Your WISP — built in, not bolted on
The FTC Safeguards Rule requires every accounting firm to maintain a Written Information Security Plan. Sextant generates it, tracks the annual review, and keeps the access log — so compliance is a living record, not a binder you update once and forget.
What the rule actually requires
The FTC Safeguards Rule (16 CFR Part 314) applies to any firm that handles nonpublic personal financial information — which means every tax and accounting practice. It requires a written security plan, a designated coordinator, a risk assessment, employee training, and an annual review. Violations can result in civil penalties and reputational damage. Most small firms are technically out of compliance because the plan they downloaded from a webinar has never been updated.
Written Information Security Plan (WISP)
A documented plan covering your firm's security policies, risk controls, and incident response procedures.
Designated coordinator
A named individual responsible for implementing and overseeing the security program.
Risk assessment
An annual evaluation of the risks to client data and the controls in place to address them.
Access controls
Role-based access so staff only see the client records they need. An audit log of every access event.
Annual review
The plan must be reviewed and updated at least once per year, with documentation of the review.
Incident response plan
A documented procedure for responding to a security breach, including client notification requirements.
How Sextant covers it
Generates your WISP
Sextant produces a firm-specific Written Information Security Plan based on your practice profile. It covers the required elements — risk assessment, access controls, incident response, and employee responsibilities — in plain language your team can actually follow.
Tracks the annual review
The platform flags your WISP review date 60 days in advance and again at 30 days. You review, update if needed, and sign off inside Sextant. The timestamp and reviewer are recorded automatically.
Keeps the access log
Every login, record view, document download, and export is written to an immutable audit log. If you're ever asked to demonstrate access controls, the log is there — searchable, exportable, and tamper-evident.
Stores your supporting documents
Upload your risk assessment, annual review report, and cyber liability insurance certificate once. Sextant tracks the expiration dates and nudges you before anything lapses.
Role-based access built in
Staff see only the clients and records assigned to them. Partners and admins have broader access. Every permission change is logged. The access control requirement is satisfied by the platform itself — no separate tool needed.
Single-tenant architecture
Your client data lives in a dedicated database — not shared with other firms. This satisfies the data isolation requirement and simplifies your risk assessment: you can document exactly where client data lives and who can reach it.
What Sextant doesn't do
Sextant is not a law firm and doesn't provide legal advice. The WISP it generates is a starting point — your firm's designated coordinator reviews it, adopts it, and signs it. It's your plan. We give you the structure, the reminders, and the record-keeping. You provide the judgment.
See the WISP module in a walkthrough
We'll show you the actual compliance checklist, the audit log, and the annual review workflow — running in a real firm's instance.