Bftcpa606 at 23:12, 18 August 2026

2026-08-18T23:12:49Z

← Older revision		Revision as of 23:12, 18 August 2026
Line 1:		Line 1:
			[[File:ATL271.jpg\|thumb\|ATL271: Why Your WISP Is Essential in 2026]]

	= ATL271 - Why Your WISP Is Essential in 2026 =		= ATL271 - Why Your WISP Is Essential in 2026 =

Bftcpa606: Created page with "= ATL271 - Why Your WISP Is Essential in 2026 = '''Accounting Technology Lab'''
'''Hosts:''' Randy Johnston and Brian F. Tankersley, CPA.CITP, CGMA
'''Presented by:''' CPA Practice Advisor
'''Episode length:''' Approximately 25 minutes == Episode Summary == In ATL271, “Why Your WISP Is Essential in 2026,” Randy Johnston and Brian Tankersley explain why a written information security plan is no longer a compliance document that can sit on a shelf...."

2026-08-18T23:11:10Z

Created page with "= ATL271 - Why Your WISP Is Essential in 2026 = '''Accounting Technology Lab''' '''Hosts:''' Randy Johnston and Brian F. Tankersley, CPA.CITP, CGMA '''Presented by:''' CPA Practice Advisor '''Episode length:''' Approximately 25 minutes == Episode Summary == In ATL271, “Why Your WISP Is Essential in 2026,” Randy Johnston and Brian Tankersley explain why a written information security plan is no longer a compliance document that can sit on a shelf...."

New page

= ATL271 - Why Your WISP Is Essential in 2026 =

'''Accounting Technology Lab''' 
'''Hosts:''' Randy Johnston and Brian F. Tankersley, CPA.CITP, CGMA 
'''Presented by:''' CPA Practice Advisor 
'''Episode length:''' Approximately 25 minutes

== Episode Summary ==

In ATL271, “Why Your WISP Is Essential in 2026,” Randy Johnston and Brian Tankersley explain why a written information security plan is no longer a compliance document that can sit on a shelf. Accounting firms hold concentrated stores of tax, financial, identity, and sometimes health information, making them attractive targets for phishing, credential theft, ransomware, fraudulent wire instructions, and AI-enhanced attacks. The hosts walk through the overlapping expectations of the IRS, FTC Safeguards Rule, and HIPAA, including written policies, multi-factor authentication, encryption, logging, incident response, training, governance, vendor oversight, and regular risk assessment. They emphasize that penalties can be severe, but the larger business risk may be client loss, reputational damage, litigation, and disruption during tax season. The episode also highlights practical governance: assign accountability, review the WISP regularly, connect security spending to risk, and report results to leadership. Randy and Brian close with five high-impact controls—MFA, full-disk encryption, tested backups, a written incident response plan, and vendor security questionnaires—plus a recurring calendar for log reviews, backup restores, phishing simulations, vulnerability scans, training, patching, and annual WISP updates. Their message: security is an operating discipline, not paperwork. For firms of every size, preparation now is cheaper than recovery.

== Key Takeaways ==

* '''A WISP should be an operating system for security—not shelfware.''' It needs ownership, periodic review, documented changes, and executive oversight.
* '''Accounting firms are unusually attractive targets''' because they aggregate tax, financial, identity, payroll, and other confidential information.
* '''Credential theft and phishing remain central risks,''' while AI is making fraudulent messages and attacks more convincing.
* '''Vendor management belongs inside the security program.''' Cloud applications, hosting companies, MSPs, AI services, and other third parties expand the firm's attack surface.
* '''Incident response must be planned before the incident.''' Firms should understand regulatory notification obligations, internal responsibilities, legal resources, and PR response.
* '''Security has a recurring calendar.''' Log reviews, backup restores, phishing tests, vulnerability scanning, access reviews, training, patching, and WISP updates need assigned frequencies and owners.

== Catchy Quotes ==

{| class="wikitable"
! Approx. Time
! Speaker
! Quote
|-
| 02:04
| Brian Tankersley
| “The firms get hit because you and I are the Fort Knox of confidential data.”
|-
| 03:33
| Brian Tankersley
| “The bad guys are getting better faster than the good guys are getting better.”
|-
| 07:40
| Brian Tankersley
| “Anything that touches client data is a death sentence for a hard drive in my office.”
|-
| 12:10
| Brian Tankersley
| “If you don't have an adequate WISP, you're in violation of the FTC safeguards rule.”
|-
| 18:20
| Randy Johnston
| “You've got risk on any provider.”
|-
| 18:42
| Brian Tankersley
| “As soon as you know something's happened, the clock is ticking.”
|-
| 23:11
| Brian Tankersley
| “Multi-factor authentication, full disk encryption, tested backup strategies, written incident response plans, vendor security questionnaires.”
|-
| 24:55
| Randy Johnston
| “Make sure that you've got your WISP … pulled out, dusted off, and updated for this year's regulations.”
|}

''Note: Timestamps are approximate where the quote occurs inside a longer timestamped speaker segment in the transcript.''

== Social Media Posts ==

# Your WISP isn't supposed to be the PDF nobody has opened since last year. In ATL271, Randy Johnston and Brian Tankersley explain why cybersecurity governance has become an operating requirement for accounting firms. #WISP #Cybersecurity #AccountingTechnology
# Accounting firms may not look like Fort Knox—but they often hold Fort Knox quantities of confidential data. Tax records. Payroll. Bank information. Identity data. That's exactly why attackers care. ATL271 tackles the risk. #CPA #Cybersecurity
# Phishing emails aren't getting worse. They're getting '''better'''—and AI is helping the bad guys improve faster. ATL271 looks at what CPA firms should be doing about it now. #AI #Phishing #InfoSec
# A written information security plan isn't just a compliance exercise. It's the playbook your firm needs when somebody clicks the wrong link at 4:45 Friday afternoon. Listen to ATL271. #WISP #IncidentResponse
# MFA. Encryption. Tested backups. Incident response. Vendor questionnaires. Five controls that can materially improve an accounting firm's security posture—and they're all discussed in ATL271. #Cybersecurity #CPAfirm
# Your firm's security perimeter doesn't stop at the office door. It includes every SaaS vendor, MSP, cloud provider, AI platform, remote employee, and third party touching client information. ATL271 digs into vendor risk. #VendorRisk #AccountingTech
# Buying a WISP template isn't the same thing as managing information security. Randy Johnston and Brian Tankersley explain why governance, accountability, testing, and periodic updates matter in ATL271. #Governance #WISP
# Who owns cybersecurity at your firm? Who approves changes? Who reviews the logs? Who reports problems to leadership? If the answer is “I'm not sure,” ATL271 belongs on your playlist. #CyberGovernance #CPA
# A backup isn't really a backup until you've restored it. ATL271 recommends making backup restoration testing part of your recurring security calendar. That's boring—right up until the day it saves the firm. #Backup #Ransomware
# Cybersecurity isn't an annual checkbox. Access logs, terminated users, phishing tests, vulnerability scans, MFA coverage, patching, training, and backups all operate on different schedules. ATL271 explains the cadence. #InfoSec
# The uncomfortable truth about a breach isn't just the remediation bill. It's clients asking, “Why should I still trust you?” ATL271 examines the compliance '''and reputational''' stakes of information security. #RiskManagement #CPAfirm
# What happens after an incident can be every bit as important as what happened before it. Legal counsel, regulatory notification, communications, documentation, and PR belong in the response plan. ATL271 explains why. #IncidentResponse
# The shiny new accounting app may solve a workflow problem—and create a vendor-risk problem. ATL271 makes the case for asking security questions before sensitive client data goes into somebody else's system. #AccountingTech #VendorManagement
# Your terminated employee shouldn't still be able to log in six months later. ATL271 recommends regularly confirming that departed users actually lost access. Simple control. Serious consequences if you skip it. #AccessControl #Cybersecurity
# Security awareness training on Day One isn't bureaucracy. It's part of onboarding someone who is about to receive access to some of your clients' most sensitive information. ATL271 explains the governance behind the practice. #SecurityAwareness
# Accounting firms have spent years adopting cloud systems. The next maturity step is managing the '''governance''' around those systems: access, logging, vendors, policies, responsibilities, and incident response. ATL271 tackles the issue. #CloudSecurity #CPA
# “We've never had a breach” is not a cybersecurity strategy. Neither is “our IT guy handles that.” ATL271 explains why firm leadership has a role in WISP governance and security oversight. #CyberRisk #Leadership
# AI is changing both sides of cybersecurity. Firms can use better tools—but attackers also get better tools. ATL271 looks at why yesterday's WISP may not adequately address today's threat environment. #AIsecurity #WISP
# Before you recycle an old laptop, copier, scanner, drive, or network device, ask a better question: '''What client data touched this device?''' ATL271 discusses secure disposal as part of the security lifecycle. #DataSecurity #Privacy
# Pull out the WISP. Dust it off. Read it. Test it. Assign owners. Update it. Then make sure what the document says is what the firm actually does. That's the central message of ATL271: ''Why Your WISP Is Essential in 2026.'' #AccountingTechnologyLab #Cybersecurity

== Products, Services, Companies, and Organizations Mentioned ==

{| class="wikitable sortable"
! Company / Organization
! Product or Service Mentioned
! X
! Facebook
! LinkedIn
! Instagram
|-
| CPA Practice Advisor
| Accounting Technology Lab / media
| @cpapracadvisor
| CPA Practice Advisor
| CPA Practice Advisor
| Not independently verified
|-
| YHB {{!}} CPAs & Consultants
| Firm security/vendor due-diligence example
| Not independently verified
| YHB {{!}} CPAs & Consultants
| YHB {{!}} CPAs & Consultants
| YHB {{!}} CPAs & Consultants
|-
| Mandiant / Google Cloud
| Cybersecurity / incident response
| @Mandiant
| Mandiant
| Mandiant (part of Google Cloud)
| Not independently verified
|-
| Data Center Inc. (DCI)
| Bank core processing / technology
| Not independently verified
| Not independently verified
| DCI / datacenterinc
| Not independently verified
|-
| Jack Henry
| Bank technology and processing
| @JH_Fintech
| JackHenryAssociates
| Jack Henry
| @jackhenry_fintech
|-
| Ubiquiti
| UniFi / Dream Machine networking and VPN hardware
| @Ubiquiti
| UIeverywhere
| Ubiquiti Inc.
| @ubiquiti*
|-
| Microsoft
| BitLocker, Microsoft VPN, Copilot
| @Microsoft
| Microsoft
| Microsoft
| @microsoft*
|-
| Apple
| Device/full-disk encryption
| @Apple
| Apple
| Apple
| @apple*
|-
| Wolters Kluwer
| Professional tax/accounting technology provider
| Not listed in current corporate directory
| Wolters Kluwer
| Wolters Kluwer
| Wolters Kluwer
|-
| Thomson Reuters
| Professional tax/accounting technology provider
| Thomson Reuters
| thomsonreuters
| Thomson Reuters
| thomsonreuters
|-
| AICPA / AICPA & CIMA
| Professional association / §7216 discussions
| @AICPA
| AICPA
| AICPA
| Not independently verified
|}

*Apparent account shown for identification; it was not verified to the same first-party standard during this research pass.

== Regulatory and Technical References Mentioned ==

* Written Information Security Plan (WISP)
* IRS
* FTC
* HHS
* FTC Safeguards Rule
* Gramm-Leach-Bliley Act (GLBA)
* HIPAA
* IRC §7216
* IRS Publication 4557
* IRS Publication 5708
* IRS “Security Six”
* Multi-factor authentication (MFA)
* Encryption
* Firewalls
* VPNs
* Password managers
* Backup and restoration testing
* Vulnerability scanning
* Phishing simulation
* Incident response plans
* Business associate agreements (BAAs)
* Vendor security questionnaires
* Access logging and monitoring
* Secure equipment disposal
* Patch management
* Security awareness training

== Suggested Hashtags ==

#AccountingTechnologyLab #ATL271 #WISP #Cybersecurity #CPA #AccountingTechnology #DataSecurity #InfoSec #RiskManagement #VendorRisk #MFA #IncidentResponse #Ransomware #CyberGovernance

ATL271 - Revision history

Bftcpa606 at 23:12, 18 August 2026