Written Information Security Plan (WISP): What the IRS Requires and How to Write One

A Written Information Security Plan, or WISP, documents how your firm protects client data. It names who is responsible, lists the risks you have assessed, describes the safeguards you run, and explains how you respond to an incident. If you prepare tax returns or provide accounting services, you must have one. Under the Gramm-Leach-Bliley Act and the FTC Safeguards Rule, tax and accounting professionals are financial institutions. And the rules apply regardless of size. IRS Publication 5708 lays out what the plan should contain.

What is a WISP, and who is required to have one?

Your WISP is a written description of your information security program. The IRS says the law requires tax professionals to have one, and the FTC Safeguards Rule requires every covered financial institution to keep its security program in writing. Sole practitioners are covered as well as large firms. But size still shapes the plan. The IRS notes that a sole practitioner can use a shorter, simpler plan than a ten-partner firm. A plan doesn't need to be long to count. It needs to be written, accurate, and something your staff can actually follow.

IRS Publication 5708 explains how to create a Written Information Security Plan for a tax and accounting practice.

What does the IRS require a WISP to include?

Publication 5708 gives you an outline to follow. Start by defining the plan's objectives, purpose, and scope. Designate a qualified individual to coordinate the program, and list everyone who can access client data. Assess your risks, including the types of information you handle and where it could be lost. Inventory your hardware and the data each device holds. Document your safeguards (data retention, network protection, user access, remote access, Wi-Fi, and reportable incidents). Then add an implementation clause. Finish by attaching supporting documents such as retention rules, breach procedures, and signed staff acknowledgements.

How does a WISP relate to the FTC Safeguards Rule and GLBA?

Your WISP is the written form of the program the Safeguards Rule requires. The rule asks you to name a qualified individual, assess risks in writing, and put safeguards in place and test them. It also asks you to train staff, oversee your service providers, keep the program current, and maintain a written incident response plan. Multifactor authentication is required for anyone accessing your systems. And you must notify the FTC within 30 days of discovering a security event involving 500 or more consumers. Your WISP is the proof that each of those is covered.

The FTC explains the Safeguards Rule requirements for small businesses.

Read how GLBA and the FTC Safeguards Rule fit together.

How do you write a WISP for a small firm?

You should start with facts, not a template. List every place your firm keeps client data. Think through your tax software, document management or portal, and email. Then cover workstations, laptops, phones, backups, filing cabinets, and any cloud apps. Name your qualified individual and a backup. Write down who can access what. Next, go through the Publication 5708 outline section by section, describe what you actually do today, and mark the gaps. A template can save time on structure. But a WISP that describes safeguards you don't have is worse than a short, honest one.

What safeguards does a WISP usually commit you to?

Your plan will usually cover the same core controls most small firms use. Multifactor authentication guards email, tax software, and remote access. Laptops are encrypted, and client data is encrypted in transit. Every person has an account with only the access they need. Computers are patched and protected. Backups are tested (not just assumed to work) and kept separate from your network. Old drives and paper are securely destroyed. And staff train every year, with signed acknowledgements on file. Last, confirm that vendors who handle client data can protect it, with that duty written into your contracts.

Who should be your qualified individual?

Your qualified individual coordinates the security program and answers for it. That's usually an owner or partner, because the role needs the authority to set rules and spend money. The Safeguards Rule allows the qualified individual to work for a service provider, such as your IT company. But your firm still stays responsible for the program and must oversee that person. Whoever you name, give them a backup. Write both names into the WISP so staff know whom to tell when something looks wrong.

What should your WISP say about vendors and remote work?

Your plan should name each vendor that can reach client data. Examples include your tax software provider, document portal, IT company, and backup service. State how you checked that each one protects that data. The Safeguards Rule expects that duty to be in your contracts. For remote work, state which devices staff may use. Client data stays in approved systems, not on personal computers. Home Wi-Fi must be secured, and remote access always requires multifactor authentication. And seasonal and contract preparers need the same rules and training as permanent staff.

How often should you review your WISP?

Review your plan at least once a year, and update it whenever something material changes: a new office, new tax or document software, a new remote work arrangement, a staff change in the qualified individual role, or an incident. Publication 5708 describes the WISP as an evergreen document. Keep a dated version history so you can show what the plan said at any point, and store a copy outside your office network in case of a physical disaster or ransomware.

What happens if you do not have a WISP?

Without a plan, you are out of compliance with the Safeguards Rule. The IRS has repeatedly reminded tax professionals that the requirement applies to them. But the bigger cost usually comes after a breach. If client data is stolen, you will be asked what safeguards you had in place. A missing plan makes that a hard conversation with clients, regulators, and your insurer. Writing the WISP tends to expose gaps, such as an account without multifactor authentication, before an attacker finds them.

The IRS explains why a Written Information Security Plan protects tax professionals and their clients.

See how we support accounting and CPA firms.

Read our FTC Safeguards Rule compliance guide.

Check your readiness with the free compliance tool.