What it is
A security plan starts with knowing where client data lives. The inventory lists every system, application and provider that stores, processes or sends firm or client data, and says whether the basic controls are on.
Each row records purpose, owner, hosting, data class, location, MFA, encryption, backup, contract or questionnaire date and review dates. Systems holding client confidential or restricted data are flagged for control gaps, missing contract evidence and overdue reviews.
When to use it
- Building the data inventory the security plan relies on.
- Annual access and provider reviews.
- Answering insurer or client security questionnaires.
What’s inside
- 60 system and provider rows
- Data class, hosting and control columns
- Next review and gap counts
- Summary by data class
Standard cited
This template follows 16 CFR 314.4(c). It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
Why is paper listed?
Paper stores and devices hold client data too. Record them with a hosting type of Paper or Device.
Which controls count as gaps?
No MFA, no encryption or no backup on a system holding client confidential or restricted data.
How often to review?
Set the interval in months on the Summary tab.
Related templates
- Written Information Security Plan (WISP) for CPA Firms
- WISP Risk Assessment Worksheet (Excel)
- Vendor Risk Register and Review Calendar (Excel)
- ITGC and User Access Review Checklist (Financial Statement Audit)
Last updated 11/05/2026. All free templates.