If you prepare returns, you’ve checked the box on your PTIN renewal confirming you understand your data security responsibilities. For plenty of firms, that’s about the only time the written information security plan comes up all year. Somebody downloaded a template a few seasons back, filled in part of it and saved it to the server, where it has been sitting ever since.
You need a real one. The IRS expects it, the FTC requires it, and if your firm ever has a breach, your insurance carrier will ask for it before they ask almost anything else. The good news is that a solid WISP for a small or midsize practice usually runs 10 to 20 pages and can be pulled together in a few working sessions. Below we cover what the IRS publications say and walk through each section of the plan.
A written information security plan is your firm’s documented approach to protecting client data. It names the person in charge, lists where client information is stored, describes the safeguards you use, explains how staff are trained, and lays out what you’ll do if something goes wrong.
No two plans should look the same. A three-person practice in a single office and a 30-person firm with remote staff in two states may run identical tax software, but their risks are different, so their plans will be too. Keep in mind that it has to be written down. A partner who “knows how we handle things” isn’t a plan.
Yes. The Gramm-Leach-Bliley Act treats professional tax preparers as financial institutions, no matter how small the firm is. That brings you under the FTC Safeguards Rule, and the Safeguards Rule requires a written information security program.
The IRS backs this up in a few places. Form W-12, the PTIN application and renewal form, asks you to confirm you know about your data security obligations. Publication 4557, Safeguarding Taxpayer Data, explains the legal requirements and the safeguards the IRS recommends. And in August 2024 the IRS and its Security Summit partners released an updated Publication 5708, which includes a sample WISP written for small tax and accounting practices.
If your firm does tax prep, bookkeeping, payroll or financial planning for individuals, assume you need a WISP. Our FTC Safeguards Rule checklist for accounting and tax firms goes through everything the rule asks for.
People mix these two up all the time.
| Publication 4557 | Publication 5708 | |
|---|---|---|
| Full title | Safeguarding Taxpayer Data: A Guide for Your Business | Creating a Written Information Security Plan for Your Tax & Accounting Practice |
| What it is | A guide to legal requirements and recommended security practices | A WISP template with instructions and a sample plan |
| Use it to | Figure out which safeguards your firm needs | Write the plan that documents them |
Read 4557 first to decide what protections make sense for your firm. Then use 5708, or the outline in the next section, to put them in writing. Don’t just fill in the blanks on either one. The IRS itself says there is no one-size-fits-all WISP.
This is the outline we use with accounting and tax firms. It lines up with the FTC Safeguards Rule and the IRS sample plan, and the notes are aimed at firms with somewhere between 5 and 50 people.
Say what the plan covers and where it applies. That means client returns, financial statements, Social Security numbers, bank account details and payroll data, across every place they’re handled: the main office, any branch locations, staff working from home and remote team members. Seasonal preparers count as well, even if they’re only with you from January to April.
The FTC requires one person to oversee the program and calls that person the Qualified Individual. At most small firms this ends up being a partner or the office manager. You can hand the role to an outside IT provider, but someone senior at the firm still has to supervise them. Put an actual name here.
Write down what could realistically go wrong and how likely it is. For accounting firms, the usual suspects are phishing emails, business email compromise, a laptop left in a car, staff reusing passwords, ransomware and remote access that was set up quickly in 2020 and never revisited. Plan to redo the assessment every year and whenever something big changes.
Make a list of every place client information lives. Start with the obvious ones (your tax software, document management system, client portal and email) and then keep going. Scanned PDFs on a shared drive. Cloud storage. Backups. The filing cabinets in the back room. This part of the exercise almost always turns something up, like a shared mailbox that still gets K-1s from a client who left three years ago.
Describe who can get to which data and how you keep it limited to what each person needs. The Safeguards Rule requires multi-factor authentication for anyone logging into your systems, so note where MFA is turned on. Check email, tax software, remote access, the portal and any cloud apps. Spell out how you shut off access when someone leaves, and don’t forget the seasonal staff who wrap up in April.
Client data should be encrypted when it moves (email, file transfers, portal uploads) and when it’s stored (laptops, servers, backups, USB drives). If there’s something you can’t encrypt, explain what you do instead and who signed off on it.
Cover how staff are trained on security, how often, and how you keep track of who completed it. List the rules people are expected to follow. How do client documents get sent? Can staff use their own phones or laptops? What should someone do with an email that looks off? Phishing picks up during filing season, so it’s smart to run a refresher in December or early January.
Address laptops, home Wi-Fi, home printers and phones. Use firm-managed devices whenever possible, require secure remote access for anything involving client data and turn on automatic screen locks. If part of your team works in another state or another country, describe how they connect and what equipment they use. They should be held to the same standard as the people in your office.
List every outside company that stores or can see client data. For most firms that includes the tax software provider, any cloud host, the IT provider, the client portal, a payroll service and the shredding company. Note how you vetted each one and where the contract says they have to protect your data. Look at the list again once a year.
Explain how you keep an eye on your systems and confirm your protections are working. Under the FTC rule, that means continuous monitoring, or else a penetration test every year plus vulnerability scans at least every six months. Firms with information on fewer than 5,000 consumers don’t have to meet this particular requirement. Regular scans are inexpensive, though, so we recommend them anyway.
Lay out what happens if there’s a breach. Who gets the first call? How do you cut off the affected computers? Who contacts your cyber insurance carrier, and who talks to clients? Tax practices also have specific reporting steps. Contact your IRS Stakeholder Liaison as soon as you find out about data theft, and notify the tax agencies in each state where you file returns. If unencrypted information on 500 or more people is involved, you have 30 days to report it to the FTC. State breach notification laws may apply too.
State how long you hold onto client records and how you get rid of them. The FTC rule says customer information has to be securely disposed of within two years of the last time you used it to serve that client, unless there’s a legitimate business or legal reason to keep it longer. Shred the paper, and wipe or destroy hard drives before old equipment leaves the building.
Finish with the date of the last review, the name of the person who approved the plan and the date of the next scheduled review. Sign it and date it. An undated WISP is much harder to stand behind.
A solo practitioner’s plan will be a lot shorter than a 40-person firm’s. The basics still apply to everyone, though. If your firm keeps information on fewer than 5,000 consumers, the FTC rule doesn’t require a written risk assessment, the monitoring and penetration testing schedule, a written incident response plan or an annual report to firm leadership.
You still need the written program itself, a Qualified Individual, and real protections like MFA and encryption. We’d also encourage you to write a short incident response section even if you’re exempt. It takes an afternoon, and it will save you a lot of scrambling if you ever need it.
The most common one is a template that was never finished. If your plan still has [FIRM NAME] in brackets anywhere, an auditor or insurance adjuster will notice right away.
Another is a plan that describes the firm someone wished they had. If the WISP says every laptop is encrypted, every laptop needs to be encrypted. We also see plans that leave out remote and seasonal staff, which is a problem because those are often the people most likely to use a personal device. And when no one is named as the owner, the plan doesn’t get updated.
Finally, most plans are never tested. Once a year, pick a scenario, say a staff member clicks a phishing link on March 20th, and talk through what would happen. You’ll find out quickly whether the plan works.
At least once a year. For most firms, the fall is a good time, once the October extension deadline has passed and before anyone is thinking about January. You should also update it whenever you change tax software, move to the cloud, open a new office, add remote staff, switch IT providers or have a security incident.
Waterdog has worked with accounting and tax firms around Philadelphia since 2002. We set up the protections your plan describes, including MFA, encryption, monitoring, backups and staff training, and we help you write a WISP that reflects how your firm really operates. Read more about our IT and cybersecurity services for accounting firms and our IT compliance support. If you’d like us to look over the plan you have now, request a Cybersecurity Risk Review.
Yes. IRS Publication 5708, Creating a Written Information Security Plan for Your Tax & Accounting Practice, includes a sample plan. Use it as a starting point and tailor each section to your firm.
Yes. Tax preparers are financial institutions under the Gramm-Leach-Bliley Act, which means they must follow the FTC Safeguards Rule. That rule requires a written information security program.
It’s the IRS guide to safeguarding taxpayer data. It covers the legal requirements and recommended security practices for businesses that prepare and file tax returns.
Once a year at a minimum, plus any time your systems, staff, vendors or office locations change in a significant way.
The WISP is your entire security program. The incident response plan is one section of it that covers what to do during and after a breach or other security event.
This article is general information and not legal advice. Please talk with your attorney or compliance advisor about your firm’s specific obligations.
