Written Information Security Plan (WISP) for Tax and Accounting Firms

10/8/2026

Every tax and accounting firm holds exactly the data identity thieves want: names, Social Security numbers, dates of birth, bank account numbers, income and employer details, often for whole families. That is why federal law treats a firm that prepares tax returns as a financial institution for data security purposes, and why the IRS now asks every preparer, at each PTIN renewal, to acknowledge that a written information security plan is required.

A written information security plan, or WISP, is the document that shows how the firm protects that data. It is not a technical manual and it is not optional. This post explains where the obligation comes from, what the plan has to contain, how a small practice can scale it, and how to run the annual review that keeps it from going stale.

Where the WISP Requirement Comes From

The Gramm-Leach-Bliley Act and the FTC Safeguards Rule

The Gramm-Leach-Bliley Act requires financial institutions to protect customer information. The Federal Trade Commission implements that requirement for non-bank businesses through the Standards for Safeguarding Customer Information, usually called the Safeguards Rule, at 16 CFR Part 314. The rule's definition of financial institution expressly covers businesses that prepare income tax returns, so CPA firms, enrolled agents, tax preparation offices and accounting firms that prepare returns are covered regardless of size.

The rule requires a covered firm to develop, implement and maintain a written information security program with administrative, technical and physical safeguards appropriate to its size, complexity, activities and the sensitivity of the information it holds. The FTC substantially updated the rule, and its more detailed requirements have applied since 2023. A further amendment requiring notice to the FTC of certain security events took effect in 2024.

What the IRS says

The IRS does not administer the Safeguards Rule, but it reinforces it in several ways:

• PTIN application and renewal. Form W-12 and the online renewal ask preparers to acknowledge that paid preparers are required by law to create and maintain a written information security plan.
• Publication 4557, Safeguarding Taxpayer Data, is the IRS guide to basic security steps, recognizing and reporting data theft, and complying with the Safeguards Rule.
• Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice, was prepared by the Security Summit (the IRS, state tax agencies and the private-sector tax community). It includes an outline and a sample template written particularly for smaller practices.
• Publication 1345, the handbook for authorized IRS e-file providers, is listed in Publication 5708 as required reading before drafting the plan, because e-file providers have their own safeguarding obligations.

Professional standards

The IRS Office of Professional Responsibility has pointed out that several provisions of Circular 230 bear on data security: the competence requirement in section 10.35, which has been read to include technological competence; section 10.36, which requires those with principal authority for a firm's tax practice to have adequate procedures for compliance by the firm's staff; and the best-practices standard in section 10.33. The Internal Revenue Code also penalizes unauthorized disclosure or use of tax return information, through the civil penalty in section 6713 and the criminal provision in section 7216. A breach caused by careless practices can therefore become a professional-conduct problem as well as a regulatory one.

State law can add obligations. Several states have their own data security and breach-notification statutes, and some, such as Massachusetts, have their own written-program requirement. Check the rules of every state where you have offices or clients.

What the Safeguards Rule Requires a WISP to Contain

The FTC frames the rule as nine elements. Your plan should address each one in writing.

1. A Qualified Individual. Designate one person to oversee and implement the program. It can be an owner, an employee or an outside provider, but if you outsource it, the firm keeps responsibility and someone in the firm must supervise the provider.
2. A risk assessment. Identify reasonably foreseeable internal and external risks to customer information, and evaluate whether current safeguards control them. For most firms this assessment must itself be written, and it must be repeated periodically.
3. Safeguards to control the risks, including:

   - access controls limiting each user to the data they need;

   - an inventory of the data, personnel, devices, systems and facilities involved;

   - encryption of customer information in transit over external networks and at rest, unless the Qualified Individual approves effective alternative controls where encryption is infeasible;

   - secure development practices for any in-house applications;

   - multi-factor authentication for anyone accessing any information system, unless the Qualified Individual approves an equivalent or more secure control in writing;

   - secure disposal of customer information no later than two years after its last use in serving the customer, unless there is a business or legal need to keep it;

   - change management procedures; and

   - monitoring and logging of authorized users' activity, and detection of unauthorized access.

4. Regular monitoring and testing. Either continuous monitoring, or annual penetration testing plus vulnerability assessments at least every six months, and additional testing when operations change materially.
5. Staff training, with security awareness training updated as risks change.
6. Service provider oversight. Select vendors that can protect the data, require it by contract, and periodically assess them. This includes tax software, cloud storage, client portals, IT support and remote-access providers.
7. Keeping the program current as the business, its technology and the threats change.
8. A written incident response plan covering goals, internal processes, roles and decision authority, communications, remediation, documentation, and evaluation of the plan after an incident.
9. An annual written report from the Qualified Individual to the board or, where there is no board, a senior officer, on the program's status and material matters.

The small-firm exception

Firms that maintain customer information on fewer than 5,000 consumers are exempt from four of these provisions: the written risk assessment, the continuous monitoring or penetration testing requirement, the written incident response plan, and the annual report. Many sole practitioners and small offices fall under that line.

Two cautions. First, the exception removes the written form of those items, not the underlying duty to protect the data; you still need to assess risk and respond to incidents. Second, the count is of consumers whose information you hold, including prior-year clients, dependents and spouses whose data sits in your files, so a firm with a modest active client list can be over it. Publication 5708's template includes a written risk assessment and breach procedures anyway, and following it is the safer course.

Notifying the FTC

Since May 2024, a covered firm must notify the FTC when unencrypted information of at least 500 consumers is acquired without authorization. The notice is due as soon as possible and no later than 30 days after discovery, through the FTC's online form. This is separate from any state breach-notification duties to the affected individuals and from reporting to the IRS.

How to Build the Plan: Following Publication 5708

Publication 5708 organizes a WISP into seven parts, and it is a practical skeleton for any firm.

1. Objectives, purpose and scope

State what the plan protects (personally identifiable information of clients, their families and the firm's own employees), the law it implements, and which offices, systems and people it covers.

2. Qualified Individual and authorized users

Name the person responsible and any deputies. List each authorized user with their access level. Keep this list current; departed staff with live credentials are a recurring cause of breaches.

3. Risk assessment

List the types of information the firm handles and the places it could be lost: phishing and credential theft, ransomware, lost or stolen laptops and phones, misdirected email, unsecured home networks, paper files, unauthorized e-file account access, and insiders. Describe how you will monitor and test those risks.

4. Hardware inventory

List each device that stores or processes client data, where it is, and what it holds. This includes laptops, desktops, servers, scanners and copiers with storage, external drives and mobile phones used for work.

5. Safety measures in place

Publication 5708 suggests policies on data collection and retention, data disclosure, network protection, user access, electronic data exchange, Wi-Fi access, remote access, connected devices and reportable incidents, plus an employee code of conduct. In practice that means stating, for example, that client documents are exchanged only through an encrypted portal, that multi-factor authentication is on for email, tax software and remote access, that backups are encrypted and test-restored, and that paper is shredded on a schedule.

6. Implementation clause

A short statement that the plan is adopted, by whom, on what date, and when it will next be reviewed.

7. Attachments

The publication's sample attachments are worth copying: a record retention policy, rules of behavior for staff, security breach procedures and notification contacts, an employee acknowledgment form, a hardware inventory and a list of employees authorized to access PII. Keeping volatile details in attachments means you update a list, not the whole plan.

The Incident Response Section Most Firms Get Wrong

A breach at a tax office is time-critical because stolen data is used to file fraudulent returns quickly. Your incident plan should say, before anything happens:

• who declares an incident and who has authority to shut systems down;
• how to preserve evidence rather than wipe affected machines;
• who contacts the firm's IRS Stakeholder Liaison, who coordinates the IRS response to a tax professional data breach;
• how to reach state tax agencies (the Federation of Tax Administrators maintains state reporting contacts), law enforcement, the firm's tax software provider and its insurer;
• how the firm will determine whether the FTC notification threshold is met and file within 30 days; and
• how clients will be notified under the applicable state laws.

Write the phone numbers into the attachment. Searching for them during an incident wastes hours that matter.

The Annual Review

The Safeguards Rule requires the program to be kept current, and Publication 5708 recommends reviewing the plan at least annually and whenever there is a material change in the business. A practical annual review covers:

• Is the Qualified Individual still the right person? Is the authorized-user list accurate? Have all departed staff and seasonal preparers been removed?
• Data and devices. Update the hardware inventory and confirm encryption on every device.
• Re-run the risk assessment against what changed: new software, remote staff, a new office, a new service line.
• Testing results. Review vulnerability scans, penetration tests or monitoring findings and confirm remediation.
• Reconfirm security terms with each provider and ask about incidents.
• Incidents and near misses. What happened during the year and what changed as a result?
• Hold the annual training session and collect signed acknowledgments from owners, employees and contractors.
• Retention and disposal. Confirm data past its retention period was securely destroyed.
• Where the firm is not under the small-firm exception, the Qualified Individual delivers the written annual report.

Scheduling this review in the quiet months after the October extension season is sensible. Doing it in the weeks before filing season, when seasonal staff join and credentials are issued, is better still, because it catches access problems before they become breach paths. Our post on hiring seasonal tax preparers covers the onboarding side, including access setup.

Common Gaps Found in Small-Firm WISPs

• A downloaded template with the firm name filled in and nothing else changed. A plan that describes systems you do not use is evidence that no risk assessment was done.
• No multi-factor authentication on email, even when it is on in the tax software.
• Client documents received by plain email, contrary to the plan.
• No vendor list, so nobody knows which providers hold client data.
• Shared logins for tax software or e-file accounts.
• Backups never test-restored.
• No disposal schedule, so files are kept indefinitely, which enlarges the damage of any breach.
• Remote and home-office work not addressed at all.
• AI tools used with client data without any policy. Our post on writing an AI governance policy for an accounting firm covers how to bring them inside the plan, and the remote accounting firm best practices post covers distributed teams.

Where the WISP Fits in Practice Management

The WISP sits alongside the firm's other written policies: engagement letters, retention, quality control and personnel rules. A peer-review or internal practice review should look at it, and our CPA firm peer review checklist is a useful companion for the annual practice review.

Training on Practitioner Regulations and Security

A WISP is only as good as the people following it. The Tax Practitioner Regulations, Penalties and Security course is our training on the regulatory side of tax practice, including the penalty and security obligations discussed above. It is a reasonable starting point for owners and staff who need to understand why the plan says what it says, and for firms that want security and practitioner rules covered in onboarding alongside their wider tax preparer training.

Frequently Asked Questions

Are tax preparers legally required to have a WISP?

Yes. The FTC Safeguards Rule, issued under the Gramm-Leach-Bliley Act, defines businesses that prepare income tax returns as financial institutions and requires them to maintain a written information security program. The IRS reinforces this: the PTIN application and renewal asks preparers to acknowledge the written-plan requirement, and IRS Publications 4557 and 5708 explain how to comply. The obligation applies regardless of firm size, although small firms are exempt from some specific provisions.

What is IRS Publication 5708?

Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice, was prepared by the Security Summit and published by the IRS. It explains the legal requirement, gives a seven-part outline (objectives and scope, Qualified Individual, risk assessment, hardware inventory, safety measures, implementation clause and attachments) and includes a sample template with attachments such as a record retention policy and breach procedures. It is aimed particularly at smaller practices.

Does the 5,000-consumer exception mean a small firm does not need a WISP?

No. Firms holding customer information on fewer than 5,000 consumers are exempt only from four provisions: the written risk assessment, continuous monitoring or penetration testing, the written incident response plan and the annual report to the board. They still need a written security program with a Qualified Individual, safeguards, multi-factor authentication, training, vendor oversight and disposal procedures. Remember that the count includes everyone whose data you hold, such as spouses, dependents and former clients.

How often should a WISP be reviewed?

At least once a year, and whenever the firm changes materially, for example by adding an office, moving to new software, allowing remote work or suffering an incident. The Safeguards Rule requires the program to be kept current, and Publication 5708's template is built around an annual review date. Pair the review with annual staff training and signed acknowledgments, and update the authorized-user list and hardware inventory each time.

What must a firm do after a data breach?

Follow the written incident response plan: contain the incident, preserve evidence, and contact the IRS Stakeholder Liaison, state tax agencies, law enforcement, your tax software provider and your insurer. If unencrypted information of 500 or more consumers was acquired without authorization, notify the FTC as soon as possible and within 30 days of discovery. Separately, notify affected clients as required by the breach laws of the states where they live.

Does multi-factor authentication have to be used everywhere?

The Safeguards Rule requires multi-factor authentication for any individual accessing any information system that holds customer information, unless the Qualified Individual approves in writing a reasonably equivalent or more secure access control. In practice that means email, tax and accounting software, client portals, cloud storage and remote access. Many professional tax software products already require it; email and file storage are where firms most often leave gaps.