WISP Required! Key Components in Your Firm's Written Information Security Plan
While primarily targeted at companies maintaining more than 5,000 client records (think tax returns), certain safeguard components are required for firms with less than 5,000 records.
Source: cpapracticeadvisor.com