Frequently asked questions

Does the FTC Safeguards Rule apply to my tax office?

Paid tax preparers are generally covered as "financial institutions" under 16 CFR Part 314, and the IRS PTIN application (Form W-12) asks preparers to acknowledge the requirement for a written information security plan. Whether and how it applies to your situation is a legal question for your own advisor.

Is there an exemption for small offices?

Partly. Under 16 CFR 314.6, a financial institution that maintains customer information on fewer than 5,000 consumers is exempt from some requirements: the written risk assessment (314.4(b)(1)), continuous monitoring or annual penetration testing and twice-yearly vulnerability assessments (314.4(d)(2)), the written incident response plan (314.4(h)), and the annual written report to the board (314.4(i)). It is not a full exemption. The other elements still apply: a qualified individual, safeguards such as access controls, encryption and MFA, staff training, service-provider oversight, and the written information security program itself. Since 2024, a notification requirement for certain security events (affecting 500 or more consumers) is also in the rule.

Will you make my office compliant or guarantee I won't be breached?

No. Nobody can honestly promise that. We help you do the work, document it and keep it current. Results depend on your office's practices.

Is this legal advice?

No. We provide technical and organizational help. For legal questions, consult an attorney.

How do I know a message is really from WispBinder?

We write only from @wispbinder.com, never ask for passwords, codes or client data, never ask you to install remote-access software, never send the check script by email, and only ask for payment by a PayPal invoice in the name WispBinder after you agreed in writing. See how to tell a real message from us.

Do you see my clients' tax data?

No. Our checks look at settings and configuration, not documents or tax returns. The internal script does not read file contents.

Can I read the check script before running it?

Yes. wisp-check.ps1 is plain text. Download it from /downloads/wisp-check.ps1 and compare its SHA256 hash with /releases.json (see how to verify).

Why do reports say DETECTED / NOT DETECTED / NEEDS WRITTEN CONFIRMATION instead of a score or rating?

Because a check from outside or a script can only show what is visible. "Not detected" may mean a setting is missing, or that it exists somewhere we could not see. "Needs written confirmation" means the script could not confirm a setting, so we ask you to confirm it in writing.

What happens to my result file and my binder?

The result file stays on your computer. The results page reads it inside your browser and does not upload it; a browser security rule on that page blocks it from sending data. Your binder (action list, records checklist, change log, vendor and training lists, reviews) is kept only in a binder file you save, or in your browser on that computer if you tick "Remember". We cannot see either. Managed pilot clients email us the files themselves. See Privacy.

Do you check Microsoft 365?

Microsoft 365 checks: coming later. For now, Microsoft 365 sections of your WISP are based on your intake form answers and are labelled as client statements.

What does a result mean?

Describes settings detected at the time of the check. Not an audit, not a certification, not legal advice.