The 12 email questions, per industry.
Use the one for your industry as the email section of your written security program. Each question has the answer a small firm should be able to give.
Overview
Healthcare: HIPAA
The questions in the HHS audit protocol, for practices.
Open checklist →Accounting & Tax: Safeguards Rule
For the WISP and the PTIN renewal question.
Open checklist →Legal & Title: ABA / ALTA
For malpractice renewals and underwriter assessments.
Open checklist →Wealth & RIAs: Rule 204-2
Before the exam, with your compliance consultant.
Open checklist →Want the answers filled in automatically? Run the free compliance scanner on your domain.
How to use these checklists
Each checklist is the email section of a written security program, phrased as the twelve questions the person reviewing you is most likely to ask. Answer each one in a sentence, attach the evidence, and file the sheet with the rest of the program. The same sheet answers a cyber-insurance application, a carrier questionnaire, an underwriter assessment or an exam request list, because those forms ask the same twelve things in different words. The HIPAA checklist follows the HHS audit protocol; the Safeguards checklist follows the elements of 16 CFR 314.4; the legal checklist follows ABA Opinion 477R and ALTA Best Practices; the RIA checklist follows Rule 204-2. Each one links to the plain-English page for its rule.
Who asks these questions
| Industry | Who asks | When | What they want to see |
|---|---|---|---|
| Healthcare | An HHS OCR auditor or investigator; your cyber-insurance carrier; a hospital or payer doing vendor due diligence | After a complaint or breach report, at renewal, or when you join a network | The risk analysis, the BAA with your email vendor, proof that PHI in email is encrypted, and the audit trail |
| Accounting and tax | The FTC under the Safeguards Rule; the IRS at PTIN renewal and through its Stakeholder Liaison after an incident; your insurer | Every PTIN renewal; after a data incident; at policy renewal | The WISP, a named qualified individual, MFA, encryption of returns in transit, a service-provider contract, a training record |
| Legal and title | Your malpractice or cyber underwriter; a title underwriter doing an ALTA assessment; bar ethics counsel after a complaint; a client’s security questionnaire | At E&O renewal, at the annual underwriter assessment, when a client sends a questionnaire | How wire instructions are sent, whether MFA and DMARC are in place, retention and legal hold, the incident playbook |
| Wealth and RIAs | An SEC or state examiner; your compliance consultant at the annual review; a custodian’s due-diligence team | At the exam, which comes with a request list and a deadline; at the annual compliance review | Complete communications by custodian, date and keyword; proof records cannot be altered; the Marketing Rule records; the off-channel policy |
How to document your answers
- Print the checklist for your industry, or copy the twelve questions into the email section of your program.
- Under each question write one sentence that is true today, not the answer you would like to give. “TLS is enforced and mail is held when the recipient cannot negotiate it” is an answer; “our provider uses TLS” is not.
- Attach evidence next to the answer: a screenshot of the policy, the signed BAA or addendum from your console, the quarterly compliance report, the DMARC record. The evidence pack collects most of these in one download.
- Mark any question you cannot answer yet, and date it. A documented gap with a plan is a normal finding; an undocumented one is a problem.
- Review the sheet once a year and after any change of email provider, and keep the previous versions.
Example
Ortiz CPA, nine people on Microsoft 365, gets the PTIN renewal question about a data security plan in October. Daniel Ortiz takes the Safeguards checklist, names himself as qualified individual for question 1, pastes the firm’s policy screenshots for questions 3 and 4, attaches the Data Processing & Safeguards Addendum for question 9, and runs the compliance scanner for question 11. Questions 10 and 12 become two dated to-dos: write the incident steps and schedule the training. The sheet goes in the WISP, and the renewal box gets checked honestly.
FAQ
Are the checklists free to use without PXCMail?
Yes. The questions and the answers a small firm should be able to give are the same whichever vendor you use. The product links show how PXCMail answers each one.
Can a checklist replace a risk assessment or WISP?
No. It is the email section of those documents. The IRS Publication 5708 template and the HHS Security Rule guidance cover the rest.
Which checklist does an insurance agency or mortgage broker use?
The Safeguards Rule checklist. Both are financial institutions under the Rule, and underwriters ask the same questions.
Does filling in the checklist make us compliant?
No document does. It makes your answers true and your evidence findable, which is what the reviewer is checking.
Related
Four rules, in plain English · Quarterly compliance report · Trust Center