Get Wisp Template

A: Three types of security policies in common use are program policies, issue-specific policies, and system-specific policies. Program policies are the highest-level and generally set the tone of the entire information security program. Issue-specific policies deal with a specific issues like email privacy.

A security policy is a document that states in writing how a company plans to protect its physical and information technology (IT) assets. Security policies are living documents that are continuously updated and changing as technologies, vulnerabilities and security requirements change.

A Written Information Security Plan, or WISP, is a document that details your organization's security controls, procedures, and policies. It also explains how confidential data is protected within the organization and who safeguards all that information.

A Written Information Security Policy (WISP) is a documented statement of rules and guidelines that need to be followed by people accessing company data, assets, systems, and other IT resources.

A Written Information Security Program (WISP) documents the measures that a business or organization takes to protect the security, confidentiality, integrity, and availability of the personal information and other sensitive information it collects, creates, uses, and maintains.

Whether a particular organization is required to have a WISP will depend on the nature and scope of the organization's collection, use and storage of protected information – what type of protected information is being collected and how it is being used.

However, there are three key areas each WISP should include: Employee management and training. Information systems and technology. Detecting and managing system failures.

Not only is a WISP essential for your business and a good business practice, the law requires you to have one. For many tax professionals, knowing where to start when developing a WISP is difficult.