# Written Information Security Plan for Bookkeepers

- Author: AutoBankConvert (https://www.autobankconvert.com)
- Published: 2026-05-19
- Updated: 2026-05-19
- Category: Security and trust
- Canonical: https://www.autobankconvert.com/blog/written-information-security-plan-for-bookkeepers

> A written information security plan for bookkeepers: the sections it needs, who owns each control, and a short template a small practice can finish in a day.
A written information security plan for bookkeepers is a short document that says what client information the practice holds, what could expose it, which safeguards are in place and who is responsible for each one. A sole practitioner can draft one in a day. It should then be reviewed at least once a year.

## Does a bookkeeping practice need a written information security plan?

Many bookkeeping practices are expected to have one, and every practice benefits from one. The IRS guide for tax and accounting firms says that under the Safeguards Rule those professionals count as financial institutions regardless of size. Whether your own practice is covered depends on the services you offer.

The rule in question is the FTC's Safeguards Rule, made under the Gramm-Leach-Bliley Act. The [FTC's guide to the Safeguards Rule](https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know) says coverage turns on what a business does, not what it calls itself, and it lists tax preparers among its examples. IRS Publication 5708, [Creating a Written Information Security Plan for your Tax & Accounting Practice](https://www.irs.gov/pub/irs-pdf/p5708.pdf), states that a written plan is one of the rule's requirements and that it "must be written and accessible."

A bookkeeper who also prepares returns is plainly in that group. A bookkeeper who only keeps books should check their position with an adviser, and the separate post on [whether the FTC Safeguards Rule applies to bookkeepers](/blog/ftc-safeguards-rule-for-bookkeepers) walks through that question. Either way, the plan is worth writing. It is the document you hand a client who asks how their statements are protected, and the one an insurer or a new hire will ask to read.

## Sections of a bookkeeping security plan and the owner of each

A workable plan has seven parts: scope, a responsible person, a risk assessment, an inventory of devices and data, the safeguards in place, an incident procedure and a review date. Each part needs one named owner. In a one-person practice that is the same name seven times, and that is fine.

Publication 5708 gives an outline in the same spirit: define objectives and scope, designate a qualified individual, assess risks, inventory hardware, document safety measures, draft an implementation clause, and add attachments. The table below maps that outline onto a bookkeeping practice. The owners shown are an example for a three-person firm.

| Section | What it says for a bookkeeper | Example owner |
| --- | --- | --- |
| Scope | Which client data the plan covers: statements, ledgers, payroll files, tax documents, logins | Practice owner |
| Responsible person | The one person who coordinates security and reports on it | Practice owner |
| Risk assessment | What could expose client data and how likely it is | Practice owner with senior bookkeeper |
| Inventory | Every laptop, phone, drive and cloud service that holds client data, and where it is | Office manager |
| Safeguards | Passwords, multi-factor sign-in, encryption, access per client, sharing rules | Senior bookkeeper |
| Incident procedure | Who to call, what to shut off, who tells clients | Practice owner |
| Review | Date of last review and next review | Practice owner |

Keep the owners column honest. A safeguard with no named owner is a wish, and the first time it fails nobody will know it was theirs to check.

## Writing the client data risk assessment for the plan

The risk assessment is a list of the ways client data could be lost, stolen or exposed, each with a rough likelihood and the safeguard that answers it. For a bookkeeping practice the list is short and specific. It does not need a consultant or a scoring model to be useful.

Start from how client information moves through the practice. A bank statement arrives from a client, is stored, is converted and categorized, is posted to the books, and is eventually deleted. Every handoff is a place it can leak. A practical list for a small practice looks like this:

- **Email.** Statements arrive as attachments and sit in inboxes for years. The guide to [encrypted email for bookkeepers sending statements](/blog/encrypted-email-for-bookkeepers) covers the options when email cannot be avoided.
- **Stolen or lost laptop.** A device with an unencrypted drive and saved passwords exposes every client at once.
- **Phished login.** A fake sign-in page captures the password to the accounting software or a cloud folder.
- **Former staff.** A person who left still has working access to client files.
- **Unvetted tools.** A staff member pastes a statement into a free website to convert it.
- **Paper.** Printed statements left on a desk or put in household recycling.

For each line, write one sentence on likelihood (low, medium or high is enough) and one on the safeguard. The aim is a page you can read in five minutes, not a spreadsheet nobody opens. The FTC guide asks covered businesses to keep written criteria for judging risks and to reassess periodically, so date the page.

## A one-day security plan template for a small bookkeeping practice

A small practice can finish a first plan in one working day by filling in the sections in a fixed order: scope and owner in the morning, inventory and risks before lunch, safeguards and incidents in the afternoon. The entries below are examples. Replace each with the facts of your own practice.

1. **Scope (30 minutes).** Example: "This plan covers client bank and card statements, general ledgers, payroll reports, tax documents and client login details held by Example Books LLC."
2. **Responsible person (10 minutes).** Example: "Jane Doe, owner, coordinates this plan and reviews it each January."
3. **Inventory (60 minutes).** List each device and service with its location and the data it holds. Example: "Laptop 1, Dell, owner's home office, encrypted drive, all client files."
4. **Risks (60 minutes).** Use the list from the risk assessment section and add anything particular to you.
5. **Safeguards (90 minutes).** Write one line per safeguard. Example: "Multi-factor sign-in on email, accounting software and cloud storage. Each staff member has a named login. Client statements are uploaded through a vendor portal, never emailed between staff."
6. **Vendors (30 minutes).** List each tool that stores client data and what you checked about it.
7. **Incident procedure (45 minutes).** Who disconnects what, who calls the insurer, who writes to clients, and where the client contact list lives offline.
8. **Staff acknowledgement (15 minutes).** A line each person signs and dates to confirm they read the plan. Publication 5708 suggests keeping these signed acknowledgements on file.
9. **Review date (5 minutes).** Put next year's review in your calendar now.

Save the finished plan as a PDF or Word file, and keep a copy away from the office. The IRS guide suggests storing a copy offsite or in the cloud in case of a physical disaster.

## Vendors and software named in the security plan

Every service that stores or processes client data belongs in the plan by name: email, cloud storage, accounting software, payroll tools, password manager and any statement converter. For each one, record what it holds, who in the practice can sign in, and what the vendor says about protecting it.

The FTC guide is direct on this point. Covered businesses must choose providers that can protect customer information, spell out security expectations in contracts, and keep an eye on them. For a small practice, "contract" usually means the vendor's terms, so read the security and data-use sections before you upload anything real.

Three questions per vendor are enough for a first plan:

- Is client data encrypted in transit and at rest?
- Who at the vendor can see client files, and is any of it used to train models or shared?
- How long are files kept, and can you delete them?

The post on [uploading client bank statements securely](/blog/upload-client-bank-statements-securely) has a fuller vendor question list. As an example of a recorded answer: AutoBankConvert's homepage states that files are encrypted in transit and at rest and that you choose how long originals are kept after export. Copy a vendor's statement into the plan in their words, with the date you read it.

Clients have a say in which tools see their data too. If your engagement letter does not yet mention outside software, the guide to [getting client consent for bookkeeping software](/blog/client-consent-for-bookkeeping-software) shows how to add it.

## Why do bookkeeping security plans go stale after the first year?

Most plans fail the same way: written once, filed, and never opened again. Within a year the inventory lists a laptop that was sold, the owner column names someone who left, and the vendor list misses the two tools added since. A stale plan can be worse than none, because it gives false comfort.

The warning signs are easy to spot if you look:

- The "last reviewed" date is more than twelve months old.
- A device or tool used every day is not in the inventory.
- A named owner no longer works at the practice.
- Nobody on staff remembers signing the acknowledgement.
- The incident procedure lists a phone number nobody answers.

Publication 5708 calls the plan an evergreen document to be reviewed, tested and updated as the business changes, and its sample template asks for a review at least annually. The fix is a fixed review date plus a few triggers that force an earlier one, which the next section covers.

## Updating the security plan when bookkeeping services change

The plan should change whenever the practice changes in a way that touches client data: a new service, a new tool, a new hire or departure, a new office, or an incident. Annual review catches drift, but these events should trigger an update within the week they happen.

New services are the trigger most often missed. A practice that adds payroll now holds Social Security numbers. One that starts doing catch-up work for a lender's deadline suddenly holds years of statements at once. Extra work agreed informally rarely makes it into the plan, which is one more cost of the creep described in [spotting and pricing scope creep in bookkeeping](/blog/scope-creep-in-bookkeeping).

Keep a short change log at the end of the plan. Example entries:

- "2026-04-02: Added payroll for two clients. Payroll provider added to vendors. Social Security numbers added to scope."
- "2026-06-15: Staff member left. Logins removed same day. Owner column updated."

A plan that changes alongside the practice is one you can hand to a client with confidence. If you are moving statement handling off email as part of the update, you can [request early access to AutoBankConvert](/get-started) and record its stated safeguards in your vendor section.