The security plan the law says you need — written and sourced, in your hands the same day.
The FTC Safeguards Rule requires every business it covers to keep a written information security program: tax preparers, mortgage brokers and lenders, auto dealers that finance or lease, finance companies, collectors, and more. Most small ones do not have one. A consultant costs thousands and takes weeks, and the cheap templates fall apart under review.
Plans for tax and accounting firms are available now. Plans for the other covered businesses, Title IV schools, Massachusetts 201 CMR 17.00, New York's SHIELD Act, and California and Texas data security law are built and in final review.
ShieldSheet fixes that. Answer a few plain questions about your firm and get back a complete, regulation-mapped plan in minutes, for a fraction of the cost.
No AI writes your plan. Every line comes from an expert-reviewed template and is traced to your own answers. Nothing is invented or guessed. Honest gaps are flagged instead of papered over. Same answers, same document, every time.
It reads like a $5,000 consultant wrote it. It costs a fraction. It is ready today.
Sample Tax & Accounting LLC
Prepared under 16 CFR Part 314, structured after IRS Pub 5708
- § 1Purpose & scopedone
- § 2Qualified Individualdone
- § 3Risk assessmentdone
- § 4Safeguards & MFAdone
- § 5Service providersdone
- § 6Incident responsedone
Required, but unwritten
The FTC Safeguards Rule requires a written plan of every business it covers, and the IRS asks every tax preparer about theirs. Most small businesses do not have one.
Consultants are slow and expensive
Thousands of dollars and weeks of back-and-forth. ShieldSheet delivers in minutes.
AI tools cannot be trusted here
They invent controls you do not have. ShieldSheet is deterministic and sourced, so it never does.
Every PTIN application and renewal asks preparers to acknowledge the written security plan requirement.
IRS · line 11Deadline to notify the FTC after a breach exposing unencrypted data of 500 or more consumers.
16 CFR 314.4(j) · since May 2024Finish the intake and your plan is generated in your dashboard, in Word and PDF, with a short list of gaps to close.
Self-serve · no waiting on emailBuilt on the published guidance
The ShieldSheet approach
Six things the Safeguards Rule asks of your business, handled in one plan
Each section of your plan answers a specific element of 16 CFR 314.4. Pick one to see what we write and what you get.
Solutions
One engine, three ways to use it
ShieldSheet drafts security documents from what's true about an organization, cites every answer, and flags what it can't confirm.
Inside the plan
Written for your office, section by section
These excerpts come from a sample plan. Yours names your software, your staff count, and your vendors. Anything we can't confirm is flagged for you.
Industries
The Safeguards Rule covers more businesses than most people think
The rule covers the non-bank financial institutions under FTC jurisdiction, and they all need the same written program (16 CFR 314.1(b)). Tax and accounting plans are available now. Plans for the businesses marked "In final review" are built on the same engine, each with its own cited applicability determination, and go live once our reviewer signs off.
Tax preparers
Seasonal and year-round offices, PTIN holders, EFINs.
CPA & bookkeeping
Payroll, bookkeeping, and advisory firms with client ledgers.
Mortgage brokers
Loan files, credit reports, and borrower documents.
Auto dealers
Dealers that arrange financing or leasing.
Non-bank lenders
Finance companies, payday and auto-title lenders, check cashers, money transfer services, and loan servicers.
Collection agencies
Debtor records and payment information.
Investment advisors
Advisors not required to register with the SEC.
Colleges and schools
Schools in the federal student aid (Title IV) programs.
Massachusetts 201 CMR 17.00
Any business holding a Massachusetts resident's personal information, mapped requirement by requirement.
Real estate appraisers
Real estate and personal property appraisers.
New York SHIELD Act
Any business holding a New York resident's private information, mapped to each safeguard N.Y. Gen. Bus. Law § 899-bb lists.
California data security law
Businesses holding a California resident's personal information: Cal. Civ. Code § 1798.81.5 and the § 1798.82 breach notice step.
Texas data security law
Businesses in Texas holding sensitive personal information: Tex. Bus. & Com. Code § 521.052 and the § 521.053 breach notice step.
The cost of getting it done
Compare writing it yourself, hiring it out, and ShieldSheet
Move the sliders to match your firm. The defaults are examples, not quotes.
First-year cost, including your time
saved in the first year compared with the next-cheapest option. ShieldSheet includes $149 plus about 30 minutes of your time for the intake and review.
Consultant figure assumes about one hour of your time to brief them.
Pricing
Clear prices. Cancel any time.
WISP for your practice
- Full written plan, § 1–8, plus appendices
- Tailored to your software, staff, and vendors
- Word and PDF, ready to sign
- Gap list with practical next steps
- Yearly refresh before tax season
After checkout you go straight to your dashboard to start the intake.
Safeguards care plan
- Everything in the WISP
- Yearly risk assessment refresh
- Annual written report to the owner
- Training and incident logs kept current
- Help when an insurer or client sends a security questionnaire
White-label partner
- Your logo and contact details on every plan
- You set the client price
- Plans delivered with your branding
- Security questionnaires from $150
- No minimums, no monthly fee
ShieldSheet partner program
Your accounting clients need this every year. Deliver it under your name.
When a client asks their IT provider for a security plan, you shouldn't lose two days to it. Send us the intake, and we return a finished plan with your branding. You keep the relationship and the margin.
Talk to us about partneringResources
Read the source material
The official guidance our plans are built on, straight from the agencies.
Pub 5708: Creating a WISP for tax professionals
The IRS's own outline and sample plan for small tax practices.
irs.gov · PDF IRS publicationPub 4557: Safeguarding taxpayer data
The checklist-style guide to protecting client information in a tax office.
irs.gov · PDF FTC guidanceThe Safeguards Rule: what your business needs to know
Plain-English explanation of each required element.
ftc.gov Regulation16 CFR Part 314, full text
The rule itself, including the 2024 breach notification requirement.
ecfr.gov SampleSee a complete sample plan
Email us and we'll send a full WISP for a fictional three-person firm.
hello@shieldsheet.comFrequently asked questions
What firms usually ask
Which businesses need a written security plan?
The FTC Safeguards Rule names mortgage lenders and brokers, payday lenders, finance companies, account servicers, check cashers, wire transferors, collection agencies, credit counselors, tax preparation firms, and investment advisors not required to register with the SEC, among others (16 CFR 314.1(b)), and its definitions add real estate and personal property appraisers (16 CFR 314.2(h)(2)(iii)). Schools in the federal student aid programs agree to follow it. Massachusetts requires a written program of any business holding a resident's personal information (201 CMR 17.00), New York requires reasonable safeguards of any business holding a resident's private information (N.Y. Gen. Bus. Law § 899-bb), California requires reasonable security of businesses holding a resident's personal information (Cal. Civ. Code § 1798.81.5), and Texas requires reasonable procedures of businesses holding sensitive personal information (Tex. Bus. & Com. Code § 521.052). Your plan states, with the citation, why it applies to you, based on your own answers.
Do tax preparers really need a written security plan?
Yes. Tax and accounting firms are financial institutions under the FTC Safeguards Rule, which requires a written information security program. IRS Publication 5708 explains this and gives a sample structure, which our plans follow.
Is this a template?
No. Your answers shape every section: the software you use, who has access, where files are stored, and which vendors you rely on. Anything we can't confirm is flagged for you to check instead of filled in with a guess.
Do you need access to my client files?
No. The intake asks how your office works, never for taxpayer data. Please don't send us any.
Who stands behind the plan?
Every section template was written and reviewed by a cybersecurity professional with a master's degree in cybersecurity. Your plan is assembled from those reviewed templates and your answers. Any control you didn't confirm is flagged as a gap, never claimed.
What do I get at the end?
Your plan in Word and PDF, appendices for assets, vendors, training, and incidents, and a short list of gaps to close first.
I already have a WISP. Can you update it?
Yes. Send your current plan with the intake and we'll bring it in line with how your office works today, at the same price.
What if we have a breach?
Your plan includes the response steps and the FTC notice rule for incidents involving 500 or more people. Care plan clients also get help working through it.
Can my IT provider deliver this for me?
Yes. Many firms get their plan through their IT provider, who resells ShieldSheet under their own name.
Is this legal advice?
No. We prepare the plan from security best practice and the published guidance. For questions about your legal obligations, talk to your attorney.
Get your plan on file before the first return of the season.
Questions first? Write to hello@shieldsheet.com and a person will answer within one business day.