Our Edge · For CPA & Tax Firms
Protect client data. Prove it on paper.
You already know there are rules. What keeps you up is whether what you wrote down is right, and whether it matches what your firm actually does. Longsword builds your Written Information Security Plan (WISP) around your real workflow, backs it with 24/7 security, and keeps both in step, so the plan on paper is the practice in reality.
The Stakes
This is something you cannot afford to get wrong.
One breach can end a tax practice
Your clients' returns, Social Security numbers, and bank details live in one place. A breach of that data costs more than money. It can cost the trust every client relationship rests on, and for a small practice, that can be the end of the business.
You know the rules. Is yours right?
Tax and accounting practices are generally treated as financial institutions under the FTC Safeguards Rule (part of the Gramm-Leach-Bliley Act), and the IRS expects tax professionals to maintain a WISP; see IRS Publications 4557 and 5708. Most firms know this. The worry is whether what's on paper is correct, and whether it matches what the firm actually does.
Paper that doesn't match practice
A generic WISP your firm doesn't actually follow documents promises that aren't being kept. If something goes wrong, that is hard to explain. A plan only protects you when it's true.
This page is informational, not legal advice. Your attorney or compliance advisor can confirm exactly which requirements apply to your firm.
The Difference
A WISP template vs. a managed WISP
The Longsword Approach
What we handle for your practice
WISP, built and maintained
A written plan tailored to your firm: who is responsible, what data you hold, where it lives, who can access it, and how you respond. We keep it current as staff, software, and vendors change.
24/7 Managed Detection & Response
Our SOC watches your endpoints and network around the clock and responds within minutes, including during the filing-season crunch.
Email defense
Intelligent filtering that stops phishing, IRS-impersonation lures, and fake client requests before they reach your team.
Tax-season security training
Practical, role-based awareness training with phishing simulations, covering payment fraud, spoofed client emails, and safe handling of client documents.
Backups that restore
2x daily backups of Google or Azure with unlimited retention and rapid restores.
Incident response included
If something happens we show up, contain it, and hand you a findings report and remediation plan. No hourly invoice, no retainer.
Documented, Not Dusty
From blank page to signed, living document.
How WISP management works
- 1
Assess
A free Security Gap Analysis shows where your practice stands today.
- 2
Build
We create your WISP from our master template and tailor it to your firm's people, systems, and client data.
- 3
Formalize
The plan is reviewed, signed, and acknowledged by your team, with a clear record of who agreed to what.
- 4
Maintain
Scheduled reviews and updates as your firm changes, plus training records kept as evidence.
- 5
Respond
If an incident occurs, your documented response plan is already in place, and we execute it with you.
FAQ
Questions Tax Pros Ask Us
Pricing
One flat rate. No hourly billing, no incident retainers, no surprise invoices.
Ready to protect your practice and prove it?
Start with a free Security Gap Analysis. Real conversation, honest findings, no pressure.