Comparing approaches
A readiness score, or a documented program
Both get sold as WISP compliance. They answer different questions, and only one of them produces what the rules ask you to be able to show.
What each one actually produces
| At the end you have | A readiness score | A documented program |
|---|---|---|
| A list of your gaps | Yes | Yes |
| A written plan describing your firm | Not usually | Yes |
| A named responsible individual, required at 16 CFR 314.4(a) | Not usually | Documented |
| Dated evidence across the year | No | Twelve entries a year |
| The annual review completed and dated, 314.4(g) | No | Scheduled and recorded |
| Something to put in front of someone who asks | A score | The plan and the log behind it |
This compares two approaches, not two named products. Check any specific vendor's own documentation before relying on this.
Where the difference bites
The rule is written in the present tense
The FTC Safeguards Rule requires a firm to develop, implement and maintain a written information security program, at 16 CFR 314.4. Maintenance is not a one-off act. The programme has to be evaluated and adjusted in light of testing results and operational changes, at 314.4(g), and the Massachusetts standards require a review of the scope of security measures at least annually or whenever there is a material change in business practices, at 201 CMR 17.03(2)(i).
A score tells you where you stood on the day you took it. It is a genuinely useful starting point, which is why we give ours away free. What it does not do is produce the record those two provisions assume exists.
When a score on its own is enough
It is enough when
- You want to know how exposed you are before deciding anything
- You already maintain the plan and the log yourself
- You have an IT provider or attorney who produces the documentation for you
It is not enough when
- Nobody at the firm is actually keeping the record between tax seasons
- You sign Form W-12 line 11 each year and want that attestation to be true
- A client, an insurer or a referral partner asks to see the program
Questions
Is a readiness score worthless, then?
No. It is the cheapest way to find out where you stand, and ours costs nothing and needs no account. The point is narrower: a score is a measurement, and the rules ask for a maintained program. One does not substitute for the other.
Can I take the score and build the documentation myself?
Yes. IRS Publication 5708 sets out a seven-section template and Publication 4557 the practical checklist, and both are free. What you are buying from any vendor is the build and the upkeep, not access to the requirement.
What counts as dated evidence?
Change reviews, vendor decisions, training completions, access reconciliations and the annual review, each with a date and an author. The test a firm should apply is whether it could produce twelve months of those entries on request.
Does the small-firm exemption remove the need for any of this?
It removes four specific requirements for a firm holding information on fewer than 5,000 consumers, at 16 CFR 314.6: the written risk assessment, continuous monitoring or penetration testing, the written incident response plan, and the annual written report. Everything else still applies. The full list is here.