We build your Safeguards program with you
A one-time engagement that takes your business from "are we compliant?" to a written, working program, tailored to how you actually handle customer information. From $2,500 for tax offices and small firms, and from $5,000 for dealerships.
Everything the rule asks for, built around your business
Gap assessment
We check your business against every requirement of 16 CFR 314.4 and show you exactly where you stand.
Tailored WISP
Your written information security program, written around your systems, vendors and staff. No fill-in-the-blank boilerplate.
Written risk assessment
What customer information you hold, where it lives, what could go wrong and how each risk is handled.
90-day action plan
A short, prioritized list of fixes for you or your IT provider, from MFA and encryption to secure disposal.
Walkthrough
We take your team and your IT provider through the program, so everyone knows their part.
First-year staff training
Security awareness training for up to 10 learners at tax offices and 50 at dealerships, plus the course for the person who oversees your program.
Four steps, done remotely
Discover
We learn how your business collects, stores and shares customer information, and whether the small-business exemption applies.
Assess
Short interviews and a review of your systems, vendors and existing documents against each requirement.
Build
Your WISP, risk assessment and supporting documents, tailored and ready to approve.
Hand off
The 90-day plan, a walkthrough with your team and IT provider, and staff training rolled out.
One-time, quoted before we start
From $2,500 one time
For businesses with records on fewer than 5,000 individuals, such as most tax and accounting firms.
From $5,000 one time per dealership
Most dealerships pass 5,000 individuals, so the full rule applies, including the written risk assessment, testing and the annual report.
Program Setup FAQ
Do you become our Qualified Individual?
Not with Program Setup alone. We build the program, and you designate a QI: someone on your team, or us under Managed QI. Many clients move to Managed QI once the program is in place.
Do you replace our IT provider?
No. We give your IT provider a clear, prioritized list and explain why each item matters. We don't sell IT services.
How long does it take?
It depends mostly on how quickly we can schedule interviews and gather documents. We agree on a schedule before we start.
Is everything remote?
Yes. Interviews, reviews and the walkthrough all happen by video call and email, wherever you're located.
Is this legal advice?
No. We're security and compliance specialists, not a law firm. For legal questions about your obligations, talk to your attorney.
Ready to build your program?
Email us with a question or to set up a free 20-minute call, and we'll tell you what Program Setup would cover for your business.