WISP requirements for tax preparers
What your written information security plan must include under the FTC Safeguards Rule, who the small-firm exceptions cover, and how to get a compliant plan written.
The short version
- Every paid tax preparer, EA, CPA and accounting firm is a financial institution under the FTC Safeguards Rule, regardless of size.
- You must keep a written information security plan (WISP) and the safeguards behind it.
- The free IRS sample in Publication 5708 is a starting point, not a finished plan.
- Firms with fewer than 5,000 consumers skip four written requirements, but not the plan itself.
What is a WISP?
A written information security plan, or WISP, is the document that describes how your firm protects client information. The IRS often calls it a data security plan. It covers who is responsible, what risks you face, which safeguards you use, how you train staff, how you oversee vendors and what you do after a breach.
The requirement comes from the Gramm-Leach-Bliley Act (GLBA) and the FTC's Safeguards Rule at 16 CFR Part 314. The IRS explains the same obligations for tax professionals in Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice, and in Publication 4557, Safeguarding Taxpayer Data.
Who needs a WISP?
If you prepare tax returns for pay, federal law treats your practice as a financial institution. That covers sole practitioners, EAs, CPAs, bookkeepers and multi-preparer firms alike. There is no minimum size.
The obligation also comes up every year at PTIN renewal, which opens in mid-October. PTINs expire on December 31, so the weeks before renewal are a natural time to write or review your plan.
What a WISP must include
Section 314.4 of the Safeguards Rule lists the elements of an information security program. Your written plan should cover each one.
| Requirement | What it means for a tax office | Rule |
|---|---|---|
| Qualified Individual | Name one person responsible for the security program. It can be an outside IT provider, but your firm stays responsible. | 314.4(a) |
| Risk assessment | Identify what could go wrong with client data and how well your current safeguards protect it. It must be written unless the small-firm exception applies. | 314.4(b) |
| Access controls | Give each person only the access their job needs, with their own login. | 314.4(c)(1) |
| Data and system inventory | Know where client data lives: devices, cloud apps, software and paper files. | 314.4(c)(2) |
| Encryption | Encrypt customer information in transit and at rest. | 314.4(c)(3) |
| Secure software practices | Use secure development practices for any applications you build in-house, and evaluate the security of outside applications. | 314.4(c)(4) |
| Multi-factor authentication | Require MFA for anyone accessing any information system, not only remote access. | 314.4(c)(5) |
| Data disposal | Dispose of customer information no later than two years after last use, unless you have a legal or business reason to keep it. | 314.4(c)(6) |
| Change management | Have a process for approving changes to systems and software. | 314.4(c)(7) |
| Monitoring | Monitor and log user activity, and detect unauthorized access. | 314.4(c)(8) |
| Testing | Regularly test your safeguards. Larger firms need continuous monitoring or annual penetration tests and vulnerability scans every six months. | 314.4(d) |
| Staff training | Give everyone with access to client data security awareness training. | 314.4(e) |
| Vendor oversight | Choose service providers that can protect your data, require it in their contracts, and check on them periodically. | 314.4(f) |
| Keep it current | Evaluate and adjust the program when your business, systems or risks change. | 314.4(g) |
| Incident response plan | A written plan for responding to and recovering from a security event. | 314.4(h) |
| Annual report | The Qualified Individual reports in writing at least once a year to the board or senior management. | 314.4(i) |
| FTC breach notice | Notify the FTC within 30 days of discovering a breach affecting 500 or more consumers. | 314.4(j) |
The small-firm exception
If your firm maintains customer information on fewer than 5,000 consumers, section 314.6 excuses you from four requirements:
- A written risk assessment (you still need to assess your risks)
- Continuous monitoring, or annual penetration testing and vulnerability scans every six months
- A written incident response plan
- The Qualified Individual's annual written report
Everything else still applies, including the written information security plan itself, MFA, encryption, training and vendor oversight.
Data breach reporting
If unencrypted customer information of 500 or more consumers is acquired without authorization, you must notify the FTC as soon as possible and no later than 30 days after discovery. The IRS also asks tax professionals to report data theft to their local IRS Stakeholder Liaison right away. State breach laws may add their own notices.
Is the free IRS WISP template enough?
IRS Publication 5708 includes a sample plan, and it describes that sample as a starting point rather than a final plan. When we mapped it against the Safeguards Rule, it stopped short in five places: multi-factor authentication, encryption at rest, the data disposal period, outsourced IT arrangements and the structure of the incident response plan.
See the side-by-side comparison.
How to write your WISP in five steps
- Name your Qualified Individual. Usually the owner or office manager in a small firm.
- Inventory your data and systems. List every device, cloud app and filing cabinet that holds client information.
- Assess your risks. Score the threats that matter to tax offices, such as phishing, remote access takeover and ransomware.
- Write your safeguards into the plan. Cover each requirement in the table above, and fix the gaps you found.
- Train staff and adopt the plan. Run a short training, collect signed acknowledgments, and set an annual review date.
Skip the blank page
The Practice Safeguards WISP Kit covers every requirement above in three editable Word files, with a one-page map showing where each rule is met.
Sources
- FTC Safeguards Rule, 16 CFR Part 314 (eCFR)
- IRS Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice
- IRS Publication 4557, Safeguarding Taxpayer Data
This guide is educational information, not legal advice. Practice Safeguards is an independent publisher and is not affiliated with or endorsed by the IRS or the FTC.