WISP for tax preparers: the written plan the IRS expects

A WISP for tax preparers is the written information security plan that the FTC Safeguards Rule requires of paid preparers, from a sole proprietor to a large firm. It names one person in charge, records the risks to client data, lists the safeguards that answer them, and covers training, vendors, testing and what happens after a breach.

Who must keep a WISP for tax preparers?

Every paid tax preparer is expected to keep a written information security plan, or WISP. The duty comes from the FTC Safeguards Rule, which treats tax preparation firms as financial institutions, and the IRS repeats it on the PTIN application. Firm size does not change whether the duty applies, only how detailed the plan needs to be.

The rule itself is short on this point. The Safeguards Rule at 16 CFR 314.1 (eCFR, current as of October 14, 2026) lists the businesses it covers and names "tax preparation firms" among them. The IRS reads it the same way. IRS Publication 5708 (Rev. 8-2024) says that under the Gramm-Leach-Bliley Act and the Safeguards Rule, "tax and accounting professionals are considered financial institutions, regardless of size," and that "Your WISP must be written and accessible."

The PTIN renewal is where most preparers meet the requirement each year. Line 11 of Form W-12 (Rev. 10-2025), the PTIN application and renewal form, is headed "Data Security Responsibilities." It reads: "I am aware that paid tax return preparers are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information." The preparer must check Yes or No, and the line points to Publications 5708 and 4557.

Line 11 is an awareness statement. It does not ask the preparer to attach a plan or describe one. The duty to have the plan comes from the Safeguards Rule, and the W-12 line records that the preparer knows about it.

A one-person practice is covered. Nothing in the rule's list of covered businesses depends on headcount, and Publication 5708 says outright that "a sole practitioner can use a more abbreviated and simplified plan than a 10-partner accounting firm." Abbreviated still means written.

Which preparers the rule reaches, how it defines a consumer, and how the FTC breach notice works are covered in full in which tax preparers the FTC Safeguards Rule covers.

The required elements of a tax preparer WISP

A tax preparer WISP has to describe an information security program with the elements listed in 16 CFR 314.4. In plain terms those are a qualified individual, a written risk assessment, safeguards, testing and monitoring, staff training, service-provider oversight, keeping the program current, an incident response plan, an annual report, and a notice to the FTC after certain breaches.

Each element, as the rule words it:

• Qualified Individual. Section 314.4(a) reads: "Designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program." Publication 5708's sample template calls this role the Data Security Coordinator.
• Risk assessment. Section 314.4(b) bases the program on a risk assessment, and (b)(1) says it "shall be written."
• Safeguards. Section 314.4(c) lists the controls, including access controls, an inventory of data, devices and systems, encryption of customer information in transit over external networks and at rest, multi-factor authentication "for any individual accessing any information system," secure disposal, change management, and logging of user activity.
• Testing and monitoring. Section 314.4(d) requires regular testing of key controls, with continuous monitoring or annual penetration testing and vulnerability assessments at least every six months.
• Training. Section 314.4(e) requires security awareness training for personnel.
• Service-provider oversight. Section 314.4(f) requires choosing providers that can protect the data, requiring safeguards by contract, and periodically assessing them.
• Keeping it current. Section 314.4(g) requires adjusting the program after testing, material changes to the business, or new risk assessments.
• Incident response plan. Section 314.4(h) requires "a written incident response plan" covering seven listed areas.
• Annual report. Section 314.4(i) requires the Qualified Individual to report in writing "regularly and at least annually" to the board or, where there is none, to a senior officer.
• FTC notice. Section 314.4(j) requires notice to the FTC within 30 days after discovering a breach involving at least 500 consumers.

IRS Publication 4557 (Rev. 6-2024) summarizes the same list for tax firms and adds that the plan "must be appropriate to the company's size and complexity, the nature and scope of its activities and the sensitivity of the customer information it handles."

How to turn these elements into the sections of an actual template, one page at a time, is the subject of the WISP template for tax professionals, section by section.

Element map for Alder Street Tax (example)

The table maps each element to an owner, the evidence that shows it is done, and how often it is reviewed. Alder Street Tax is a fictional two-preparer office with one seasonal assistant; the names and intervals are examples.

The evidence column is the useful one. A plan that says "MFA is on" is a claim. A dated list of accounts with MFA status is evidence.

How detailed should a solo preparer's WISP be?

A solo preparer's WISP should be as detailed as the practice's data and systems require, and no more. The Safeguards Rule lets a plan scale to size and complexity, and 16 CFR 314.6 removes four specific provisions for firms holding customer information on fewer than 5,000 consumers. Everything else still applies.

The exemption is narrow. 16 CFR 314.6 (eCFR) drops the written risk assessment, the testing schedule, the written incident response plan and the annual report, and every other element, including MFA and encryption, still applies; the full list and how the 5,000 count works are in Safeguards Rule exemptions for small tax firms.

The IRS sample plan goes further than the exemption requires. Publication 5708's template includes an incident and breach-notification section and a review "at least annually" for every firm, and it says "There is no one-size-fits-all WISP." Whether a small firm keeps those sections is its own decision; the publication offers them as a starting point.

What a solo plan can shorten in practice:

• Roles. One person can be the Qualified Individual, the trainer and the contact for vendors. Publication 5708 suggests different people for the Data Security Coordinator and the Public Information Officer "in most firms of two or more practitioners," which leaves a one-person office to name itself for both.
• Inventory. A laptop, a phone, a backup drive and a handful of cloud accounts may be the whole list.
• Training. The owner can record their own annual review of the plan with a dated signature.

What it cannot shorten is the substance: a list of where client data lives, the risks to it, and the controls that answer each risk.

Keeping a WISP current between tax seasons

A WISP is current when it still describes how the firm actually handles client data today. Publication 5708 calls the WISP "an evergreen document" and its template asks for review "at least annually or whenever there is a material change." The Safeguards Rule's section 314.4(g) also requires adjusting the program after material changes to operations.

The quiet months after the filing season are a practical time for the annual review. The Publication 5708 template has a "Last Modified/Reviewed" line on its cover page for exactly this. Fill in the date and initial it each year so a reader can see the plan was looked at, not just kept.

Changes that should trigger an update outside the annual review:

• A new hire or a departure. Accounts are added or closed, and access levels change. Publication 5708's sample authorized-access list records "date access granted, and date access Terminated" for each person.
• A new vendor or a dropped one. A new tax software, document tool, backup service or IT contractor changes the service-provider list and may change where client files live.
• A new office or a move to remote work. Physical safeguards, Wi-Fi and remote access policies all change.
• New devices. A replacement laptop or a new scanner goes on the inventory with its location and the type of data it holds.
• A security incident. Publication 5708's template requires a post-incident review and says changes are "tracked and kept on file as an addendum to this WISP."

A firm that collects client documents through an outside tool should list that tool too. A firm using Schema CPA would add it to the inventory and the service-provider list as the place each client's uploads land; the workflow section of the homepage shows what it does with those documents.

Phishing threats, staff turnover and software changes tend to cluster around the filing season. The tax season workflow category covers how firms organize the rest of that season.

WISP mistakes that leave a preparer exposed

The most common WISP mistakes are a template filed but never followed, no named owner, and an asset list that is years old. Each one turns the plan from a description of the firm's real practices into a document that says one thing while the office does another.

A template filed but never followed. Publication 5708 says its sample "is not intended to replace your own research, to create reliance or serve as a substitute for developing your own plan." A plan that copies sample policies the firm never adopted, such as event-log reviews every 90 days or weekly antivirus tests, describes controls that do not exist. Edit each sample policy down to what the firm does, or change what the firm does.

No named owner. The rule's first element is a Qualified Individual, and the Publication 5708 template opens its responsibilities section with a blank for the coordinator's name. A plan with "[Employee’s Name]" still in place has no owner. If the owner leaves, the plan should be updated the same week.

An asset list that is years old. Publication 4557 tells firms to "Perform an inventory of devices where client tax data are stored" and to inventory the software used to process or send tax data. An inventory that lists a laptop sold two years ago and leaves out the new phone gives the wrong picture of where client data lives.

Unsigned staff acknowledgments. Publication 5708 recommends a signed Employee/Contractor Acknowledgment of Understanding, updated at annual training. Missing signatures leave no record that training happened.

A plan nobody can find. The template expects the WISP to be available to employees, and Publication 5708 recommends a copy stored offsite or in the cloud. A plan locked on the owner's laptop helps no one if that laptop is the thing that was stolen.

Treating the WISP as the whole job. Publication 5708 says a WISP "is just one part of what tax professionals need to protect their clients and themselves." Publication 4557's safeguarding checklist covers the practices behind the plan; the IRS Publication 4557 checklist for firms turns it into yes or no checks with an owner and a date for each.