Federal law requires tax and accounting practices to have a written information security plan. This kit gets you a complete one, written for a small practice, without starting from a blank page.
The IRS treats tax and accounting professionals as financial institutions under the Gramm-Leach-Bliley Act. That puts you under the FTC Safeguards Rule, which requires a written plan, a Qualified Individual to run it, a written risk assessment, specific safeguards such as MFA and encryption, an incident response plan, and a yearly report to the owner. Your PTIN renewal also asks you to confirm you know you need a data security plan.
The IRS sample plan in Publication 5708 is a good start, and you should read it. This kit goes further: it follows the Safeguards Rule element by element, tells you what a good answer looks like for a small practice, and gives you the worksheets and trackers that show the plan is actually running.
Every document comes as an editable Word file and as a PDF.
Tax preparers, enrolled agents, bookkeepers and small CPA practices, from solo offices to about 50 people. No security background needed.
It is not legal advice, an audit or a certification, and buying it does not by itself make you compliant. Core-Infosec is a cybersecurity firm, not a CPA firm or a law firm. You are responsible for adapting the plan to your practice and following it.
$129, one-time purchase. Instant download after payment.
Is this the same as the free IRS template? No. Publication 5708 is a free guide of about 28 pages with a sample plan, and you should read it. This kit adds a rule-by-rule fill-in guide, a risk assessment worksheet, trackers and an annual review process.
We keep information on fewer than 5,000 consumers. Do we need all of it? The rule exempts small institutions from a few parts, such as the written incident response plan and the annual report. The Fill-In Guide shows which ones, explains how to count, and explains why doing them anyway is still smart.
What format are the files? Word (.docx) and Excel (.xlsx) for editing, and PDF for reading.
What if it is not what I expected? Email us through the Contact Us page within 14 days and we will refund you.
Want help writing or testing the plan? Core-Infosec offers vCISO and compliance support.
We use strictly necessary cookies for security and sign-in, and, with your permission, analytics (Microsoft Clarity session recordings and Jetpack Stats) to improve this site. See our Privacy Policy.