Written Information Security Program (WISP) template
A WISP is the written information security program the FTC Safeguards Rule requires of financial institutions under its jurisdiction: who runs security, how risks are assessed and which safeguards protect customer information. This free template follows the rule element by element, for firms with several offices, systems and service providers to account for.
Get the WISP template
A fill-in PDF structured on 16 CFR 314.4, with your organization's name on the cover. We email it to you and you can download it straight away.
- 10 sections, one per element of the rule, from the Qualified Individual to the FTC breach notice
- Fill-in tables for owner, systems, frequency and evidence location
- Example entries clearly marked as examples
- Version and approval table, key terms and a review calendar
A template, not legal advice. Whether the rule applies to you, and whether your program meets it, is for your organization and its counsel.
Ten sections, one per element of the rule
- 01
Qualified Individual (314.4(a))
Name the one person responsible for overseeing, implementing and enforcing this program. If that person works for a service provider or an affiliate, record who in your organization directs and oversees them.
- 02
Written risk assessment (314.4(b))
Base the whole program on a written assessment of the reasonably foreseeable internal and external risks to customer information, and of whether the safeguards already in place control them.
- 03
Safeguards (314.4(c))
Design and implement safeguards to control the risks the risk assessment identifies. For each of the eight safeguards the rule names, record who owns it, what it covers, how often it is checked and where the evidence is kept.
- 04
Testing and monitoring (314.4(d))
Regularly test or otherwise monitor whether the key controls, systems and procedures work, including those that detect actual and attempted attacks. Record which route you take for your information systems and why.
- 05
Personnel and training (314.4(e))
Make sure your people can carry out the program: security awareness training for everyone, and enough qualified security staff, internal or external, to manage the risks.
- 06
Service provider oversight (314.4(f))
Choose service providers that can protect the customer information they handle, require it of them by contract, and keep checking based on the risk each one presents.
- 07
Keeping the program current (314.4(g))
Evaluate and adjust the program whenever testing results, changes to the business or a new risk assessment call for it, and keep a record of each change.
- 08
Incident response plan (314.4(h))
Keep a written plan to respond promptly to, and recover from, any security event that materially affects the confidentiality, integrity or availability of customer information in your control.
- 09
Annual report to the board (314.4(i))
The Qualified Individual reports in writing, regularly and at least once a year, to the board of directors or equivalent governing body, or to a senior officer responsible for the program if there is no such body.
- 10
FTC notification (314.4(j))
If a notification event involves the information of at least 500 consumers, notify the FTC as soon as possible and no later than 30 days after discovery. Decide in advance who makes the call and who files.
What a WISP is, and who needs one
A written information security program, or WISP, is the document that sets out how an organization protects customer information: who is responsible, how risks are assessed, which safeguards are in place, how they are tested and what happens after an incident. The FTC Safeguards Rule (16 CFR Part 314) requires covered financial institutions to keep one, written in one or more readily accessible parts, with safeguards appropriate to their size and complexity, the nature and scope of their activities and the sensitivity of the information they hold.
The rule applies to financial institutions under the FTC's jurisdiction, and the group is wider than many firms expect. The rule's own examples include accountants and other tax preparation services that complete income tax returns, mortgage brokers, real estate settlement services, check cashers, businesses that regularly wire money for consumers and automobile dealerships that lease vehicles for longer than 90 days. The FTC's guide adds mortgage lenders, payday lenders, finance companies, collection agencies, credit counselors and investment advisors not required to register with the SEC. Coverage depends on the services you provide, so confirm it with counsel.
For an organization that already runs MFA, encryption and monitoring, the gap is often the written program that ties those safeguards to the rule and names who owns each one. The template covers every element of 314.4, from the Qualified Individual to the annual report to the board and the FTC notice for notification events involving 500 or more consumers. If you want help running the safeguards and keeping the evidence current, see our FTC Safeguards Rule compliance support, our IT compliance program and managed IT for accounting firms.
References
Standards referenced
About the WISP Template
What is a WISP?
A written information security program (WISP) is the document that sets out how an organization protects customer information. Under the FTC Safeguards Rule it must be written, include each element in 16 CFR 314.4 and contain administrative, technical and physical safeguards appropriate to the organization's size, complexity, activities and the sensitivity of the information.
Does the FTC Safeguards Rule require a WISP?
It requires a comprehensive information security program written in one or more readily accessible parts (16 CFR 314.3(a)). The rule itself does not use the term WISP; that is the name most firms and advisors give the written program. Either way, it must cover every element in 314.4, from the Qualified Individual to the report to the board.
Who needs a WISP under the Safeguards Rule?
Financial institutions under the FTC's jurisdiction. The rule and the FTC's guide name, among others, accountants and tax preparation firms that complete income tax returns, mortgage lenders and brokers, finance companies, collection agencies, investment advisors not required to register with the SEC and automobile dealerships that lease vehicles for longer than 90 days. Confirm coverage with counsel.
What if we hold information on fewer than 5,000 consumers?
Section 314.6 exempts institutions that maintain customer information concerning fewer than 5,000 consumers from four requirements: the written risk assessment, the continuous monitoring or penetration testing requirement, the written incident response plan and the annual written report to the board. Everything else still applies, including the FTC notice for notification events. The template marks the exempt sections.
Is filling in the template enough to comply?
No template can be. It gives you the structure the rule asks for, but compliance depends on the safeguards actually running, the risk assessment reflecting your real systems and the evidence being kept. Whether the rule applies and whether your program meets it is for your organization and its counsel. Atlas helps with readiness; it does not certify compliance.
What do you do with my details?
We use your name and company to personalize the cover and build the PDF, and we store them with the request so we can send it. The only email you get is the copy of your template, unless you ask us to review your completed program, in which case we reply to that request.
Want help putting
the program in place?
Tell us what you found and we'll tell you what we'd fix first. No obligation.