WRITTEN INFORMATION SECURITY PLAN (WSIP)
I. OBJECTIVE
Our objective, in the development and implementation of this comprehensive Written Information Security Plan (WISP), is to create effective administrative, technical, and physical safeguards for the protection of the Personally Identifiable Information (PII) retained by Richardson Accounting and Tax, (hereinafter known as the Firm). This WISP is to comply with obligatins under the Gramm-Leach-Bliley Act and Federal Trade Commission Financail Privacy and Safeguards Rules to which the Firm is subject. The WISP sets forth our procedure for evaluating our electronic and physical methods of accessing, collecting, storing, using transmitting, and protecting PII retained by the Firm. For purposes of this WISP, PII means information containing the first name and last name or first initial and last name of a taxpayer, Spouse, Dependent, or Legal Guardianship person in combination with any of the following data elements retained by the Firm that realte o Clients, Business Entities, or Firm Employees:
Socail Security number, Date of Birth, or Employment data
Driver's license number or state-issued identification card number
Income data, Tax Filing data, Retirement Plan data, Asset Ownership data, Investment data
Financial account number, credit or debit card number, with or without security code, access code, personal identification number, or password(s) that permit access to a client's financial accounts
E-mail addresses, non-listed phone numbers, residential or mobile or contact information
PII shall not include information that is obtained from publicly available sources such as a Mailing Address or Phone Directory listing, or from federal, state, or local governments records lawfully made available to the general public.
II. PURPOSE
The purpose of the WISP is to:
Ensure the Security and Confidentiality of all PII retained by the Firm
Protect PII against anticipated threats or hazards to the security or integrity of such informaton.
Protect against any unauthorized access to or use of PII in a manner that creates a substantial risk of Identity Theft or Fraudulent or Harmful use.
III. SCOPE
The scope of the WISP related to the Firm shall be limited to the following protocols:
Identify reasonably foreseeable interanl and external risks to teh security, confidentiality, and/or integrity of any electronic, paper, or other records containing PII.
Assess the potential damage of these threats, taking into consideration the sensitivity of the PII.
Evaluate the sufficiency of existing policies, customer information systems, and other safeguards in place to control identified risks.
Design and implement this WISP to place safeguards to minimize those risks, consistent with the requirements of the Gramm-Leach-Bailey Act, the Federal Trade Commission Financail Privacy and Safeguard Rule, and National Institute of Standards recommendations.
Regular montitoring and assessment of the effectiveness of aforementioned safeguards.
IV. IDENTIFIED RESPONSIBLE OFFICIALS
The Firm has designated Michael L Richardson to be the Data Security Coordinator (hereinafter the DSC).
The DSC is the responsible official for the Firm data security processes and will implement, supervise, and maintain the WISP. Accordingly, the DSC will be responsible for the following :
Implementing the WISP includng all daily operational protocols
Identifying all the Firm's respositories of data subject to the Wisp protocols and designating them as Secured Assets with Restricted Access
Verifying all employess have completed recurring InformationSecurity Plan Training
Monitoring and testing empoyee cmpliance with the plan's policies and procedures
Evaluating the ability of any third-arty service providers not directly involved with tax preparation and electronic transmission of tax returns to implement and maintain approproate security measures that comly with this WISP.
Reviewing the scope of the serivce measures int he Wisp at least annually or whenever there is a material change in our business practies that affect the security or integrity of records containing PII