Written Information Security Plan templates

Your FTC Safeguards Rule security plan, written in an afternoon.

Fill-in-the-blank WISP template packs for small offices. Each kit gives you a complete plan to customize, working spreadsheets, and a step-by-step Quick-Start Guide, so you don't start from a blank page.

Built on the FTC Safeguards Rule (16 CFR Part 314), with every source cited
Editions for five types of business
Editable Word and Excel files, plus PDFs

See the kits Do I need a WISP?

Covers of the five SafeguardKit WISP template packs: tax preparers, auto dealers, mortgage brokers, financial advisors, and collection agencies

Who needs a WISP

If your business handles consumer financial information, the FTC may already require a written plan.

The FTC's Safeguards Rule (16 CFR Part 314) covers many non-bank businesses that the law treats as "financial institutions." That includes tax preparers, auto dealers that arrange financing or leasing, mortgage brokers and lenders, collection agencies, check cashers, and investment advisers that are not registered with the SEC.

Covered businesses must have a written information security program, often called a WISP. It describes how you protect customer information, who is in charge, and what you do when something goes wrong.

Not sure whether the rule applies to you? Start with the FTC's own guide: FTC Safeguards Rule: What Your Business Needs to Know. Your industry association or attorney can confirm your situation.

What the rule asks for

A Qualified Individual who runs the program
A written risk assessment
Safeguards such as access controls, encryption, and multi-factor authentication
Staff training and service-provider oversight
A written incident response plan
A yearly written report to the owner or board
Notice to the FTC within 30 days of discovering a breach of unencrypted information about 500 or more consumers

The kits

Pick the edition for your business

Every kit has the same ten-file structure. The examples, risks, vendors, and related rules are written for your industry.

WISP Template Pack for Tax Preparers and Small CPA Firms cover

Tax Preparers & CPAs

For solo preparers, EAs, CPAs, seasonal tax offices, and small accounting firms (about 1–15 people).

Follows IRS Publication 5708 and Publication 4557
18 pre-loaded tax-office risks, including EFIN misuse and remote takeover
Who to call after a breach, including the IRS Stakeholder Liaison
Notes on the PTIN renewal (Form W-12) WISP question

$39instant download

Buy on Etsy

Auto Dealers

For independent, franchised, and buy-here-pay-here dealers, plus powersports and RV dealers that finance or lease (about 1–50 people).

Sections on the showroom and F&I office, deal jackets, the DMS, and lender portals
18 pre-loaded dealership risks, including shared logins and payoff fraud
Built from the FTC's June 2025 FAQ for automobile dealers
Lists related duties: Privacy Rule notices, Red Flags Rule, Form 8300

$59instant download

Buy on Etsy

WISP Template Pack for Mortgage Brokers and Lenders cover

Mortgage Brokers & Lenders

For independent mortgage brokers, small nonbank lenders, and loan-origination teams (about 1–50 people). Not for banks or credit unions.

Sections on wire fraud and closing communications
Loan files, settlement partners, and lender and investor terms
Wire-recall steps in the incident response plan
Regulator table: FTC, CFPB, state/NMLS, FinCEN AML, Red Flags

$69instant download

Buy on Etsy

WISP Template Pack for State-Registered Financial Advisers cover

Financial Advisors

For state-registered RIAs, solo and small advisory firms, and fee-based planners that are not SEC-registered (about 1–15 people).

A one-page "which rule applies" table (FTC vs. SEC Regulation S-P)
State rules, with a map to the NASAA model rule
Sections on client money movement and custodian access
Not for SEC-registered advisers, which follow Regulation S-P

$79instant download

Buy on Etsy

Collection Agencies

For third-party collection agencies, debt buyers, and collection teams (about 1–50 people). Check cashers and for-profit credit counselors can adapt it.

Sections on call recordings, skip tracing, payments, and creditor-client data
Retention notes, including Regulation F's 3-year periods
Regulator table: FTC, CFPB Reg F, HIPAA, state licensing
A written plan to show creditor clients when they audit you

$59instant download

Buy on Etsy

What's in every kit

Ten files, delivered as one ZIP

Word (.docx)
Excel (.xlsx)
PDF
Works in Google Docs, Sheets, and LibreOffice

WISP Main TemplateFill-in-the-blank placeholders, guidance notes you delete when done, and a section for every element of 16 CFR 314.4.
Quick-Start GuideA step-by-step plan to finish your WISP.
Risk Assessment Worksheet18 pre-loaded industry risks, auto-scoring, color-coded ratings, and dropdowns.
Data & Asset InventoryDevices, software and cloud apps, data, paper records, users, and a disposal log.
Incident Response PlanRoles, step-by-step response, who to call, and the FTC 500-consumer / 30-day notice worksheet.
Employee Acknowledgment & Training LogRules of behavior, sign-off form, training plan, onboarding and offboarding checklist.
Vendor Oversight ChecklistRegister, due diligence, contract requirements, and periodic review.
Annual Report to OwnerThe Qualified Individual's written yearly report, element by element.
ReferencesThe primary sources behind the templates, with links.
Read-Me-FirstDisclaimer and single-business license.

Sample pages from the Tax Preparers & CPAs edition. Every edition follows the same layout.

Sample WISP pages showing bracketed placeholders and shaded guidance notes — WISP pages with placeholders and guidance notes

Sample incident response plan and breach checklist pages — Incident response plan and breach checklist

Sample risk register and inventory spreadsheets — Risk register and inventory spreadsheets

About SafeguardKit

Who makes these templates

SafeguardKit templates are built by IT professionals with experience in telecommunications, managed IT services, and healthcare, including hospitals and clinics. We specialize in identity and access management (IAM), the accounts, permissions, and sign-in security that the FTC Safeguards Rule's access-control and multi-factor authentication requirements are built on. These templates let small offices put those protections in writing without paying consultant rates.

FAQ

Common questions

Is this legal advice?

No. These are templates for general information only. Buying them does not create an attorney-client or consultant relationship, and using them does not by itself make your business compliant. You are responsible for customizing the plan, putting it into practice, and checking it against current law, ideally with a qualified attorney or IT security professional. See the terms.

My business is small. Do I still need a WISP?

Usually, yes. Under 16 CFR 314.6, a business that keeps customer information on fewer than 5,000 consumers is exempt from only some requirements: the written risk assessment, continuous monitoring or annual penetration testing and vulnerability scans, the written incident response plan, and the annual written report to the board or owner. It still needs a written information security program and the rule's other safeguards. Each kit explains the exemption and still includes the optional pieces, since many small offices use them anyway.

What file formats do I get?

Editable Microsoft Word (.docx) and Excel (.xlsx) files, plus PDFs, in one ZIP. They also open in Google Docs, Google Sheets, and LibreOffice. Unzip the file on a computer, since some phones can't open ZIP files.

How is it delivered?

As an instant digital download through Etsy. After purchase, open Purchases & Reviews in your Etsy account and download the ZIP. Nothing is shipped.

Can I use one kit for more than one business?

Each purchase is a single-business license: one business (one legal entity, including its owners, staff, and locations) may edit and use the templates internally. Please don't resell or share them. Consultants or firms serving several businesses need a separate license, so message us through the SafeguardKit shop on Etsy.

How do I contact you?

Message us through the SafeguardKit shop on Etsy. We use Etsy messages for all support and licensing questions.