Questions & Answers

Our practice is built around regulated professional firms: accounting and tax practices first, and alongside them law firms, insurance agencies, financial advisors, and medical and dental practices. What these firms share is the thing we specialise in: they hold records that clients cannot afford to have exposed and that a regulator can ask about. If your firm holds that kind of data, we speak your language; if you are unsure, ask.

If your firm prepares tax returns or otherwise handles consumer financial data, the Safeguards Rule requires a written information security plan, a named individual responsible for it, a risk assessment, specific technical safeguards such as encryption and MFA, staff training, vendor oversight, and an incident response capability. It is not optional and it is not satisfied by a template nobody has read. Our free WISP Builder shows you the shape of what is required.

If you have a PTIN, yes. The IRS requires paid preparers to have a written data security plan, and Form W-12 asks you to confirm it exists. Beyond the requirement, the WISP is the document you produce when an insurer, a client, or an examiner asks how client data is protected. A plan that no longer describes your firm reads as no plan at all, which is why maintenance matters as much as creation.

IT support keeps systems running; a security function decides what is safe and answers for it. A virtual CISO gives a small firm that function without a full-time hire: a named advisor who knows your environment, sets the security decisions, completes the questionnaires insurers and clients now send, and reviews posture with leadership on a schedule. Many of our clients keep their existing IT provider; we handle what that provider was never scoped to do.

Possibly nothing, and possibly a serious one, and the difference is where it runs and what goes into it. AI in a personal account processes client data outside your firm's control, outside your retention policy, and outside anything you could attest to in a review. The same work inside a properly configured Microsoft 365 tenant stays within your boundary and is never used to train public models. We move firms from the first situation to the second without slowing anyone down.

Every engagement is fixed-fee and scoped in writing before work begins: a defined deliverable, a defined price, and a timeline. The number depends on your firm's size band, systems in scope, and how much groundwork exists, which is why it follows a scoping conversation rather than a price list. The conversation itself is thirty minutes and free. The structures are described on our Engagements page.

Yes, and suspected incidents skip the scoping queue. Do not wipe or rebuild anything, preserve logs, note times, and call (414) 301-1017. Evidence of what happened is worth more than a fast cleanup, and the first hours matter.

Yes, and verifiably so: the Readiness Check, WISP Builder, and Workbench run entirely in your browser. Nothing you type is transmitted or stored by us unless you explicitly choose to send us a report. We built them this way because telling firms to be careful with client data while harvesting theirs would be absurd.

Claremont Security is based in the Milwaukee, Wisconsin area and works with firms across Wisconsin and nationwide. Most engagement work is performed remotely by design, and Wisconsin clients can expect in-person availability for the conversations that warrant it.

The first conversation can usually happen within a few business days, and assessment work typically begins within two weeks of a signed proposal. If you are heading into filing season, say so; we schedule remediation around your calendar, not ours.