Juniper Tax Services LLC (sample)

Firm profile

1. Objective, purpose and scope

1.1 Objective. Juniper Tax Services LLC (sample) ("the Firm") keeps this Written Information Security Plan to protect the security, confidentiality and integrity of clients' personal information, as required for tax return preparers under the Gramm-Leach-Bliley Act and the FTC Safeguards Rule (16 CFR Part 314), and following IRS Publications 5708 and 4557.

1.2 Scope. This plan covers all customer information the Firm collects, stores, uses, sends or destroys, on paper or electronically, by the owner and staff and by service providers. "Personal information" includes names, Social Security and taxpayer identification numbers, dates of birth, addresses, bank account and routing numbers, income records, identity documents and IRS correspondence.

1.3 Size note. The Firm holds customer information on fewer than 5,000 consumers. Under 16 CFR 314.6, it is not required to meet §314.4(b)(1) (written risk assessment), §314.4(d)(2) (continuous monitoring or annual penetration testing), §314.4(h) (written incident response plan) or §314.4(i) (annual written report). The Firm keeps a short written risk assessment and incident response plan anyway (Sections 4 and 9), because the IRS recommends them. If the Firm ever holds information on 5,000 or more consumers, it will meet every element.

2. Responsible people (§314.4(a))

3. Customer information inventory (§314.4(c)(2))

4. Risk assessment (§314.4(b))

Reviewed October 15, 2026. Next review by October 2027, or sooner after any change in systems, staff or an incident.

5. Access control (§314.4(c)(1))

5.1 Each person has a unique login on every system. No shared accounts or passwords.

5.2 Staff receive the least access they need for their role; seasonal staff can prepare returns but cannot transmit e-files, export data or reach banking.

5.3 Access is reviewed at the start and end of each filing season and logged in Attachment F.

5.4 Offboarding. Within 24 hours of anyone leaving, the owner disables their accounts on every system, recovers keys and devices, and records it in Attachment F.

5.5 Before anyone receives access, they sign the acknowledgement in Attachment B and complete a background check.

6. Technical and physical safeguards (§314.4(c))

6.1 Inventory. The information inventory in Section 3 is reviewed every year.

6.2 Multi-factor authentication (§314.4(c)(5)). MFA is required on tax software, email, the client portal, IRS e-Services, the backup service and the domain registrar, using an authenticator app where possible. Currently on for: Tax software, Email, Client portal, IRS e-Services and Backup service. Remaining systems are listed in Attachment G.

6.3 Encryption (§314.4(c)(3)). Every computer holding client data uses full-disk encryption (BitLocker or FileVault); phones and tablets use a passcode of at least 6 digits with device encryption on. Client information sent outside the Firm travels through encrypted channels (the client portal or encrypted email), never as plain email attachments.

6.4 Portable devices. Screens lock after 5 minutes. Remote locate and wipe is on. Client information is not kept in phone photos or download folders.

6.5 Updates. Automatic updates are on for the operating system, browsers and applications; the owner confirms this monthly.

6.6 Malware protection. Endpoint protection and the firewall are on for every computer, with scheduled scans.

6.7 Passwords. A password manager holds unique passphrases of 14 or more characters. Tax-system passwords are not saved in browsers.

6.8 Backups. Client data is backed up automatically and encrypted, with a copy away from the office. A test restore is done every quarter and logged.

6.9 Client file exchange. Clients send documents through the secure portal. The Firm never asks for Social Security numbers or bank details by plain email or text message.

6.10 Physical security (§314.4(c)(6)). Paper with client information is kept in a locked cabinet in a room that is locked when not in use. Desks are cleared at the end of each day. Paper is destroyed with a cross-cut shredder; old drives are wiped or physically destroyed before disposal.

6.11 E-file monitoring. The owner compares e-file acceptance counts in IRS e-Services against the Firm's own records weekly in filing season and monthly otherwise, and watches for unknown activity on the EFIN.

6.12 Logging (§314.4(c)(8)). Sign-in logging is on for email and tax software, and the owner reviews unusual sign-in alerts weekly.

6.13 Change management (§314.4(c)(7)). New software, devices or vendors are checked against this plan before use.

6.14 Secure development (§314.4(c)(4)). Not applicable: the Firm does not build its own software.

7. People: training and behaviour (§314.4(e))

7.1 Everyone with access to client information reads this plan and signs Attachment B before access is granted, and again every January.

7.2 Security awareness training using the IRS "Protect Your Clients; Protect Yourself" materials and Publication 4557 is completed at hire and every January, and logged in Attachment F.

7.3 Verify-by-phone rule. Any request to change bank details, send copies of returns, or urgently release information is confirmed by calling a number already on file, never a number in the request.

7.4 Rules of behaviour are in Attachment A.

8. Service providers (§314.4(f))

The Firm selects service providers that can protect customer information, requires security terms in their contracts, and reviews each one every year.

9. Incident response (§314.4(h))

9.1 Recognise. Warning signs include e-files rejected because a return was already filed, e-file acceptances the Firm did not send, clients receiving unexpected IRS letters, unusual sign-ins, ransom notes and lost devices.

9.2 Contain. Disconnect affected devices from the network, change passwords from a clean device, and call Ridgeline IT (sample).

9.3 Report to the IRS. Contact the IRS Stakeholder Liaison for Idaho right away (listed on irs.gov under "Stakeholder Liaison local contacts") and report to the state tax agency.

9.4 Report to the FTC (§314.4(j)). If unencrypted customer information of 500 or more consumers is acquired without authorisation, notify the FTC through its online form as soon as possible and no later than 30 days after discovery. Unauthorised access is presumed to be acquisition unless shown otherwise.

9.5 Other notices. Follow the breach-notification law of each state where affected clients live (every state has one), notify law enforcement as appropriate, and notify clients as required. Speak with a lawyer about notification duties.

9.6 Continuity. Work continues on a clean device from cloud systems and restored backups.

9.7 After the incident. Within 30 days, record what happened and what changed (Attachment D) and update this plan.

10. Monitoring, review and updates (§314.4(d), (g))

10.1 The Qualified Individual reviews this plan at least once a year, each October before PTIN renewal, and after any material change or incident.

10.2 Because the Firm holds information on fewer than 5,000 consumers, §314.4(d)(2) testing is not required. The Firm still checks MFA coverage and runs a basic vulnerability scan of its devices each October.

10.3 Each review is recorded in Attachment F.

11. Plan approval

Approved by: Dana Ellis, EA, Owner. Qualified Individual: Dana Ellis.
Date: October 15, 2026    Signature: ______________________

Attachment A: Rules of behaviour

1. Use only approved devices for client data.
2. Never email or text Social Security numbers, bank details or returns in plain form.
3. Lock your screen whenever you step away.
4. Do not install software without the owner's approval.
5. Report lost devices and suspicious emails to the owner immediately.
6. No client data on USB drives or personal cloud accounts.
7. Paper with client data goes into locked storage or the shredder, never the recycling bin.
8. Confirm unusual requests by phone (Section 7.3).

Attachment B: Acknowledgement

I have received and read the Juniper Tax Services LLC (sample) Written Information Security Plan and agree to follow it.

Name: ____________________ Signature: ____________________ Date: __________

Attachment C: Incident report form

Date and time discovered: ______ Discovered by: ______
What happened: ________________________________
Systems and information involved: ________________
Estimated number of clients affected: ______ Was the information encrypted? Yes / No
Actions taken: ________________________________
IRS Stakeholder Liaison contacted (date): ______ State agency (date): ______
FTC notice needed (500 or more)? Yes / No. Filed (date): ______ Clients notified (date): ______

Attachment D: Post-incident review

Root cause: ______________ Changes made: ______________ Plan sections updated: ______________ Reviewed by and date: ______________

Attachment E: Safeguards Rule map

Attachment F: Review and activity log

Attachment G: 30-day action list

Your answers showed these items still to do. Complete them within 30 days and tick them off:

• ☐ Turn on multi-factor authentication for: Website/domain registrar. Use an authenticator app rather than text messages where the service allows it.
• ☐ Test a restore from backup and record the date in Attachment F; repeat every quarter.

Built on: FTC Safeguards Rule, 16 CFR Part 314; IRS Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice; IRS Publication 4557, Safeguarding Taxpayer Data; NIST Small Business Information Security: The Fundamentals.