About
About the Business
Wisp Creation is the security consulting service of Fraley GRC Security Solutions, LLC. I help solo practitioners and small tax, accounting, and bookkeeping firms understand the risks to the sensitive information they handle and develop a practical plan to address them.
Small firms are often told they need a written information security plan (WISP), but a generic template doesn’t tell you where your security gaps are, whether your existing practices are adequate, or what you should address first.
That’s why my service starts with a security risk assessment, not a template. I review how your firm operates, identify and prioritize potential risks, assess relevant third-party providers, and use those findings to develop a custom WISP and practical implementation guide.
The complete assessment package is $500 flat, with no subscription or ongoing commitment. Whether you’re starting from scratch or already have a WISP that needs reviewing, the goal is the same: give you a clearer understanding of your security responsibilities and a plan that reflects how your firm actually works.
I’m an independent consultant and handle every engagement personally, from the initial conversation through the assessment and final documentation. Everything is conducted remotely, working US Eastern business hours and serving firms throughout the United States. There is no sales team, outsourced assessment, or handoff to someone you haven’t met.
The Approach
Understand your business first.
Every firm operates differently. I begin with a live interview of approximately 60–90 minutes, asking straightforward questions about your people, processes, software, devices, security practices, and third-party providers. I complete the assessment questionnaire during our conversation. You don’t need a technical background, and you don’t need to prepare a security report beforehand. If you don’t know an answer, that’s useful information too.
Your clients’ information stays with you.
I assess your security practices without accessing your clients’ personal or financial information. I don’t ask for client names, Social Security numbers, tax returns, passwords, or administrator credentials. The assessment focuses on how your firm handles information, using general categories rather than actual client records. I don’t access your systems, install software, or make changes to your devices.
A complete assessment for one fixed price.
For $500, you receive:
Security risk assessment report: Documented findings rated from Critical to Low, with an explanation of the risks identified.
Custom written information security plan: Developed from your assessment rather than copied from a generic template.
Vendor compliance check: A review of relevant third-party providers using publicly available information.
Implementation guide: Practical recommendations to help you understand and prioritize the steps needed to address identified gaps.
Walkthrough: An opportunity to go through your completed documents and ask questions.
One revision: A revision within 14 days of delivery.
There are no subscriptions, automatic renewals, or unexpected consulting charges. The price is agreed upon before work begins and paid in full before the assessment interview.
Built to be used, not filed away.
The goal isn’t to produce a thick document that gets forgotten. It’s to give you a realistic picture of your firm’s security practices, explain where improvements are needed, and provide documentation you can maintain as your business changes.
I use the NIST Cybersecurity Framework 2.0 to structure the assessment and draw on relevant IRS and FTC guidance when developing recommendations and the written plan. These provide a consistent foundation for the work, while the actual findings and recommendations remain specific to your business.
This is a professional security risk assessment and documentation service. It is not legal advice, a formal certification, or a guarantee of regulatory compliance. I assess and advise; implementation and changes to your systems remain your responsibility.
Frameworks and standards I work with
I don’t invent my own standards or frameworks. Here’s what the work is built on:
- Assessments are built on the NIST Cybersecurity Framework 2.0. It organizes your findings into six areas: govern, identify, protect, detect, respond and recover. I rate risk using likelihood and impact, following the approach in NIST SP 800-30.
- Your written plan is written with IRS guidance for tax professionals and the FTC Safeguards Rule in mind.
- Vendor checks look at what each vendor publishes about its own security, such as SOC 2 reports and ISO/IEC 27001 certification, and compare it with how your firm has the service set up.
My Experience
I’m Andrew Fraley, founder of Fraley GRC Security Solutions, LLC.
My professional background includes commercial project and safety management, small-business operations, independent contracting, and information security consulting.
My earlier work in construction involved managing projects, identifying workplace hazards, evaluating risks, and establishing practical procedures and controls. I later managed small-business operations and worked independently as a contractor.
I’ve also worked in information security consulting, including work involving PCI DSS and US financial-industry security and compliance requirements.
These experiences have shaped how I approach security: understand how a business operates, identify its risks, prioritize what matters, and develop practical measures that can be implemented and maintained.
I focus on smaller tax and accounting practices because they handle highly sensitive personal and financial information but often operate without dedicated IT or information security staff. They still have important responsibilities for protecting that information, and they need security guidance that reflects the realities of running a small firm.
Fraley GRC Security Solutions, LLC is my own firm. I personally conduct the assessments, develop the recommendations, and put my name on every report.