Transparent, Predictable Compliance for CPAs
Choose the exact level of protection your accounting firm needs. From solo practitioners needing an IRS-ready WISP to full-scale practices requiring staff training and simulated phishing defense.
Choose Your Compliance Level
All plans fulfill federal Written Information Security Plan documentation mandates.
WISP Essentials
Automated IRS Pub 4557 and FTC Safeguards compliance for single preparers.
- Automated WISP Generator (IRS & FTC)
- Incident Response & Vendor Logs
- Audit-Ready PDF Export & Vault
- DIY Implementation Guide (13 sections)
- 5 CPA-Specific Training Modules
- E-SIGN Compliance & Appendix C Log
- 10 Included Staff Seats (+$15/yr extra)
- Quarterly Phishing Campaigns
- External Perimeter Scan
Compliance Plus
Meets both WISP and mandatory FTC §314.4(e) staff security awareness training.
- Automated WISP Generator (IRS & FTC)
- Incident Response & Vendor Logs
- Audit-Ready PDF Export & Vault
- DIY Implementation Guide (13 sections)
- 5 CPA-Specific Training Modules
- E-SIGN Compliance & Appendix C Log
- 10 Included Staff Seats (+$15/yr extra)
- Quarterly Phishing Campaigns
- External Perimeter Scan
Full Shield & Managed Defense
Managed Security Service: our security engineering team manages the quarterly campaigns and delivers executive audit-ready compliance reports directly to the firm.
- Automated WISP Generator (IRS & FTC)
- Incident Response & Vendor Logs
- Audit-Ready PDF Export & Vault
- DIY Implementation Guide (13 sections)
- 5 CPA-Specific Training Modules
- E-SIGN Compliance & Appendix C Log
- 10 Included Staff Seats (+$15/yr extra)
- Managed Quarterly Phishing Campaigns
- Office Perimeter Scan (Included)
Interactive Firm Calculator & Add-Ons
Customize your firm's exact team size, office count, and security testing upgrades to see your exact annual cost.
1 Select Base Plan
2 Configure Firm Size
3 Optional Upgrades & Add-ons
Enhance your technical security controls and audit readiness.
A small device for your office network that checks the computers and devices inside it for known weaknesses. Not yet available to order.
Instant access to WISP Builder & Staff Training Portal upon checkout.
Compare Plan Capabilities
Review the detailed feature matrix across all tiers.
| Feature & Regulatory Coverage | Essentials $249/yr |
Compliance Plus $449/yr (Recommended) |
Full Shield $999/yr |
|---|---|---|---|
| 1. WISP & Compliance Documentation | |||
| 11-Domain WISP Document (IRS Pub 4557 & FTC §314) | ✓ | ✓ | ✓ |
| Dynamic Incident Response Plan (IRP) with 30-Day Notice | ✓ | ✓ | ✓ |
| Corrective Action Plan (CAP) for pending items | ✓ | ✓ | ✓ |
| Third-Party Cloud Vendor Inventory & Risk Assessment | ✓ | ✓ | ✓ |
| Audit-Ready PDF Export with IRS Checklist | ✓ | ✓ | ✓ |
| Cloud Vault & Annual Policy Expiration Alerts | ✓ | ✓ | ✓ |
| 2. FTC §314.4(e) Staff Security Awareness Training | |||
| Interactive Staff Training Portal | — | Included | Included |
| Staff Seats Included | 0 | 10 Seats | 10 Seats |
| Additional Staff Seats Cost | — | $15/user/yr | $15/user/yr |
| 5 CPA-Tailored Curriculum Modules (10 slides each + quizzes) | — | ✓ | ✓ |
| Password-Free 1-Click Employee Access Tokens | — | ✓ | ✓ |
| E-SIGN Act Digital Signatures & Training Records | — | ✓ | ✓ |
| Appendix C Training Log embedded directly in WISP PDF | — | ✓ Automatic | ✓ Automatic |
| 3. Cybersecurity Testing & Vulnerability Scans | |||
| Quarterly Simulated Phishing Campaigns (Managed Security Service) | — | — | ✓ Managed |
| Instant Teachable Landing Pages for Clicked Employees | — | — | ✓ |
| Executive Audit-Ready Phishing & Insurance Defense Reports | — | — | ✓ |
| Office Perimeter Scan (your office internet connection) | +$150/yr | +$150/yr | Included |
| Hardware Network Sensor (inside your office network) | Coming soon | Coming soon | Coming soon |
| 4. Compliance Advisory & Support | |||
| Support Level | Standard Email | Priority Email | Dedicated Specialist |
Frequently Asked Questions
Common questions about CPA compliance, tax deductions, and plan upgrades.
Does the Compliance Plus tier satisfy the FTC Safeguards Rule training mandate?
Yes. Under 16 CFR §314.4(e), financial institutions (which legally include all professional tax preparers and accountants) must provide security awareness training to all personnel. Compliance Plus provides 5 interactive modules covering the exact threats mandated by the FTC and IRS, logs digital signatures, and embeds Appendix C: Staff Training Log directly into your official WISP document.
Can our firm deduct this as a business expense?
Software and cybersecurity subscriptions used for business operations are generally deductible as ordinary and necessary business expenses. Your specific tax treatment depends on your firm, so please confirm it with your accountant or tax advisor.
How do employees access their training? Do they need logins?
Zero passwords required! When you add staff members to your firm roster, the platform generates a unique, secure employee access token. Staff members click the link in their email to immediately access their training portal, complete lessons, take quizzes, and sign their compliance acknowledgment.
What happens if our firm hires additional staff mid-year?
You can add extra staff seats anytime for just $15/user/year. The moment a new employee completes their training and signs their acknowledgment, your WISP's Appendix C automatically updates with their timestamped proof of completion.
Why do cyber insurance carriers require this documentation?
Insurance underwriters now routinely deny coverage following a ransomware or wire fraud claim if an accounting firm cannot produce a signed, timestamped WISP and annual staff training records. Having documented reports helps you answer underwriter questions and support your coverage.
Ready to Protect Your CPA Practice?
Join accounting firms that use CPA Security for straightforward WISP generation and staff training.