A few years ago on The TaxBook forum, someone posted the following (https://forum.thetaxbook.com/forum/discussion-forums/main-forum-tax-discussion/298864-written-data-security-plan-for-tax-preparers#post299231):
Given how we are repeatedly reminded how important it is to have a written plan sitting on the shelf, it's odd that no one wants to actually provide a template of any kind. The closest I've seen is Tax Tip 2019-119 from the IRS, issued Aug 29 2019. So, using the available guidance in that tax tip, here is my written plan. Note that the law doesn't say it has to be very good, just that I have to have one. So, done.
* Include the name of all information security program managers.
Me.
* Identify all risks to customer information.
Fire, theft, flood, earthquake, government seizure of property, software malfunction, mis-addressed or mis-delivered communications. No risk from employees because I have none.
* Evaluate risks and current safety measures.
Yes, they are all risks. Current safety measures include physical locks, a dog on the premises, up to date professional computer software with all vendor supplied security patches applied within one week of release, and encryption of customer data in digital form.
* Design a program to protect data.
Immediately scan client paper documents into secure encrypted digital storage, then return or shred the paper. Use unique passwords for each login requiring a password. Do not share passwords. Use MFA for tax software access.
* Put the data protection program in place.
Yes.
* Regularly monitor and test the program.
Take this plan off the shelf once per year and read it. Test: get a colleague to come over and promise to buy them a meal if they access customer information in my tax office without my help, within 30 minutes.