What a WISP is, and why it matters here

A Written Information Security Program (WISP) is a document that spells out how your firm protects information: who is responsible, how access works, how you train people, how you respond to an incident, and how you review the program over time.

How a WISP relates to SB 2610

SB 2610 never uses the word “WISP.” It requires a cybersecurity program with administrative, technical, and physical safeguards that conforms to a recognized framework and meets the statute’s design goals (Sec. 542.004).

In practice, a WISP is how most small professional firms document that program. If you ever need to show what was in place at the time of a breach, the WISP is the evidence.

Why tax and CPA firms care

Tax and bookkeeping practices hold sensitive client data, usually run on Microsoft 365, and already face related expectations: FTC Safeguards for some financial institutions, and IRS and Security Summit reminders about written plans.

A clear WISP helps you:

• show what you actually do, not just what you intend,
• scale controls to your size using SB 2610’s tiers, and
• answer insurers and clients without improvising.

This is general information, not a determination that your firm is covered by any particular federal rule.

How threep LLC helps

threep LLC in North Texas drafts WISPs and hardens Microsoft 365 for small Texas firms. The free starting point is the seat check: a short questionnaire about seats, MFA, admins, backups, and whether you already have a WISP. No tenant access. You get a one-page summary and, if you want it, a 30-minute call.

Independent guide by threep LLC. Not affiliated with the State of Texas or any government agency. Not legal advice. Statute: enrolled SB 2610.