WispBinderRead your results PILOT
Your result file stays on your computer. This page reads it inside your browser and does not upload or send it. It also builds your binder (action list, records, reviews), which is kept only if you choose: in a binder file you save, or in this browser.
Drag your result file here
You can also open a binder file you saved earlier, a domain-check file saved from the domain check, or a training completion file from the staff training.
It is in the WispBinder-Results folder on your Desktop. Its name starts with wisp-check- and ends with .json.
or
How do we know nothing is sent?
This page is served with a browser security rule (Content-Security-Policy: connect-src 'none'; form-action 'none') that tells your browser to block every network request the page's code might try to make, and to block form submissions. It also loads no scripts from other companies and no analytics. All texts it needs are loaded with the page, before you choose a file. IT staff can confirm this in the browser's developer tools (Network tab): opening a result file adds no new requests. If you tick "Remember", your action list is stored in this browser on this computer only (browser storage), and you can delete it with "Clear binder".
Results
Settings that were detected
Managed pilot clients only: send your file to WispBinder
- Click the button below. Your email program opens a new message to WispBinder.
- Attach the result file yourself, from the WispBinder-Results folder on your Desktop (file name:
wisp-check-...json). - Check the message and click Send.
Self-service clients do not need to send anything. Nothing is sent unless you send the email yourself.
Describes settings detected at the time of the check. Not an audit, not a certification, not legal advice.
Your binder
Three parts that you keep up to date during the year. Everything stays on this computer unless you send the binder file to someone yourself.
1. Action list
For each item: choose who will do it and by when, follow the steps, then tick Done. Overdue items are marked in red. For "Confirm in writing" items, write what you found in the note: that note is your written record. Run the check again after your fixes and open the new file here: items that are now detected are confirmed automatically.
Log a change
When something changes in the office, log it here. The binder adds a "Review" item to the action list with what to look at again, and updates your change log record (E08). These are suggestions to review, based on WispBinder's own rules; they do not decide what is required.
2. Evidence checklist
Records the Windows check cannot read. For each one, say whether you have a document (with its date and where it is kept), or that you do it without a document. Each record is labelled "Document on file", "Office statement, not verified" or "Not provided". Some records must be updated regularly: backup and restore test every 90 days, training, vendor reviews and the risk list every 12 months. The records themselves stay where they are: this list only points to them.
References are to 16 CFR 314.4. Offices with fewer than 5,000 consumers are not required to have some of these (16 CFR 314.6); we list them as good practice. This checklist helps you keep records; it is not legal advice and does not show compliance.
Domain checks
Email settings of your office domain (SPF, DMARC, DKIM), saved from the domain check with the date of the check. Open a saved domain-check file here to add it; the latest result per domain is shown and goes into the review pack.
Microsoft 365 checks
Settings of your Microsoft 365 account (multi-factor sign-in, administrators, audit log, email forwarding), read by the Microsoft 365 check and saved with its date. Open its result file here to add it; the latest check goes into the review pack. The Microsoft 365 check is a draft and is not offered yet.
Vendor list
Companies that handle client information for you. While this list has rows, it fills record E12 (vendor list); review each vendor at least every 12 months. If you keep your vendor list elsewhere and set E12 yourself, this list does not change it.
Training records
Who completed security training and when, and when they signed the staff acknowledgment (WISP Exhibit F). While this list has rows, it fills record E10 (staff training records); training should be repeated at least every 12 months. Names stay in this binder on your computer. Staff can take our short security training and open the completion file here to add a row.
Staff list
Everyone who works with client information. Name the person who gives each written confirmation in your action list. If someone leaves, enter the date here: every confirmation they gave is opened again to confirm again, because the person who could answer for it has gone. Earlier confirmations are kept in each item's history. Only you enter names and dates; they stay in this binder on your computer.
Risk list
Risks to client information and what you decide about each one (WISP section 2). You rate each risk yourself: High = likely within a year and would expose many clients' information; Medium = one of the two; Low = neither. Each High risk needs a decision: reduce it (with a target date) or accept it in writing. While this list has rows, it fills record E02; review it at least every 12 months and after big changes. This page does not rate risks for you.
Incident log
Your record of security incidents (WISP Exhibit D): a lost or stolen device, a hacked email or tax-software account, ransomware, returns filed that you did not file, client information sent to the wrong person. Each entry has the first steps from your plan (WISP section 14). Describe what happened in general terms. Do not enter client names, Social Security numbers, account numbers or passwords.
If an event is a notification event involving the unencrypted information of 500 or more consumers, the FTC must be notified as soon as possible and no later than 30 days after discovery (16 CFR 314.4(j)); the log shows that date as a reminder. Whether an event must be reported, and to whom else (IRS, states, clients), is a question for your attorney and insurer. If something is happening right now, follow your plan first and fill this in afterwards.
Incident kit
A page to print now and keep on paper, away from your computers: the first steps, your contacts, who to tell (with the public source of each line), and what your binder showed before an incident, including your evidence ledger head. Fill in your contacts once; they are kept in this binder only.
A checklist from IRS and FTC guidance, not legal advice. Who must be told, and when, depends on the facts and on state law; decide with your attorney and insurer.
3. Annual review
4. Annual review pack
A printable summary of this binder for the year: computers and checks (first and latest), actions, records kept, reviews, and a table that connects each part of the WISP to its checks and records. Every line says whether it came from a check file or was entered by the office. Use your browser's "Save as PDF" to keep a copy.
5. Evidence ledger
A running record of every check file you open here and of your office statements, in the order they were added. Each entry has a fingerprint (SHA-256) that also covers the entry before it.
What it does not do: without a ledger head given earlier, a ledger file proves nothing, because anyone who knows the method could make one. Dates come from your computer. It does not prove who ran a check, that every computer was checked, or that your office is protected or meets any rule. WispBinder never sees your ledger and does not confirm anything in it. You can start a new ledger at any time (for example by clearing the binder), so only a head you have given to someone protects your record.
An item extract shows that one item in full, plus the number, type and claimed date of every other entry in your ledger (not their contents). Your binder file also holds a private value of the ledger that is never put in a ledger file or extract; keep the binder file private.
6. Statements these records do not support
Before you describe your binder to an insurer, a reviewer or a client, check this list. It is built from your latest check of each computer and is also printed in the review pack.
The binder file is a normal file on your computer. Keep it with your WISP records and open it here next time. Nothing is uploaded.