WISP requirements in Ohio

Do Ohio tax preparers need a WISP?

Yes, if they are covered by the FTC Safeguards Rule or IRS tax-data security expectations, they should maintain a written plan. Ohio state breach-notice duties make incident planning especially important.

The WISP should start with federal obligations because the Safeguards Rule supplies the security-program structure.

Ohio response planning should distinguish discovery, notification from a vendor, material-risk analysis, resident notice, and the 1,000-resident consumer-reporting-agency threshold.

What is specific to Ohio?

Resident notice in the most expedient time possible and no later than 45 days after discovery or notification, subject to law-enforcement delay and scope/restoration needs; consumer-reporting-agency notice without unreasonable delay for more than 1,000 Ohio residents. The plan should identify who evaluates state notice, who contacts counsel, and where the decision record is kept.

State breach-notification law does not replace the Safeguards Rule. It adds a state-specific response layer when an incident affects Ohio residents.

Ohio residents whose personal information was, or reasonably is believed to have been, accessed and acquired by an unauthorized person and whose access and acquisition causes or reasonably is believed will cause a material risk of identity theft or other fraud.

The reviewed general Ohio breach-notification statute does not impose a routine Attorney General filing trigger; the Attorney General may investigate and bring a civil action for alleged noncompliance.

What should the WISP say?

It should describe real safeguards, assign responsibility, map vendors and systems, and include an incident-response path that reaches state-law review quickly.

For a small firm, the strongest plan is plain and evidence-backed: MFA records, backup tests, access reviews, training, vendor lists, and remediation dates.

The plan should never promise a control that is not actually in place.

FAQ