Cedar Hollow Tax Services

The institution maintains an accessible written information security program scaled to its circumstances and covering the required elements.

Federal Trade Commission · official source

One or more required control concepts, scope details or contractual duties are missing from this passage; overlapping words alone cannot earn a strong label. Automated text screen found only a partial match (75.0% of wording concepts or weighted terms). Review the cited passage against the full requirement; weighted term overlap is not a measure of implementation.

“Where a service provider performs the control, the provider's attestation and the contract clause reference are attached. The reviewer noted that the procedure in this WISP was followed as written and did not require an update this period.”

Suggested fix: Create or consolidate an approved written information security program, define its scope, and cross-reference every applicable § 314.4 element.

The program is risk-based, identifies foreseeable internal and external risks, and evaluates safeguard sufficiency.

Federal Trade Commission · official source

Coverage is below the strong-match threshold. Automated text screen found only a partial match (52.8% of wording concepts or weighted terms). Review the cited passage against the full requirement; weighted term overlap is not a measure of implementation.

“4. Risk assessment SOP Each January, the Security Lead documents reasonably foreseeable internal and external risks, assesses likelihood and impact, identifies controls, and records residual risk in the risk register.”

Suggested fix: Document the risk basis for the program, the relevant risk categories, and safeguard-sufficiency review.

MFA protects every individual's access to information systems unless a written, equivalent-control exception is approved.

Federal Trade Commission · official source

One or more required control concepts, scope details or contractual duties are missing from this passage; overlapping words alone cannot earn a strong label. Automated text screen found only a partial match (65.2% of wording concepts or weighted terms). Review the cited passage against the full requirement; weighted term overlap is not a measure of implementation.

“• Evidence item 6: result carried forward to the annual written report to the Managing Partners. Reviewer notes MFA enrollment was confirmed for every account in scope, including administrator and service accounts with interactive access. The reviewer sampled five records from the period and traced each one to the supporting ticket or log entry without exception. Change tickets affecting this control were reviewed to confirm that the system owner approved the change before implementation.”

Suggested fix: Expand MFA coverage to all individuals and document any equivalent-control approval in writing.

The program is evaluated and adjusted after testing, risk assessment, material change, or other material circumstances.

Federal Trade Commission · official source

Coverage is below the strong-match threshold. Automated text screen found only a partial match (51.5% of wording concepts or weighted terms). Review the cited passage against the full requirement; weighted term overlap is not a measure of implementation.

“WISP evaluation and adjustment Control area WISP evaluation and adjustment Requirement reference 16 CFR 314.4(g) Scope for this record Business email tenant Control owner Security Lead Frequency Annually and after material change Review period 2026-07 Evidence required Redlined WISP and approval minutes Status Operating as designed - evidence on file Procedure performed For the review period 2026-07, the Security Lead performed the wisp evaluation and adjustment control for the business email tenant in accordance with the Cedar Hollow WISP.”

Suggested fix: Add event-driven program evaluation, change approval, versioning, and follow-through requirements.

A written plan supports prompt response and recovery for material customer-information security events.

Federal Trade Commission · official source

Coverage is below the strong-match threshold. Automated text screen found only a partial match (50.3% of wording concepts or weighted terms). Review the cited passage against the full requirement; weighted term overlap is not a measure of implementation.

“Marketing website content that never receives customer information is out of scope but is still covered by change management. 2. Roles and responsibilities Role Responsibilities Security Lead (Qualified Individual) Owns the WISP, risk assessment, control testing, incident response coordination, vendor reviews, and the annual written report to the Managing Partners. Managing Partners Approve the WISP, risk exceptions, budget, and the annual report; receive escalations for material security events.”

Suggested fix: Create and approve a written incident response plan scoped to material customer-information events.

For a qualifying notification event, the institution can notify the FTC as soon as possible and within 30 days of discovery. This is an event-triggered duty; document coverage demonstrates readiness but does not prove compliance in an actual event.

Federal Trade Commission · official source

One or more required control concepts, scope details or contractual duties are missing from this passage; overlapping words alone cannot earn a strong label. Automated text screen found only a partial match (75.0% of wording concepts or weighted terms). Review the cited passage against the full requirement; weighted term overlap is not a measure of implementation.

“Legal counsel determines any applicable customer or regulator notice obligations, including whether an event involving unencrypted information of 500 or more consumers must be reported to the FTC no later than 30 days after discovery.”

Suggested fix: Add the threshold, discovery rule, owner, escalation, and 30-day FTC deadline to the response procedure.

The program expressly treats security and confidentiality of customer information as an objective.

Federal Trade Commission · official source

Coverage is below the strong-match threshold. Automated text screen found only a partial match (42.8% of wording concepts or weighted terms). Review the cited passage against the full requirement; weighted term overlap is not a measure of implementation.

“The program is designed to protect the security, confidentiality, and integrity of customer information, to protect against reasonably anticipated threats or hazards, and to protect against unauthorized access that could result in substantial harm or inconvenience to any customer.”

Suggested fix: Add security and confidentiality of customer information as an explicit program objective.

The written risk assessment defines how risks and threats are evaluated and categorized.

Federal Trade Commission · official source

Coverage is below the strong-match threshold. Automated text screen found only a partial match (40.0% of wording concepts or weighted terms). Review the cited passage against the full requirement; weighted term overlap is not a measure of implementation.

“• Step 2 - Identify threats: phishing, credential theft, ransomware, lost devices, insider misuse, vendor compromise, misdirected mail, and physical theft. • Step 3 - Rate likelihood and impact from 1 (low) to 5 (high) using the matrix in 4.2. • Step 4 - Record existing controls and evaluate whether they sufficiently address each risk.”

Suggested fix: Add repeatable likelihood, impact, and categorization criteria to the written risk assessment.

The written assessment defines how risks are mitigated or formally accepted and fed into the program.

Federal Trade Commission · official source

Coverage is below the strong-match threshold. Automated text screen found only a partial match (37.2% of wording concepts or weighted terms). Review the cited passage against the full requirement; weighted term overlap is not a measure of implementation.

“• Step 5 - Record residual risk, the treatment decision (mitigate, accept, transfer, avoid), owner, and target date.”

Suggested fix: Define risk mitigation, acceptance authority, documentation, and program-update requirements.

The institution identifies and manages relevant assets according to business importance and risk.

Federal Trade Commission · official source

Coverage is below the strong-match threshold. Automated text screen found only a partial match (34.3% of wording concepts or weighted terms). Review the cited passage against the full requirement; weighted term overlap is not a measure of implementation.

“Managing Partners approve any risk exception, with an owner and expiration date. 4.1 Procedure • Step 1 - Confirm the system and data inventory is current. • Step 2 - Identify threats: phishing, credential theft, ransomware, lost devices, insider misuse, vendor compromise, misdirected mail, and physical theft.”

Suggested fix: Document asset categories, ownership, inventory expectations, and risk-based prioritization.

Covered externally developed applications receive security evaluation, assessment, or testing.

Federal Trade Commission · official source

Coverage is below the strong-match threshold. Automated text screen found only a partial match (47.0% of wording concepts or weighted terms). Review the cited passage against the full requirement; weighted term overlap is not a measure of implementation.

“Marketing website content that never receives customer information is out of scope but is still covered by change management. 2. Roles and responsibilities Role Responsibilities Security Lead (Qualified Individual) Owns the WISP, risk assessment, control testing, incident response coordination, vendor reviews, and the annual written report to the Managing Partners.”

Suggested fix: Add risk-based security assessment and testing requirements for covered external applications.

Without effective continuous monitoring, penetration testing occurs annually with risk-based scope.

Federal Trade Commission · official source

Coverage is below the strong-match threshold. Automated text screen found only a partial match (49.8% of wording concepts or weighted terms). Review the cited passage against the full requirement; weighted term overlap is not a measure of implementation.

“Marketing website content that never receives customer information is out of scope but is still covered by change management. 2. Roles and responsibilities Role Responsibilities Security Lead (Qualified Individual) Owns the WISP, risk assessment, control testing, incident response coordination, vendor reviews, and the annual written report to the Managing Partners. Managing Partners Approve the WISP, risk exceptions, budget, and the annual report; receive escalations for material security events. Operations Manager Approves access requests based on job need; reports role changes within one business day; owns onboarding and offboarding checklists.”

Suggested fix: Set an annual risk-based penetration-testing requirement and remediation process.

Personnel receive security awareness training updated for identified risks.

Federal Trade Commission · official source

One or more required control concepts, scope details or contractual duties are missing from this passage; overlapping words alone cannot earn a strong label. Automated text screen found only a partial match (75.0% of wording concepts or weighted terms). Review the cited passage against the full requirement; weighted term overlap is not a measure of implementation.

“Activity Frequency Owner Evidence Security awareness training At hire and annually Security Lead Training completion log Phishing simulation Quarterly Security Lead Campaign results and coaching notes Vulnerability scan Monthly IT Administrator Scan report and remediation tickets Penetration test Annually Independent tester Test report and retest letter Security staff updates Ongoing Security Lead Continuing education records 10.”

Suggested fix: Define and maintain risk-informed security awareness training for all relevant personnel.

Security personnel receive role-appropriate updates and training for relevant risks.

Federal Trade Commission · official source

One or more required control concepts, scope details or contractual duties are missing from this passage; overlapping words alone cannot earn a strong label. Automated text screen found only a partial match (66.7% of wording concepts or weighted terms). Review the cited passage against the full requirement; weighted term overlap is not a measure of implementation.

“Activity Frequency Owner Evidence Security awareness training At hire and annually Security Lead Training completion log Phishing simulation Quarterly Security Lead Campaign results and coaching notes Vulnerability scan Monthly IT Administrator Scan report and remediation tickets Penetration test Annually Independent tester Test report and retest letter Security staff updates Ongoing Security Lead Continuing education records 10.”

Suggested fix: Establish continuing role-based training and security-update requirements for security personnel.

The institution verifies that key security personnel maintain current threat and countermeasure knowledge.

Federal Trade Commission · official source

Coverage is below the strong-match threshold. Automated text screen found only a partial match (51.4% of wording concepts or weighted terms). Review the cited passage against the full requirement; weighted term overlap is not a measure of implementation.

“Procurement Performs service provider due diligence before contract signature and keeps contract security clauses current. All staff Complete training, follow this WISP, protect credentials, and report suspected incidents immediately. 3. Information and system inventory The Security Lead maintains an inventory of data, personnel, devices, systems, and facilities that store or process customer information. Each inventory entry records the system owner, data types, location, hosting model, encryption status, MFA status, backup status, and the date it was last verified.”

Suggested fix: Document continuing-knowledge activities and periodic verification for key security personnel.

The plan defines internal response processes.

Federal Trade Commission · official source

Coverage is below the strong-match threshold. Automated text screen found only a partial match (43.6% of wording concepts or weighted terms). Review the cited passage against the full requirement; weighted term overlap is not a measure of implementation.

“Disposal evidence for this period includes the vendor certificate of destruction and the internal disposal log entry. Follow-up and escalation If this control fails or evidence is missing, the IT Administrator opens a remediation item within five business days, rates the gap using the scoring matrix in Section 4.2, and notifies the Security Lead. High or critical gaps affecting the managed it support provider (northpoint, fictional) are reported to the Managing Partners within 30 days, and any related security event is handled under the incident response SOP in Section 11.”

Suggested fix: Document detection, triage, containment, eradication, recovery, and lessons-learned processes.

The plan governs internal and external communications and sharing.

Federal Trade Commission · official source

Coverage is below the strong-match threshold. Automated text screen found only a partial match (33.7% of wording concepts or weighted terms). Review the cited passage against the full requirement; weighted term overlap is not a measure of implementation.

“Access to the evidence folder is limited to the Security Lead, the Managing Partners, and the external assessor when engaged. No shared accounts were identified; named accounts were confirmed against the current staff roster provided by the Operations Manager.”

Suggested fix: Define stakeholders, approval, channels, timing, and protected information sharing.

The plan is evaluated and revised after security events when necessary.

Federal Trade Commission · official source

One or more required control concepts, scope details or contractual duties are missing from this passage; overlapping words alone cannot earn a strong label. Automated text screen found only a partial match (66.7% of wording concepts or weighted terms). Review the cited passage against the full requirement; weighted term overlap is not a measure of implementation.

“Incident response plan Control area Incident response plan Requirement reference 16 CFR 314.4(h) Scope for this record Scanner and multifunction printers Control owner Security Lead Frequency Tested annually Review period 2026-02 Evidence required Plan, tabletop record, incident log Status Operating as designed - evidence on file Procedure performed For the review period 2026-02, the Security Lead performed the incident response plan control for the scanner and multifunction printers in accordance with the Cedar Hollow WISP.”

Suggested fix: Require a post-event review and controlled plan updates.

The written report covers overall program status and compliance with Part 314.

Federal Trade Commission · official source

Coverage is below the strong-match threshold. Automated text screen found only a partial match (45.2% of wording concepts or weighted terms). Review the cited passage against the full requirement; weighted term overlap is not a measure of implementation.

“14. Governance, annual report, and evidence The Security Lead gives the Managing Partners a written annual report covering risk assessment results, control testing, security events, vendor status, and recommended changes.”

Suggested fix: Add program-status and Part 314 compliance sections to the annual report template.

The written report addresses material program matters and recommendations for change.

Federal Trade Commission · official source

Coverage is below the strong-match threshold. Automated text screen found only a partial match (44.7% of wording concepts or weighted terms). Review the cited passage against the full requirement; weighted term overlap is not a measure of implementation.

“The Security Lead is designated as the Qualified Individual responsible for overseeing, implementing, and enforcing this information security program. The Security Lead maintains a system and data inventory and reviews this WISP every year and after material changes, such as a new office, a new tax software platform, a merger, or a security event. 1.1 Information in scope Information type Examples Formats Taxpayer identity data Names, SSNs, ITINs, dates of birth, identity document images Electronic, paper Tax return information Draft and filed returns, schedules, e-file acknowledgements Electronic, paper Financial account data Refund deposit account and routing numbers, payment records Electronic Client portal records Uploaded source documents, secure messages, signature records Electronic Engagement records Engagement letters, consent forms, preparer notes Electronic, paper 1.2 Systems and locations in scope • Main office and seasonal satellite office (fictional addresses on file with Operations).”

Suggested fix: Expand the annual report template to cover material risks, controls, providers, tests, events, responses, and recommendations.

The organization uses and monitors reasonable disposal measures for paper, electronic media, and transferred media containing consumer-report information.

Federal Trade Commission · official source

Coverage is below the strong-match threshold. Automated text screen found only a partial match (39.3% of wording concepts or weighted terms). Review the cited passage against the full requirement; weighted term overlap is not a measure of implementation.

“When retention expires, paper containing customer information is cross-cut shredded by an approved vendor; electronic copies are securely erased or destroyed.”

Suggested fix: Adopt a risk-based disposal policy and procedures that render covered information impracticable to read or reconstruct and monitor compliance.

When a disposal vendor is used, the organization performs due diligence, contracts for compliant disposal, and monitors performance. This paragraph is an illustrative safe practice, not an exclusive method.

Federal Trade Commission · official source

Coverage is below the strong-match threshold. Automated text screen found only a partial match (40.0% of wording concepts or weighted terms). Review the cited passage against the full requirement; weighted term overlap is not a measure of implementation.

“Records Manager Maintains the retention schedule, legal holds, disposal log, and vendor destruction certificates. Procurement Performs service provider due diligence before contract signature and keeps contract security clauses current.”

Suggested fix: Document vendor selection, contract controls, and monitoring for record-destruction providers.