Managed IT ServicesAlmost every business runs on electronic information: client records, financial files, contracts, and the everyday data that keeps operations moving. Losing it, or having it stolen, can stop a business cold. A written information security plan spells out how you protect that data, and a business continuity plan spells out how you keep working when something goes wrong. You need both.
Cybercriminals don’t only go after large enterprises. They know smaller firms often run lean on security, and any data they can sell or ransom is worth their time. A written information security plan (WISP) and a business continuity plan (BCP) are the two documents that turn good intentions into a repeatable, provable process.
In this guide, we’ll explain what each plan is, who is legally required to have one, how they differ, and the seven steps eMDTec uses to build a written information security plan that holds up to an auditor, an insurance carrier, or a real attack.
What Is a Written Information Security Plan?
A written information security plan is a document that describes the administrative, technical, and physical safeguards your business uses to protect sensitive information. It names who is responsible for security, what data you hold, where it lives, who can access it, and how you’ll respond if it is exposed.
Think of it as the rulebook for your data. Firewalls, backups, and antivirus are the tools. The written information security plan explains which tools you use, why you chose them, and how you check that they’re working. Without it, security depends on whoever happens to be in the office that day.
A good WISP is specific to your business. A ten-person accounting firm and a forty-person medical practice will cover the same basic categories, but the risks, systems, and regulations behind them look very different.
What a WISP typically covers
- A named security coordinator (the FTC calls this the “Qualified Individual”) who owns the program.
- A data inventory listing the sensitive information you collect and where it is stored.
- A risk assessment that identifies threats to that data and how likely they are.
- Safeguards such as access controls, multi-factor authentication, encryption, and secure disposal.
- Employee training and an acceptable-use policy.
- Vendor oversight for any service provider that touches your data.
- An incident response plan with notification steps.
- A review schedule so the plan stays current.
WISP Requirements: Who Needs a Written Information Security Plan?
For many businesses, a written information security plan isn’t optional. It’s required by federal or state law, and regulators increasingly ask to see it.
Tax professionals and accounting firms
The FTC Safeguards Rule, which falls under the Gramm-Leach-Bliley Act, requires financial institutions to maintain a written information security program. The FTC defines “financial institution” broadly, and that definition includes tax preparers and many accounting firms. The IRS has repeatedly reminded tax professionals that they need a written information security plan and publishes a sample template in IRS Publication 5708. Tax pros also attest to having a data security plan when they renew their PTIN.
Other financial businesses
Mortgage brokers, auto dealers that offer financing, wealth managers, and other non-bank lenders fall under the same FTC Safeguards Rule. Since May 2024, covered businesses must also report breaches involving 500 or more consumers to the FTC within 30 days of discovery.
Healthcare practices
HIPAA requires covered entities and business associates to document their security policies and procedures and keep that documentation for six years. In practice, that documentation is a written information security plan, even if your practice calls it something else.
Businesses holding residents’ personal data
Some states require a WISP outright. Massachusetts, for example, requires any business that holds personal information about Massachusetts residents to maintain one, no matter where the business is located. New Jersey’s breach notification law and the New Jersey Data Privacy Act both expect businesses to use reasonable security practices, and a written plan is the clearest way to show you do.
If you’re unsure which rules apply, our guide to which NJ regulations apply to your business is a good place to start.
The Value of a Written Information Security Plan
Compliance is the reason many businesses start a WISP. The day-to-day value is what makes it worth maintaining.
- Fewer gaps. Writing down your safeguards forces you to notice what’s missing, such as a shared admin password or a former employee who still has email access.
- Consistent decisions. When a new hire starts or a laptop is lost, the plan tells your team exactly what to do.
- Lower breach costs. IBM’s Cost of a Data Breach Report puts the 2026 global average at $4.99 million per breach. Businesses with tested incident response plans consistently contain breaches faster and spend less.
- Easier insurance renewals. Cyber insurance applications ask about MFA, backups, training, and incident response. A current written information security plan gives you accurate answers.
- Proof for regulators and clients. When a client, auditor, or regulator asks how you protect their data, you can hand them a document instead of a promise.
What Is a Business Continuity Plan?
A business continuity plan is a strategy for keeping your organization running during and after an unexpected disruption. That could be a ransomware attack, a fire, a flood, a regional power outage, or a cloud provider going down for a day.
Downtime is expensive. Gartner’s often-cited estimate puts the average cost at $5,600 per minute, and the number climbs for firms that bill by the hour or can’t see patients. According to FEMA, roughly 40% of small businesses never reopen after a disaster, and many more close within a year. FEMA’s Ready Business program offers free planning resources for exactly this reason.
A BCP answers practical questions before you’re under pressure: Where will staff work? How do clients reach you? Which systems come back first? Who calls the insurance carrier? How long can you operate on paper?
The Value of a Business Continuity Plan
A well-built business continuity plan protects revenue, reputation, and people.
- Shorter outages. Clear recovery priorities and tested backups turn a week-long scramble into hours of planned work.
- Client confidence. Clients stay loyal to firms that keep answering the phone during a crisis.
- Protected jobs. Your employees keep working and getting paid instead of waiting for the doors to reopen.
- Regulatory coverage. HIPAA requires a contingency plan with data backup, disaster recovery, and emergency-mode operations. A BCP covers all three.
For a step-by-step look at outages specifically, see our IT outage checklist for business.
WISP vs. Business Continuity Plan: Similarities and Differences
Both plans protect your business and your data, so they’re easy to confuse. The simplest way to separate them: a written information security plan works to prevent incidents, while a business continuity plan helps you survive the ones you can’t prevent.
| Written Information Security Plan (WISP) | Business Continuity Plan (BCP) | |
|---|---|---|
| Main goal | Protect the confidentiality, integrity, and availability of sensitive data | Keep critical operations running during and after a disruption |
| Focus | Safeguards, access, policies, training | Recovery priorities, alternate work locations, communication |
| Typical triggers | Daily operations, new hires, vendor changes, audits | Ransomware, outages, natural disasters, loss of a key system |
| Who requires it | FTC Safeguards Rule, IRS, HIPAA documentation rules, some state laws | HIPAA contingency planning, cyber insurers, many client contracts |
| Key metrics | Risk ratings, training completion, access reviews | Recovery time and recovery point objectives |
The two overlap in important places. Your written information security plan should include an incident response section, and your business continuity plan should explain how you recover data and systems securely. Backups appear in both: the WISP covers how they’re protected, and the BCP covers how quickly you can restore them.
How to Build a Written Information Security Plan in 7 Steps
Here is the process eMDTec follows when we build a written information security plan with a client. You can use it to start your own or to check the one you already have.
1. Name your security coordinator
Pick one person who owns the written information security plan. In a small firm, this is often a partner or office manager working with an outside IT provider. The FTC allows you to use a service provider for this role, as long as someone at your business oversees them.
2. Inventory your data and systems
List the sensitive data you collect, such as Social Security numbers, tax returns, bank details, or patient records. Then list where it lives: servers, cloud apps, laptops, phones, email, and paper files. You can’t protect what you haven’t found.
3. Assess your risks
For each system, ask what could go wrong and how bad it would be. Common risks include phishing, weak passwords, unpatched software, lost devices, and vendors with too much access. A professional security risk assessment gives you an objective baseline.
4. Choose and document your safeguards
Match each risk to a control. Typical safeguards include multi-factor authentication on email and remote access, encryption on laptops, least-privilege access, endpoint protection, monitored backups, and secure disposal of old drives. Write down what you use and who maintains it.
5. Train your people
Most breaches start with a person, not a server. Include phishing awareness, password and MFA basics, and reporting procedures in your plan, and schedule refresher training at least once a year.
6. Plan your incident response
Document who to call, how to contain an incident, how to preserve evidence, and who must be notified. New Jersey businesses, for example, must notify the New Jersey State Police before notifying affected customers of a breach. Our guide on what to do after a cyberattack walks through the first 24 hours.
7. Test, review, and update
A written information security plan that sits in a drawer goes stale fast. Review it at least annually and any time you add a major system, change vendors, or have an incident. Covered financial businesses must also give a written report to their board or owners each year.
How the Two Plans Work Together During a Ransomware Attack
Here’s how the two documents play out in a real incident. An employee at a small professional services firm opens an invoice attachment on a Monday morning, and by lunch the file server is encrypted.
The written information security plan has already limited the damage. Because staff only have access to the folders they need, the ransomware can’t reach the partners’ or payroll shares. MFA on email stops the attacker from logging in to other mailboxes with stolen credentials. The incident response section tells the office manager to disconnect the affected machine, call the IT provider, and contact the cyber insurance carrier before paying anyone anything.
The business continuity plan takes over from there. Staff switch to cloud email and a shared client contact list kept outside the server. The IT provider restores the file server from an isolated backup taken the night before. Clients get a short, pre-written message explaining that service will resume that afternoon.
Without either plan, the same Monday turns into a week of guessing, lost billing, and uncomfortable calls. With both, it’s a bad day instead of a business-ending one.
Written Information Security Plan Examples by Industry
The structure of a WISP stays the same across industries, but the details change. Here’s what we emphasize for the types of clients we support most.
Accounting and tax firms
Tax season compresses risk into a few months. A written information security plan for an accounting firm should cover client portals, e-file credentials, seasonal staff onboarding and offboarding, and how paper source documents are stored and shredded. It should also address the FTC Safeguards Rule’s specific requirements, including MFA for anyone accessing client data and encryption in transit and at rest. Our team also supports firms through IT support for accounting firms.
Medical and dental practices
For healthcare, the WISP lines up with the HIPAA Security Rule’s administrative, physical, and technical safeguards. It should document your annual risk analysis, business associate agreements, EHR access controls, and how workstations in exam rooms are locked down. Our HIPAA compliance consulting team builds this documentation alongside the practice.
Law firms and professional services
Law firms hold privileged communications, and many clients now send security questionnaires before engaging outside counsel. A written information security plan should cover document management, secure file sharing with clients, remote access, and retention schedules that match your engagement letters.
Financial advisors and wealth managers
Advisors face both the FTC Safeguards Rule and SEC expectations around protecting client records. Their WISPs typically go deeper on vendor oversight for custodians and portfolio platforms, and on wire-fraud verification procedures.
Common Mistakes We See in WISPs
- Downloading a template and never customizing it. A generic plan that doesn’t match your systems won’t help in an audit or an incident.
- Listing tools you don’t actually use. If the plan says every laptop is encrypted, every laptop needs to be encrypted.
- Forgetting vendors. Your tax software, cloud backup, and IT provider all handle your data and belong in the plan.
- No owner. When everyone is responsible, no one updates the document.
- Treating the WISP and BCP as one file. They can reference each other, but each needs its own clear procedures.
Frequently Asked Questions
Is a written information security plan required by law?
For many businesses, yes. Tax preparers, accounting firms, and other financial businesses covered by the FTC Safeguards Rule must have one, and HIPAA requires documented security policies. Some states, such as Massachusetts, require a WISP for any business holding residents’ personal information.
How long should a WISP be?
Long enough to be specific. Small firms often land between 10 and 30 pages, including policies and appendices. Accuracy matters more than length.
How often should we update our written information security plan?
At least once a year, and whenever you change major systems, add a vendor, open a new office, or experience a security incident.
What’s the difference between a WISP and a business continuity plan?
A written information security plan focuses on preventing data from being lost, stolen, or exposed. A business continuity plan focuses on keeping operations running when a disruption happens anyway. Most businesses need both, and the two should reference each other, especially around backups and incident response.
Do we need a WISP if all our data is in the cloud?
Yes. Moving data to the cloud changes where it lives, not whether you’re responsible for it. Your plan should cover how cloud accounts are secured, who has admin rights, and how you’d get your data back if you left the provider.
Can our IT provider write our WISP for us?
Your IT provider can do most of the work, including the risk assessment, safeguards, and documentation. Someone at your business still needs to review it, approve it, and oversee the program.
eMDTec Can Help Secure Your Company’s Future
A written information security plan and a business continuity plan serve different purposes, but together they give you a strong foundation: one keeps attackers out, and the other keeps you running if something gets through.
eMDTec has helped New Jersey businesses protect their data since 2002. Our WISP compliance services include the risk assessment, a written information security plan customized to your systems, staff training, and annual reviews. When you’re ready for the continuity side, our disaster recovery services and managed IT services make sure your backups and recovery plan actually work when you need them.
Don’t wait for an audit, a renewal questionnaire, or an incident to find the gaps. Schedule a free consultation and we’ll review where your written information security plan stands today.