[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-143471-105":59,"doc-detail-143471-en":131},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":124,"head_meta":126,"extra_data":128,"updated_unix":130},105,"en","written-information-security-plan-wisp-protecting-nonpublic-personal-information-npi-admin-technical-and-physical-safeguards","Written Information Security Plan (WISP) - Protecting Nonpublic Personal Information (NPI) - Admin, Technical, and Physical Safeguards","","Written Information Security Plan (WISP) establishing administrative, technical, and physical safeguards to protect Nonpublic Personal Information (NPI) for clients, employees, and the firm. Defines scope across staff, contractors, vendors, and all systems where NPI is created, stored, transmitted, or disposed of. Includes data classification rules, annual risk assessments, documented mitigation and safeguard reviews, detailed access control, device and mobile encryption, remote work security, logging and monitoring, vendor management, and breach incident response steps including containment, investigation, and notification.",{"@graph":69,"@context":123},[70,84,106],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":40,"@type":76,"position":81},"https://docshare.wps.com/document/research-report/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/written-information-security-plan-wisp-protecting-nonpublic-personal-information-npi-admin-technical-and-physical-safeguards/143471/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/written-information-security-plan-wisp-protecting-nonpublic-personal-information-npi-admin-technical-and-physical-safeguards/143471.png","ImageObject",300,407,{"name":92,"@type":93},"Evangeline","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-30","2026-08-25",true,{"@type":102,"interactionType":103,"userInteractionCount":105},"InteractionCounter",{"@type":104},"ViewAction",15,{"@type":107,"mainEntity":108},"FAQPage",[109,115,119],{"name":110,"@type":111,"acceptedAnswer":112},"What does the Written Information Security Plan (WISP) cover?","Question",{"text":113,"@type":114},"It covers the administrative, technical, and physical safeguards implemented to protect Nonpublic Personal Information (NPI), including the people and systems involved in creating, storing, transmitting, and disposing of NPI.","Answer",{"name":116,"@type":111,"acceptedAnswer":117},"How is NPI data classified and handled?",{"text":118,"@type":114},"Firm data is classified into Public Information, Internal Use Only, and Confidential/NPI. Confidential/NPI requires encryption, restricted access, and secure disposal, and employees must follow the required safeguards based on the classification.",{"name":120,"@type":111,"acceptedAnswer":121},"What controls are required for access and remote work?",{"text":122,"@type":114},"Access requires written authorization and follows least-privilege with quarterly reviews. Termination disables access immediately; passwords follow a strict complexity and rotation policy. Remote work must use firm-approved secure devices and VPN/portals with MFA, and paper documents must be locked and shredded when no longer needed.","https://schema.org",{"og:url":83,"og:type":125,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":127,"canonical":83},"index,follow",{"doc_id":129,"site_id":62},143471,1787695297,{"code":4,"msg":5,"data":132},{"doc_id":129,"user_id":133,"nickname":92,"user_avatar":134,"doc_module":4,"category_id":39,"category_name":40,"doc_title":65,"doc_description":67,"doc_content":135,"file_id":136,"file_url":137,"file_type":138,"file_size":139,"view_count":105,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":34,"language":140,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":67,"update_tm":130,"read_time":144},13056703019662,"https://ap-avatar.wpscdn.com/avatar/be000253a8e92610077?_k=1778726343310543188","Written Information Security Plan  \n(WISP)  \nPrepared for: [Your Firm Name]  \nPrepared under: FTC Safeguards Rule & IRS Guidance  \n1. Purpose & Scope  \nThis Written Information Security Plan (WISP) establishes the administrative, technical, and physical safeguards [Your Firm Name] has implemented to protect Nonpublic Personal Information (NPI), including client, employee, and firm data.  \nThe scope of this plan covers:  \n• All employees, contractors, and vendors who access or manage client information.  \n• All physical and electronic systems where NPI is created, stored, transmitted, or disposed of.  \n• All business processes involving the use of sensitive client data, including tax preparation, bookkeeping, payroll, and financial consulting.  \n2. Firm Profile  \nFirm Name: [Your Firm Name]  \nNumber of Employees: [\\#]  \nPrimary Location: [Address]  \nServices Offered: [Tax preparation, accounting, consulting, etc.]  \n3. Data Classification Policy  \nTo ensure proper handling of information, all firm data is classified into categories:  \n• Public Information – Data intended for public distribution (marketing materials, website content) . No restrictions apply.  \n• Internal Use Only – Business records not intended for external release (internal memos, training guides) . Must remain within the firm.  \n• Confidential / NPI – Client tax returns, Social Security Numbers, financial accounts, or any information protected by federal/state law. This data requires encryption, access restrictions, and secure disposal.  \nEmployees are responsible for knowing the classification of data they handle and following the required safeguards.  \n4. Risk Assessment  \nRisk assessments are performed annually and after major system or business changes. Each assessment includes:  \n• Threat Identification – Insider threats, external hackers, phishing campaigns, ransomware, lost/stolen devices, and natural disasters.  \n• Likelihood & Impact – Evaluation of how probable and damaging each risk is to the confidentiality, integrity, and availability of NPI.  \n• Safeguard Review – Assessment of current controls, such as MFA, encryption, and employee training.  \n• Mitigation Planning – Documenting improvements such as new controls, enhanced monitoring, or additional staff training.  \nResults are reviewed by the Data Security Coordinator and integrated into security updates.  \n5. Safeguards  \nAdministrative Safeguards:  \n• Security policies are communicated to all staff and acknowledged in writing.  \n• Employee background checks are conducted before granting access to sensitive systems.  \n• Access rights are tied to job responsibilities and reviewed quarterly.  \nTechnical Safeguards:  \n• Systems must run current operating systems with regular patching.  \n• Multi-Factor Authentication (MFA) is required for cloud services, email, and remote access.  \n• Encrypted backups are maintained daily and tested quarterly for restorability.  \n• Antivirus and endpoint detection tools are required on all firm devices.  \nPhysical Safeguards:  \n• Offices secured by keyed or electronic access.  \n• Paper files locked in restricted areas after hours.  \n• Portable media (USB, CDs, external drives) not permitted without encryption and written approval.  \n• Visitors must sign in, be escorted, and wear identification when in restricted areas.  \n6. Access Control Policy  \n• Access is provisioned only after written authorization from management.  \n• User privileges are tied to job duties (“least privilege” principle) .  \n• Access reviews are conducted quarterly to ensure only active employees have access.  \n• Immediately upon termination, IT disables system logins, email accounts, and remote access.  \n• Password Policy:  \no Minimum 12 characters with uppercase, lowercase, number, and symbol.  \no Changed every 90 days.  \no Prohibited from reuse across systems.  \n7. Device & Mobile Security  \n• All firm-issued devices must be encrypted with AES-256 full-disk encryption.  \n• Auto-lock screens ","cbCaicYcYJLPOtgI","https://ap.wps.com/l/cbCaicYcYJLPOtgI","pdf",175936,"English","# Purpose & Scope\n## Firm Profile\n# Data Classification Policy\n# Risk Assessment\n# Safeguards\n## Administrative Safeguards\n## Technical Safeguards\n## Physical Safeguards\n# Access Control Policy\n# Device & Mobile Security\n# Remote Work Policy\n# Logging & Monitoring\n# Vendor & Third-Party Management\n# Incident Response Plan","[{\"question\":\"What does the Written Information Security Plan (WISP) cover?\",\"answer\":\"It covers the administrative, technical, and physical safeguards implemented to protect Nonpublic Personal Information (NPI), including the people and systems involved in creating, storing, transmitting, and disposing of NPI.\"},{\"question\":\"How is NPI data classified and handled?\",\"answer\":\"Firm data is classified into Public Information, Internal Use Only, and Confidential/NPI. Confidential/NPI requires encryption, restricted access, and secure disposal, and employees must follow the required safeguards based on the classification.\"},{\"question\":\"What controls are required for access and remote work?\",\"answer\":\"Access requires written authorization and follows least-privilege with quarterly reviews. Termination disables access immediately; passwords follow a strict complexity and rotation policy. Remote work must use firm-approved secure devices and VPN/portals with MFA, and paper documents must be locked and shredded when no longer needed.\"}]","Written Information Security Plan (WISP) - Protecting Nonpublic Personal Information (NPI) - Admin, Technical, and Physical Safeguards | PDF",18]