10 quick questions for your security plan PILOT

About 5 minutes. Your answers help us write your Written Information Security Plan (WISP). "Not sure" is always fine. We go through the rest together on a short call (about 15 minutes).

Your answers stay on this computer. This page does not send anything: when you are done, it saves a small file on your computer. You decide whether to email that file to us. Please do not type tax returns, Social Security numbers, client names, passwords or account numbers.

Continue from a file you saved earlier (optional)

1. Office name

Legal business name

"Doing business as" name, if any

2. States

In which US states do your clients live? (for example: OH, KY, IN)

3. People

How many people work in the office, including owners and seasonal staff?

4. Responsible person

Who will be responsible for your security program? If you are not sure yet, write "owner".

Name

Title

Work email

5. Clients on file

About how many individual clients do you keep information about, including past clients whose files you still keep?

Under 1,000 1,000–4,999 5,000 or more Not sure

6. Tax software

Which professional tax software do you use?

Is it installed on your computers or used online?

Installed Online Not sure

7. Second sign-in step

Does your tax software ask for a code or an app approval when you log in?

Yes No Not sure

8. Documents

How do clients send you documents, and how do you send documents back? (choose all that apply)

In person Client portal Regular email Encrypted email Fax Mail

Other

9. Backup

How is client data backed up? (for example: "cloud backup service, every night", "external drive, weekly", "not sure")

When did you last restore a file from a backup? (a month and year is enough, or "never")

10. Problems

Has the office ever had a security problem (stolen device, hacked email, returns filed that you did not file, ransomware)? A short description is enough, or "none".

Something like this is happening right now

Only these 10 questions are asked here. Describes what you tell us; it is not an audit, not a certification and not legal advice.