What a WISP is, and why it matters here
A Written Information Security Program (WISP) is a document that spells out how your firm protects information: who is responsible, how access works, how you train people, how you respond to an incident, and how you review the program over time.
How a WISP relates to SB 2610
SB 2610 never uses the word “WISP.” It requires a cybersecurity program with administrative, technical, and physical safeguards that conforms to a recognized framework and meets the statute’s design goals (Sec. 542.004).
In practice, a WISP is how most small professional firms document that program. If you ever need to show what was in place at the time of a breach, the WISP is the evidence.
Why tax and CPA firms care
Tax and bookkeeping practices hold sensitive client data, usually run on Microsoft 365, and already face related expectations: FTC Safeguards for some financial institutions, and IRS and Security Summit reminders about written plans.
A clear WISP helps you:
- show what you actually do, not just what you intend,
- scale controls to your size using SB 2610’s tiers, and
- answer insurers and clients without improvising.
This is general information, not a determination that your firm is covered by any particular federal rule.
How threep helps
threep in North Texas drafts WISPs and hardens Microsoft 365 for small Texas firms. The free starting point is the seat check: a short questionnaire about seats, MFA, admins, backups, and whether you already have a WISP. No tenant access. You get a one-page summary and, if you want it, a 30-minute call.
Have the documents? Now prove them.
SB 2610's safe harbor depends on showing you actually follow a recognized framework, not just that you have a policy. threep, our hosted app, checks your policies, procedures and evidence against framework controls (NIST, TX-RAMP, SOC 2, HIPAA, ISO 27001). It marks each control as STRONG, PARTIAL, GAP or NONE and names an owner for every gap. A person on your team approves every answer. Built for firms that get security questionnaires from clients. Early access.
threep does not certify compliance or give legal advice.
Independent guide by threep (threep.ai). Not affiliated with the State of Texas or any government agency. Not legal advice. Statute: enrolled SB 2610.