2.3 – Designating Your Information Security Coordinator-remove this

Lesson at a Glance

Every compliant WISP must name a specific individual as the Information Security Coordinator — the person accountable for implementing, maintaining, and updating the plan. The FTC Safeguards Rule uses the term “Qualified Individual” and requires that this person oversee the information security program. For a solo preparer, this is straightforward. For a multi-person office, choosing and empowering the right coordinator — and documenting their responsibilities clearly — is one of the most important structural decisions you will make in building your WISP. This role is not honorary; it carries real obligations and real accountability.

Learning Objectives

After completing this lesson you will be able to:

  • Explain why naming a specific coordinator is a required WISP element.
  • Describe the core responsibilities of the Information Security Coordinator.
  • Apply the criteria for selecting the right person in a multi-employee practice.
  • Write the coordinator designation language for your own WISP.

Why a Named Individual Is Required

The FTC's reasoning is straightforward: security programs that belong to "everyone" belong to no one. When responsibility is diffuse, critical tasks — annual reviews, breach notifications, employee training — fall through the cracks. A named coordinator creates accountability. If a breach occurs and a regulator asks who was responsible for the security program, the answer cannot be "we all were." There must be a name.

The FTC 2023 Safeguards Rule update strengthened this requirement by specifying that the Qualified Individual must report regularly to the firm's governing authority — for a small practice, that means the owner — about the status of the security program. This reporting requirement is a new addition that many existing WISPs do not yet address.

Core Responsibilities of the Coordinator

Responsibility

What It Means in Practice

Implement the WISP

Ensure that every policy in the written plan is actually in place and functioning — not just written down

Train staff

Conduct or arrange security awareness training for all employees who handle client data, at least annually

Monitor for threats

Stay current on IRS Security Summit alerts, software vendor security notices, and FTC guidance

Manage vendor relationships

Verify that vendors with access to client data maintain adequate security practices

Lead breach response

Serve as the primary point of contact if a breach is detected — coordinate internal response, IRS notification, and client notification

Annual review and update

Review the WISP each year and update it to reflect changes in the practice, new threats, and new regulatory guidance

Report to firm leadership

Provide the firm owner or governing authority with a regular status update on the security program (required under updated Safeguards Rule)

Who Should Be the Coordinator?

For a solo preparer, the answer is simple — you are the coordinator. For a practice with multiple staff members, the coordinator should meet these criteria:

  • Authority: The person must be able to enforce policies, require compliance from other staff, and make purchasing decisions related to security tools — without needing approval for every small action.
  • Availability: The coordinator must be reachable and able to act quickly in the event of a breach — including during filing season.
  • Knowledge: The coordinator does not need to be a cybersecurity expert. They need to understand the firm's data flows, be willing to learn, and be able to communicate clearly with staff and vendors.
  • Continuity: Avoid designating a role that turns over frequently, such as a seasonal preparer or a part-time employee. The coordinator should be a consistent presence in the practice.

Your risk assessment must be updated when your practice changes.

Adding a new employee, switching tax software platforms, moving to a cloud-based workflow, or opening a second office location all create new risks that must be assessed and addressed. The FTC requires re-assessment whenever there is a "material change" to your operations. Build this review into your annual WISP update — and document it every time.

Language for Your WISP

Your WISP should include a coordinator designation section that clearly states:

  • The full name and title of the designated coordinator
  • Their contact information (for breach notification purposes)
  • A summary of their responsibilities under the plan
  • The name of a backup coordinator (strongly recommended for multi-person practices)
  • The date the designation was made

Sample WISP Language — Coordinator Designation

"The Information Security Coordinator for [Firm Name] is [Full Name], [Title], reachable at [phone/email]. This individual is responsible for implementing, maintaining, and annually reviewing this Written Information Security Plan; conducting or arranging annual security training for all staff; serving as the primary point of contact for any suspected or confirmed data breach; and reporting the status of the information security program to the firm owner no less than annually. In the absence of the primary coordinator, [Backup Name], [Title], will assume these responsibilities. This designation was last reviewed and confirmed on [Date]."

Practitioner Tips

  • Update the coordinator designation every year as part of your annual WISP review — even if the same person remains in the role. An undated designation raises questions about whether the plan has been actively maintained.
  • Brief your coordinator on the breach response plan specifically. The coordinator's most time-sensitive obligation is breach notification — and that process must be understood before a breach occurs, not discovered during one.
  • For solo preparers: Consider naming a trusted colleague or your professional association as an emergency contact in the event you are incapacitated during a breach. The IRS needs to be notified within 24 hours — plan for the possibility that you cannot make that call yourself.