Intake form: your answers for the security plan

Leave out client names, Social Security numbers, passwords, password hints, recovery keys, your EFIN or e-Services login, and anything from a client's return. We do not need any of it. If some arrives, we delete it and tell you.

After you pay on Ko-fi, send your answers number by number as a Ko-fi message, or by email to sales@secondpass.knowngoodit.com. Your finished plan comes back by email within 3 business days of a complete form.

It takes about 30 minutes. Skip any question you are unsure about. We list skipped items on the cover page of your plan so you can fill them in. Your plan marks every answer "owner reported, not verified", because we only see what you send us.

1. Your office

  1. Which language do you want your plan in: English, Spanish or both? If both, you choose which version to sign.
  2. Office name and address, as they should appear on the plan.
  3. Name and title of the owner or principal. Please do not send PTIN or EFIN numbers.
  4. What the office does. For example tax preparation, bookkeeping, payroll, accounting.
  5. Where does client information live? List each office, home office or storage space.

2. Your people

  1. How many people work in the office, including you? How many are seasonal or part time?
  2. Who will run the security plan day to day? Name, title, phone and email. The plan calls this person the Data Security Coordinator. You pick this person.
  3. Who is their backup, and who oversees them? Names and titles. In a one-person office these can be the same person.
  4. Who speaks for the office to clients, police or the news media if something happens? Name.
  5. List everyone who handles client information, with a job title for each.
  6. Does anyone work from home or from a phone or tablet? How do they reach office files?

3. Your computers and devices

  1. How many computers and laptops do you have? Windows or Mac? Which Windows version, if you know?
  2. Are the laptops encrypted, as far as you know? Has any laptop or drive ever been lost or stolen?
  3. Who installs updates, and how do you know they are done? What antivirus is on the computers?

4. Email and tax software

  1. Do you use Microsoft 365, Google Workspace or something else for email?
  2. Which tax software do you use? Is the program on your own computers, or online?
  3. How do you send and receive client documents: a portal, email or a drive link? Name the portal if you use one.

5. Backups and storage

  1. Where are client files kept: on the computers, a server, a cloud service or paper? Name the cloud service.
  2. How are they backed up, how often, and where to? When did you last restore something to see if it worked?
  3. Who shreds paper? Name the service if you use one.

6. Access and passwords

  1. Does every person have their own login to email and to the tax software?
  2. Is two-step sign-in on for email? For the tax software? For cloud storage? Has anyone turned it off because it was annoying?
  3. How do people keep track of passwords? Do you use a password manager? Which one? (Name it only. Never send a password.)
  4. Which outside companies handle your client information: tax software, email or cloud storage, backup, IT provider, payroll or bookkeeping, anyone else? Names only.

7. If something goes wrong

  1. Have you had a scam email, a locked computer or a data problem before? What happened?
  2. If a computer were stolen tonight, what would you do first?
  3. Who in your office would decide whom to notify after an incident? If you do not say, the plan names the Data Security Coordinator.
  4. Do you have cyber insurance? Name the company and its claims phone number. Add the policy number to your printed plan yourself.

8. Your plan on paper

  1. Do you have a written security plan today? When was it last updated? Where will the new plan be kept, and where will the second copy be kept (for example a cloud folder)?
  2. Your choices for two sentences. Opening section: the IRS sample's sentence ("This WISP is to comply with obligations under the Gramm-Leach-Bliley Act and Federal Trade Commission Financial Privacy and Safeguards Rules to which the Firm is subject.") or a plain sentence ("This WISP describes how the Firm protects PII and the practices the Firm has adopted."). Signature section: the IRS sample's sentence ("...has created this Written Information Security Plan (WISP) in compliance with regulatory rulings...") or "Effective [date], [Firm] adopts this Written Information Security Plan." If you skip this, we use the plain sentences. Any state rules you want named in the plan are yours to write in. We do not decide that for you.

What happens next

When your answers are complete and you have replied "I agree" to the services agreement, we fill in your plan and email it to you within 3 business days. Skipped items are listed on the cover page. Read the plan, tell us what does not match your answers (one round of corrections within 14 days), and decide what applies to your office. The plan is drafted with AI tools from your answers. We get no access to your systems and never ask for a password. This is not legal or tax advice, and the plan does not say your office is compliant or approved by the IRS.

Refunds

If you ask before we start drafting, you get a full refund. Drafting starts when we have your complete form and your "I agree", and we tell you the day it starts. After delivery there is no refund, except for an error of ours that we cannot fix. If we cannot deliver within 3 business days of a complete form, we refund the plan fee. The services agreement has the full terms.

Optional upkeep, $29 a month

A monthly checklist, a yearly refresh of your plan, and acknowledgement sheets for new staff. Month to month, cancel any time. Upkeep on Ko-fi