WispTrust — Client Intake Questionnaire

WispTrust builds Written Information Security Programs for tax firms, operated by MVP Forge LLC. Our work is verification: you submit your firm's information on the intake form, and a Client Verification Specialist reviews every answer in-house — a person, checking your answers against the FTC Safeguards Rule — before your plan is built. If anything needs clarifying, we reach out by email; nothing is written into your plan as fact that your answers don't support, and anything unconfirmed goes on the gap list instead. The plan itself is built clause-by-clause against the FTC Safeguards Rule (16 CFR Part 314), following the outline in IRS Publication 5708 — your firm's verified information, structured to the federal rule. It is not a template pulled from a database. We are not a law firm, a tax advisor, or a security firm; we do not design your security, and we never receive or hold your client data. You review the finished plan and sign it as your firm's own Qualified Individual.

If your firm handles customer financial information — and a tax practice does by definition — the FTC Safeguards Rule (16 CFR Part 314) requires a written information security program with a designated Qualified Individual. On the IRS side, Form W-12 line 11 asks every paid preparer to attest to having a written plan when applying for or renewing a PTIN, and all PTINs expire December 31. IRS Publications 4557 and 5708 explain the expectation in the IRS's own words. So for a practicing firm, yes — this is a standing duty, not an optional extra.

A smaller version of it does, and we'll tell you exactly which parts. Under 16 CFR 314.6, firms maintaining information on fewer than 5,000 consumers are exempt from a few written-program elements (the written incident response plan requirement and certain testing provisions, among them). The core duties are not exempted at any size: having a program, designating a Qualified Individual, running safeguards, overseeing vendors — and the FTC's breach-notification duty in 314.4(j) applies to every firm. The IRS attestation has no small-firm exemption. Your plan states your 314.6 position in writing, so what applies to you is documented, not assumed.

The questionnaire — about 30 minutes, answered firsthand by whoever knows each part of your firm — about how your firm operates: your people and roles, your software, your devices, your vendors, your office setup. Plus an email address we can reach you at. For a handful of settings (multi-factor authentication, encryption, backups), answer from the settings screen itself where you can, so the plan states facts, not recollections; if we need anything more, we'll ask by email. That's the whole input — there is no call.

No. Never asked for, never accepted. We do not collect client names, Social Security numbers, tax returns or anything from them, bank details, passwords, or your EFIN/PTIN numbers. Our intake is built to refuse that data, and if anything of the kind ever arrives by mistake, it is deleted the same day, the deletion is logged, and we confirm it to you in writing. Federal law (Internal Revenue Code §§7216 and 6713) restricts sharing return information — and sharing it with us is never necessary for this service.

Fast, and in writing at every step. Your submission confirmation is instant — it appears on screen the moment you finish, and we confirm receipt by email. A Client Verification Specialist reviews your intake within one business day, and your finished plan is delivered within two business days of submission. Business days here are Monday–Thursday: submit Monday and your plan arrives by Wednesday; submit Friday and it arrives by Tuesday. If the review turns up anything that needs clarifying, we email you within that first business day, and the two-day delivery clock resumes when you answer. Your part is the questionnaire (about 30 minutes) and signing the plan's adoption page when it arrives.

Flat, and the same in writing everywhere: the Core Build is $549 for a firm of 1–3 staff, $749 for 4–10 staff. That includes the in-house verification review, the risk assessment, the tailored plan, the incident response plan, the training pack, and the evidence binder. After that, the optional Safeguards Year — annual review, updates when rules or your firm change, and incident support — is $49/month or $490/year. If you already have a plan, a review of it is $199. No hourly billing and no surprise add-ons; anything optional is chosen by you, in the engagement letter, before work starts.

A template is a document written for a hypothetical firm; the work of matching it to your actual software, devices, vendors, and practices — the risk assessment, the inventories, the verification — is still entirely yours, and that is most of the job. What we sell is the finished work product: built from your answers, with your unverified items listed honestly as gaps instead of written up as facts, and every answer checked by a Client Verification Specialist before the plan is built, so you sign something true. If you will genuinely finish a template yourself, it's a fair option; if it would sit unfinished, it isn't a plan.

Your IT person runs your technology; this is the documentation layer they typically don't produce: the written risk assessment, the vendor register with contract clauses checked, the Qualified Individual's annual report, the incident plan with its reporting clocks. The Safeguards Rule requires a written program under a named QI — a document, not a device setting. Your IT person actually makes our verification step easier: several answers describe the settings they manage. We document what they do; we don't replace them.

First, honesty: no plan prevents every breach, and anyone who guarantees that is misrepresenting the product. What the plan gives you is the response, ready before you need it: a contact card (attorney, insurer, bank, IRS liaison), a quick card for the first hour, and the reporting clocks spelled out — the IRS stakeholder liaison by the next business day, the FTC within 30 days if the event involves 500 or more consumers' unencrypted information, your states' notifications per the matrix built for your client states. After an incident, firms are judged on what they can show: their program, their evidence, and their response. The plan is exactly that record.

You are — we recommend the owner hold the designation, and the plan is built to support the owner in it: the designation document, the annual QI report to sign off, the training and review rhythm. We never serve as a firm's Qualified Individual; that accountability has to live inside the firm, and our job is to make it manageable.

If you're on the Safeguards Year: we re-run the annual review, update the plan for whatever changed — staff, software, rules — refresh the QI annual report for your sign-off, and your PTIN attestation is again a true statement because the plan behind it is current. If you're not on the Safeguards Year, the plan is yours to maintain, and the annual review is available whenever you want it.

No. We are not a law firm, and this service is documentation and administrative support: we build your written plan from your answers and the published requirements — the Safeguards Rule itself and the IRS's publications. We do not represent you before the IRS or any agency, and we make no compliance determinations for your specific situations. Questions that need a legal call go to your attorney; most attorneys would rather review a finished, sourced plan than draft one from a blank page, and every plan we deliver includes a Basis & Sources page to make that review easy.

The FTC Safeguards Rule itself — 16 CFR Part 314 — structured following the IRS's Publications 4557 and 5708, with e-file incident-reporting clocks from Publication 1345. Every plan ships with a Basis & Sources page: each part of your plan mapped to the paragraph of the rule it answers, the primary sources listed with links, and the date the citations were last verified against the eCFR and IRS.gov. You, your CPA, or your attorney can check any line against the source — that transparency is deliberate.

Not on a website — by design. And note what carries the signature: your intake form carries no signature — it's just your answers. The signature lives on the plan, where you adopt it as your firm's Qualified Individual. The last page of the plan is an adoption/signature page: signature line, printed name, title, firm, and date, under a short adoption statement — that you adopt the plan as QI and that its factual statements are true as reviewed against your submitted answers. You sign one of two ways: (a) print the page, sign it, and return a scan or a clear phone photo; or (b) sign the PDF with any e-signature tool your firm already uses and return the signed PDF. The signed copy is filed in your firm's packet and in your evidence binder, so the signed version is the version of record. The engagement letter is signed the same way.

We watch the sources monthly — the Safeguards Rule on the eCFR, FTC and Federal Register announcements, IRS Publications 4557 and 5708, IRS Security Summit releases, and the state laws in your plan's notification matrix — with a deep re-verification every October before PTIN season. If a change affects your plan, it reaches you as a dated, versioned plan amendment under the Safeguards Year, explained in plain English, for your signature the same way as the original adoption; your signed plan is never silently edited, and your packet keeps every version. Your annual review then re-issues the full plan incorporating everything — so no client is ever more than a year behind the current rule, and the amendments cover the space between.

Then we email you — within one business day of your submission — with the specific questions, in plain language. Nothing is guessed at or filled in for you: the item stays off the plan, or lands on the gap list, until you answer. When you reply, the delivery clock resumes and your plan follows within the remaining time. If we don't hear back, we'll send one reminder; your answers stay on file exactly as you sent them, and the work picks up when you reply.