmed requires a coordinated response under this Plan.
The Firm classifies Incidents by severity to drive proportionate response and escalation:
Low — limited scope, no confirmed exposure of Customer Information, no notification triggered. Moderate — possible exposure; investigation and containment required. High — confirmed exposure of Customer Information, or material disruption of an Information System. Critical — confirmed exposure affecting a large number of consumers, or loss of the Firm’s ability to operate; triggers full notification analysis.
Ref: 16 CFR 314.4(h); 16 CFR 314.2(m)
Proof of Implementation: severity classification recorded in the incident record or response log.
Section 5 sets out the communications and notification chain, including the FTC notification analysis for a security event involving the unencrypted information of 500 or more consumers, and the state notification path for the states you operate in…
3 of 4 · Acceptable Use Policy
The document your staff actually sign. It adapts to what you told us: this example firm reported MFA as still being rolled out, so the policy states an interim requirement rather than claiming a control the firm does not yet have.
Section 3. Accounts, Passwords, and Multi-Factor Authentication
Each Authorized User shall use unique credentials assigned to that user. Shared accounts are prohibited except where technically unavoidable and approved in writing by the Qualified Individual.
Immediate acceptable-use requirement. Until MFA is fully deployed or equivalent stronger controls are approved in writing by the Qualified Individual, users shall exercise heightened caution, including using unique passwords, reporting suspicious login prompts, and prioritizing MFA setup for email, tax and accounting software, cloud storage, remote access, and administrative accounts.
Ref: 16 CFR 314.4(c)(5)
Proof of Implementation: MFA screenshots or admin-console exports; the Qualified Individual’s written approval for any equivalent or stronger control.
Thirteen sections in total, plus Addendum A on taxpayer information handling, ending with a signed acknowledgment page for each user…
4 of 4 · Access Control Policy
Written for the firm you described. A one-person practice does not get boilerplate about offboarding employees it does not have.
Section 5. Access Review and Termination
Although the owner is the Firm’s only human user, the Firm shall still review, at least semiannually, all non-employee access to Customer Information — including cloud and tax-software vendor accounts, support and remote-access accounts, administrator and service accounts, API keys, and account-recovery email addresses and phone numbers — and shall promptly remove any access that is no longer needed. If the Firm later adds personnel or contractors, it shall additionally institute prompt revocation of access upon role change or separation.
Ref: 16 CFR 314.4(c)(1)
Proof of Implementation: dated access-review records.
Six sections covering least privilege, authentication, remote access, access review, and physical access, each cited the same way…
$299 one-time. 14-day refund, no questions asked.
What’s in the full packet.
Written Information Security Plan (WISP)
Your firm's core security program, scaled to your size.
- Every section cited to 16 CFR Part 314
- Control-status summary: in place vs. in remediation
- Proof-of-implementation checklist
- IRS focus-area crosswalk for tax firms
Incident Response Plan
What to do, and who to call, in the first hour of a breach.
- Severity levels and response deadlines
- FTC, IRS, and state notification chain
- Ransomware, wire-fraud, and lost-device playbooks
- Fill-in emergency contacts table
Acceptable Use Policy
Day-to-day handling rules your staff can actually follow.
- Email, device, and remote-work rules
- Approved apps and generative-AI restrictions
- Paper handling and secure disposal
- A signed acknowledgment for each user
Access Control Policy
Who can reach client data, and on what terms.
- Least-privilege and multi-factor authentication
- Access reviews and prompt offboarding
- Shared- and service-account controls
- Physical access safeguards