How do I handle a lost laptop in a WISP and incident plan? solo practitioners
A lost laptop or device is a distinct scenario because the compliance answer depends on facts the firm can prove quickly: whether client data was on the device, whether encryption was active, whether remote wipe or endpoint logging exists, whether credentials were saved, and whether the event triggers federal, state, client, insurer, or IRS escalation. For solo practitioners, the page is indexable only because the scenario changes actual WISP obligations: The plan should name the qualified individual, document current safeguards, note gaps honestly, and create a maintainable annual review rhythm. The controlling citations are 16 CFR 314.4(c)(3), 314.4(c)(8), 314.4(h), and 314.4(j), with IRS guidance added where tax return data or e-file operations are involved.
Key facts
- Lost laptop or device should be written into the WISP because it changes systems, users, vendors, or incident evidence for solo practitioners.
- The primary citation path is 16 CFR 314.4(c)(3), 314.4(c)(8), 314.4(h), and 314.4(j); do not rely on a generic policy sentence without proof.
- The firm should preserve device inventory record, disk-encryption proof, remote-wipe or lock record, and any gap remediation dates.
Key takeaways
- Lost laptop or device should be written into the WISP because it changes systems, users, vendors, or incident evidence for solo practitioners.
- The primary citation path is 16 CFR 314.4(c)(3), 314.4(c)(8), 314.4(h), and 314.4(j); do not rely on a generic policy sentence without proof.
- The firm should preserve device inventory record, disk-encryption proof, remote-wipe or lock record, and any gap remediation dates.
- If facts are uncertain, keep the page's guidance as an escalation checklist and route legal notice decisions through qualified counsel.
Why lost laptop or device is different for solo practitioners
Lost laptop or device changes the WISP because solo firms still need a written plan, but the safeguards should be scaled to a small practice rather than copied from an enterprise manual. The firm needs controls that match the actual workflow, not just a sentence saying staff must be careful.
A lost laptop or device is a distinct scenario because the compliance answer depends on facts the firm can prove quickly: whether client data was on the device, whether encryption was active, whether remote wipe or endpoint logging exists, whether credentials were saved, and whether the event triggers federal, state, client, insurer, or IRS escalation. This is why Policywright treats the scenario as a distinct page instead of reusing the ordinary wisp for solo tax practitioners template.
The WISP should identify who owns the workflow, what customer information passes through it, which systems or vendors are involved, and which safeguards satisfy 16 CFR 314.4(c)(3), 314.4(c)(8), 314.4(h), and 314.4(j). Those facts are what keep the page from being thin and what keep the policy useful after the first draft.
What the WISP should say
The WISP should add a scenario-specific control block for lost laptop or device: scope, system inventory, access rules, evidence records, exception handling, and incident escalation.
For solo practitioners, the wording should connect directly to this obligation: The plan should name the qualified individual, document current safeguards, note gaps honestly, and create a maintainable annual review rhythm. A generic WISP can miss that connection, especially when work happens in cloud apps, remote devices, client portals, or tax software.
The document should also state what is not yet complete. If MFA, vendor review, logging, training, encryption, or disposal evidence is missing, the stronger compliance record is an owner, a target date, and an interim safeguard rather than an unsupported claim that the control is finished.
Evidence to keep
Keep evidence that proves the scenario is controlled: Device inventory record; Disk-encryption proof; Remote-wipe or lock record; Credential reset log; Incident timeline and notice analysis.
Evidence should live beside the policy packet or be referenced from it by date and owner. That makes annual review easier and makes insurance applications less dependent on memory.
When a security event happens, the same records become the incident timeline. They help the Qualified Individual decide whether the event is contained, whether customer information was involved, whether the FTC 500-consumer rule could apply, and whether state breach-notification review is needed.
| WISP item | Scenario-specific detail | Evidence to retain |
|---|---|---|
| Scope | Solo practitioners workflow affected by lost laptop or device | Device inventory record |
| Access control | Least-privilege access, approval, MFA, and removal records | Disk-encryption proof |
| Data inventory | Customer information touched by the workflow and where it is stored | Remote-wipe or lock record |
| Vendor or system review | Provider, software, or device controls tied to the workflow | Credential reset log |
| Incident escalation | Who investigates, who preserves logs, and who routes notice analysis | Incident timeline and notice analysis |
FAQ
Is this legal advice?
No. Policywright is a configurable template product, not a law firm and not legal advice. A qualified lawyer should review state-law reliance or breach-notification decisions.
Does a small firm still need a written plan?
Yes. The Safeguards Rule requires a written information security program for covered financial institutions, and IRS guidance tells paid tax preparers to maintain a written data security plan.
What if a control is not in place yet?
A serious WISP should not pretend. It should identify the gap, assign an owner, set a target date, and preserve a dated remediation record.
Should lost laptop or device be a separate WISP section?
Yes, when it changes who accesses customer information, where the data lives, which vendors are involved, or which evidence the firm must preserve. Lost laptop or device meets that threshold for solo practitioners.
Can Policywright decide legal breach notice from this scenario?
No. Policywright can preserve the facts and cite the decision points, but final notice decisions should be reviewed by qualified counsel.
What makes this page different from the general role page?
The general role page explains the overall WISP. This page drills into lost laptop or device, including the distinct controls, artifacts, and escalation records that the scenario creates.
Sources
- FTC Safeguards Rule, 16 CFR Part 314 (eCFR)
- FTC, Safeguards Rule: What Your Business Needs to Know
- FTC, Safeguards Rule notification requirement now in effect (16 CFR 314.4(j), eff. May 13, 2024)
- IRS Publication 5708, Creating a Written Information Security Plan
- IRS Publication 4557, Safeguarding Taxpayer Data
- IRS Form W-12, PTIN Application and Renewal
- IRS Publication 1345, Handbook for Authorized IRS e-file Providers
Build the lost laptop or device section into your packet.
Policywright turns your answers into a source-cited WISP and companion policies with proof prompts for the scenario.
Start the questionnaire