WISP: Written Information Security Program Guide for Texas SMBs 2026

A WISP is a short, living document that states how your business protects customer, employee, and company data. It names who is responsible, which data you hold, which risks you have identified, and which safeguards you run. It is not a 90-page policy binder copied from a template. Examiners and insurers want to see that the document matches what your team actually does.

Industry reporting consistently shows that small firms lose most compliance disputes on documentation, not on technology. You may already run MFA, backups, and endpoint protection. If none of it is written down and assigned to an owner, it does not count as a program.

• Finance, auto, and tax businesses covered by the FTC Safeguards Rule, which explicitly requires a written program.
• Companies that collect consumer data and must show reasonable practices under Texas data privacy law.
• Businesses renewing cyber coverage, because carriers now ask for written policies alongside the technical controls in the cyber insurance requirements.
• Vendors to larger customers who send security questionnaires and expect a program document in return.

1. Purpose and scope: which systems, locations, and data types the program covers.
2. Program owner: one named person accountable, with a backup.
3. Data inventory: where sensitive records live, including cloud apps, laptops, and phones.
4. Risk assessment: the top threats to that data and how likely each is in your environment.
5. Safeguards: access control, MFA, encryption, patching, backups, and vendor controls, each with an owner.
6. Incident response: who decides, who calls the insurer, and who notifies customers. Link to your incident response plan.
7. Review cycle: a yearly review date and a trigger list, such as a new vendor or a staff change.

The most frequent failure is a policy that promises more than the business delivers. Writing "all laptops are encrypted" when three are not creates a documented misstatement, which is worse than silence. Write what is true today, then list the gaps with dates.

The second failure is forgetting vendors. Your accounting platform, payroll provider, and line-of-business software all touch sensitive data, so your program should reference third-party vendor risk management. The third is skipping staff training. A policy nobody has read protects nothing, so pair the WISP with security awareness training that works.

A solid WISP is the foundation you build later frameworks on. If a customer eventually asks for SOC 2 readiness, most of your policies, risk register, and ownership records carry over. Building it once and mapping it to each requirement is far cheaper than writing a new document for every audit.

Picture a 25-person Houston accounting firm that suffers a mailbox compromise. With a WISP, the owner opens one document, sees who calls the insurer, which clients must be notified, and which logs to preserve. Without one, the first two days are spent debating who is in charge. The document does not stop the attack, but it shortens the response and gives your insurer and regulators evidence of reasonable care.

A WISP also makes hiring and offboarding cleaner. New employees know the rules on day one, and departing staff trigger a defined access-removal checklist. Treat it as an operating manual for security, reviewed every year and after any major change, not as paperwork you file and forget.

This week, name your program owner and list the five places sensitive data lives. Next, run a one-page risk review and write down the ten safeguards you already operate, with the person responsible for each. That draft is 60 percent of a WISP. Our compliance services and cybersecurity services can turn it into a defensible document and an evidence folder, and our resource library has supporting guides. For day-to-day ownership, our Houston managed IT team can run the controls the document promises.

• Houston managed IT
• The Woodlands managed IT
• Katy managed IT