BitFlip Technologies
Get in touchContact
Menu
Security Notes

Do you need a written security plan?

By Travis Baldwin, Founder & Principal ConsultantLast reviewed 2 min read

The short version

  • A written information security plan, or WISP, describes how your business protects the customer information it holds.
  • Some businesses must have one, including tax preparers and many others covered by the FTC Safeguards Rule.
  • In Ohio, a written cybersecurity program based on a recognized framework can help defend your business if a data breach leads to a lawsuit.
  • Even where it isn't required, writing it down turns good intentions into habits everyone follows.

What a WISP is

A written information security plan is a document, often just a few pages for a small business, that says what sensitive information you hold, who is responsible for protecting it, and what you do to keep it safe. It's less about technology than about deciding things in advance: who gets access, how devices are protected, and what happens when something goes wrong.

Who has to have one

  • Businesses covered by the FTC Safeguards Rule. The rule reaches well beyond banks to many businesses that provide financial products or services to consumers, including tax preparers, mortgage brokers and many auto dealers, and it requires a written information security program.
  • Tax and accounting practices. The IRS expects tax professionals to keep a written plan and publishes a free template, Publication 5708, along with its broader guide to safeguarding taxpayer data, Publication 4557.
  • Others, depending on your work. Health care practices have security obligations under HIPAA, and some states set their own requirements for businesses that hold residents' personal information.

Ohio's safe harbor

Ohio's Data Protection Act (Ohio Revised Code chapter 1354) gives businesses a legal defense in certain data-breach lawsuits if they created, maintained and followed a written cybersecurity program that reasonably conforms to a recognized framework, such as those published by NIST or the Center for Internet Security. For any Ohio business that holds personal information, that's a strong reason to put its security practices in writing.

What goes in it

  1. Who's responsible: a named person who coordinates security.
  2. What you hold and where: customer records, financial data, and the systems and vendors that store them.
  3. The risks: what could go wrong, and how likely and harmful it would be.
  4. The safeguards: access limited to people who need it, two-step login, encryption, updates, backups, and secure disposal of old records and devices.
  5. Staff training: what everyone is expected to do, and how often it's refreshed.
  6. Vendors: how you check that service providers protect your data too.
  7. Incident response: who does what if something goes wrong, including who must be notified.
  8. Review: a date to revisit the plan at least once a year, and whenever something significant changes.

Whether a specific rule applies to your business depends on what you do and the information you hold. Treat this note as a starting point, and confirm your obligations with your attorney or professional association.

More Security Notes