About 10 minutes · no client data

1. Your practice

This goes on the cover and in the responsibilities section.

Your credential
Where do you work?

2. Size

How many people, including you, can access client data?
Do you have seasonal staff?
Roughly how many people's information do you keep, counting prior years?
Do you hold an EFIN and e-file?

3. Systems

Tax software (tick all you use)
Email
How do clients send you documents?
Other systems that hold client data
Devices used for client work
Who owns those devices?

4. Safeguards you have today

Be honest: anything missing goes on your 30-day action list, not into the plan as if it were done.

Multi-factor authentication is on for:
Full-disk encryption on every computer?
Do you use a password manager?
Backups of client data
Last time you tested restoring from backup
Antivirus and automatic updates on every device?

5. Paper and people

Do you keep paper with client information?
How is it stored?
How is it destroyed?
Do staff sign a confidentiality agreement?
Background checks before access?
Do you remove access the day someone leaves?
Security training in the last 12 months?

6. Help and responsibility

Who helps with IT?

Your plan appears the moment payment completes.