Terms and Conditions

Written Information Security Plan (WISP)

Accurate by Nadia CPA

1. Introduction

This Written Information Security Plan (WISP) outlines the measures and protocols that Accurate by Nadia CPA has implemented to protect the confidentiality, integrity, and availability of sensitive information. This plan is designed to comply with applicable laws and regulations, including the Gramm-Leach-Bliley Act (GLBA) and other relevant data protection laws.

2. Objectives

The objectives of this WISP are to:

• Protect client information from unauthorized access, use, or disclosure.
• Ensure the security and confidentiality of client information.
• Protect against anticipated threats or hazards to the security or integrity of client information.
• Comply with legal and regulatory requirements.                         

3. Scope

This WISP applies to all employees, contractors, and third-party service providers who have access to sensitive information at Accurate by Nadia CPA. It covers all forms of information, including electronic, paper, and other media.

4. Information Security Officer

Accurate by Nadia CPA has designated Nadia Fuia as the Information Security Officer responsible for implementing, maintaining, and enforcing this WISP.

5. Risk Assessment

Accurate by Nadia CPA conducts regular risk assessments to identify potential threats and vulnerabilities to sensitive information. The risk assessment process includes:

• Identifying and evaluating potential risks to client information.
• Assessing the likelihood and impact of these risks.
• Implementing appropriate measures to mitigate identified risks.

6. Information Security Policies

Accurate by Nadia CPA has established the following information security policies to protect sensitive information:

1. Access Control

• Access to sensitive information is restricted to authorized personnel only.
• Employees are required to use strong passwords and multi-factor authentication.
• Access rights are reviewed and updated regularly.

1. Data Encryption

• Sensitive information is encrypted both in transit and at rest.
• Encryption keys are managed securely, and access is restricted to authorized personnel.

1. Physical Security

• Physical access to sensitive information is restricted to authorized personnel.
• Secure storage facilities are used for paper records containing sensitive information.

1. Incident Response

• An incident response plan is in place to address security breaches and data loss incidents.
• Employees are trained to recognize and report security incidents.
• Incidents are documented, investigated, and resolved promptly.

1. Employee Training

• Employees receive regular training in information security policies and procedures.
• Training includes topics such as data protection, phishing awareness, and secure handling of sensitive information.

7. Monitoring and Auditing

Accurate by Nadia CPA regularly monitors and audits its information security practices to ensure compliance with this WISP. This includes:

• Conducting regular security audits and vulnerability assessments.
• Monitoring access to sensitive information and detecting unauthorized access.
• Reviewing and updating security policies and procedures as needed.

8. Third-Party Service Providers

Accurate by Nadia CPA] ensures that third-party service providers who have access to sensitive information comply with this WISP. This includes:

• Conducting due diligence on third-party service providers.
• Including information security requirements in contracts with third-party service providers.
• Regularly reviewing third-party service providers’ security practices.

9. Review and Update

This WISP is reviewed and updated annually or as needed to address changes in technology, business practices, and regulatory requirements. The Information Security Officer is responsible for ensuring that this WISP remains current and effective.

10. Conclusion

Accurate by Nadia CPA is committed to protecting the confidentiality, integrity, and availability of sensitive information. By implementing this WISP, we aim to safeguard client information and comply with legal and regulatory requirements.