For tax preparers, EAs and small CPA firms
Your PTIN renewal asks about your WISP. Check the email part in 5 minutes.
Line 11 on the PTIN form (W-12) asks you to say you're aware that paid preparers have to keep a written information security plan. The IRS sample plan covers monitoring for all your systems in one short paragraph, and email isn't named in it. This free check asks 8 yes/no questions, lines them up against the IRS sample plan (Publication 5708), and gives you a one-page list of what's missing.
No signup. We don't save your answers to any account or database. Like the rest of this site, visits may be recorded to help us improve it.
This is a checklist, not legal advice, and it doesn't make a plan complete. Only you (and your advisor) can decide what your plan needs.
Why email gets its own line
Required by federal law
Tax and accounting pros count as financial institutions under the Gramm-Leach-Bliley Act and have to keep a WISP. (IRS, IR-2026-92, Aug 18, 2026)
The rule names monitoring
The FTC Safeguards Rule asks for controls to "monitor and log the activity of authorized users and detect unauthorized access" (16 CFR 314.4(c)(8)) and MFA for anyone accessing your systems (314.4(c)(5)).
Email is where the money goes missing
The FBI's 2025 IC3 report counted 24,768 business email compromise complaints and $3,046,598,558 in reported losses.
The 8-question check
Eight questions on the email part of your plan.
Answer yes, no, or not sure. "Not sure" counts as a gap. Takes about 5 minutes.
Q1 of 8
Is your WISP written down, and has someone reviewed it in the last 12 months?
Maps to: Pub 5708, Outline I and the sample template's "Last Modified/Reviewed" line (at least annually).
Q2 of 8
Have you named one person who's in charge of the plan (the "Data Security Coordinator")?
Maps to: Pub 5708, Outline II; 16 CFR 314.4(a).
Q3 of 8
Do you have a current list of everyone who can get into client data, including contractors and your IT person, and what each one can access?
Maps to: Pub 5708, Outline II.b and Sample Attachment F (Firm Employees Authorized to Access PII).
Q4 of 8
Is multi-factor authentication turned on for every firm email account and every remote login?
Maps to: Pub 5708, Outline V (User access, Remote access); Firm User Access Control Policy A-B; 16 CFR 314.4(c)(5).
Q5 of 8
If someone added a forwarding rule to a firm mailbox, or signed in from somewhere new, would anyone at the firm find out within a day?
Maps to: Pub 5708, Network Protection Policy D (monitored for unauthorized access, event logging on, review not to exceed 90 days); 16 CFR 314.4(c)(8).
Q6 of 8
When someone leaves the firm, is their email turned off the same day, and does someone check that it actually happened?
Maps to: Pub 5708, Personnel Accountability Policy E (terminated employees' e-mail access inactivated).
Q7 of 8
Do you know which outside apps have been given access to firm email or files (things like "Sign in with Microsoft/Google" add-ons)?
Maps to: Pub 5708, Outline V, Connected devices (new software approved by the DSC or IT Professional before installation).
Q8 of 8
Do you have a written plan for a breach, including who calls the IRS Stakeholder Liaison and when the FTC has to be told?
Maps to: Pub 5708, Outline V (Reportable Incidents) and Sample Attachment C; IR-2026-92 (FTC notice for events affecting 500+ people, generally within 30 days).
Your one-page gap summary shows up here once all 8 questions are answered.
Want to know if someone could send mail that pretends to be your firm? The free domain check grades your SPF, DKIM and DMARC records (Pub 5708 Outline III, Assess Risks). It's a separate page and doesn't use your answers here.
Free fill-in text
"WISP monitoring control: email accounts"
Paste this into the Network Protection part of your plan and fill in the brackets. It works whether you use InboxGuards, another tool, or a person checking logs by hand.
Email account monitoring (Place under: Network Protection Policy, after item D, in a plan based on IRS Publication 5708. Related rule text: 16 CFR 314.4(c)(8).) [Firm name] uses [Microsoft 365 / Google Workspace] for firm email. To spot unauthorized access to firm email accounts, the Firm [uses (tool name) to review / has (name) review] the email provider's audit records for these events: - sign-ins from a new location or device, and repeated failed sign-ins followed by a successful one - new inbox rules that forward, delete or hide mail, and automatic forwarding set on a mailbox [Google Workspace: forwarding only, see item 4 below] - new mailbox delegates or "send as" permissions - administrator role changes and administrator password resets - multi-factor authentication methods added, removed or turned off - new third-party apps given access to firm email or files Alerts go to [name, role] at [email address], with [backup name] as backup. [Name] looks at each alert within [one business day], writes down what was found and what was done in [where the alert log is kept], and follows the Firm's Security Breach Procedures (Attachment C) if an account looks compromised. At least every [90] days, the Data Security Coordinator confirms that: 1. monitoring is still connected for every firm email account, 2. accounts for people who have left the Firm are turned off, and 3. multi-factor authentication is on for every firm email account, and 4. [Google Workspace only] Gmail filters on each firm mailbox have been looked at by hand, because user-created Gmail filters don't show up in the audit records. Date of last check: [__________] Checked by: [__________] Limits: this control covers firm email accounts only. It doesn't cover computers, tax software, file servers or paper records, and it doesn't stop an attack. It raises an alert after the email provider records the event, and the provider may record events with a delay. Those other areas are covered in other sections of this plan.
What InboxGuards is (and isn't)
- It's an alarm on your Microsoft 365 or Google Workspace audit log. Read-only. It can't read or send mail.
- It checks at the fastest cadence available on standard Microsoft 365 and Google Workspace plans. Provider delays apply. It's not real time and it's not a staffed security team.
- Inbox-rule alerts are Microsoft 365 only. On Google Workspace it sees mail forwarding but not Gmail filters, so check filters by hand.
- Alerts are timestamped and kept, and you can download a monthly report and a monitoring certificate while monitoring is active. Those are records you can keep with your plan. Whether they satisfy anyone is up to whoever is asking.
- $2 per active user per month, or $20 per user per year. A 5-person office is $10 a month. 30-day money-back.
- Owned and run by Orion CMD LLC in Omaha, Nebraska.
Looking for general email security steps for an accounting office? See the email security checklist for CPA firms.
FAQ