Tech Guru
Free tool

Build your firm's incident response playbook in ten minutes.

Fifteen questions about where you work, what you run, and who helps you. Out comes the plan for your worst day: the first hour, the first day, who to call, who must be told and by when, and scenario playbooks for the incidents tax firms actually have. Free, no sign-up, delivered as a Word document.

  • Your answers stay in your browser. Nothing is uploaded or stored.
  • Built on 16 CFR 314.4(h) and (j), IRS Publication 4557, and the IRS data theft reporting path.
  • A playbook with a one-page contact sheet, a notification matrix, and scenario steps for the incidents tax firms actually have.

Step 1 of 5 About the firm

1Your firm and the person who leads an incident

The incident lead makes the calls in the first hour. Usually a partner or the firm administrator.

Changes: Fills the cover, the roles section, the contact sheet, and the state notification table.

2How many people work in the firm?

Changes: Sets the response team: a solo owner with a named backup, or a lead, an alternate, and a communications role.

3Roughly how many individuals’ information does the firm hold, including prior years?

Changes: Under 5,000 the written plan is labeled recommended under the Safeguards Rule’s small-firm exception; at 5,000 or more it is required. The FTC’s 500-consumer notification threshold is explained either way.

4What does the firm do?

Changes: Names the data at stake and adds the payment-card incident path when cards are involved.

5Does the firm e-file under its own EFIN?

Changes: Adds the EFIN compromise playbook and the IRS e-help contact.

What you get, and what you do not

Written to be read at 7 a.m. in March.

Steps in order, numbers on one page

The first hour and the first day are numbered checklists. Appendix A is the contact sheet: incident lead, technical help, insurer, counsel, the IRS Stakeholder Liaison, your state, the FTC form, the bank fraud line. Print it and take it home.

Playbooks for the real incidents

Lost laptop. Phishing click and mailbox takeover, with the exact Microsoft 365 or Google Workspace steps. Wire fraud. Ransomware. Misdirected email. EFIN misuse. A departing employee. A vendor breach. A break-in. Only the ones that fit your firm.

What it is not

It is not legal advice, and it does not decide notification for you. The matrix and the worksheet are the starting point; counsel applies your state’s law to the facts. Generator version 1.0 (October 2026).

Want someone watching so the playbook rarely opens?

Tech Guru clients get managed detection and response, a security operations center, and an incident lead on our side of the line, 24/7/365. Book a discovery call.

Book your discovery call now

Not ready to talk? Score your firm's security in two minutes.

No long-term contract. No hour caps. No minimums. 60-day cancellation any time. Full proposal within 24 hours of your call. (800) 692-6096