WISP template for tax professionals, section by section

The standard WISP template for tax professionals is the sample plan in IRS Publication 5708. Fill it in one section at a time with your own facts: the devices and accounts where client data lives, the risks to that data, the safeguard and owner for each risk, a response page with real phone numbers, and a dated signature.

Where does the IRS WISP template for tax professionals come from?

The IRS WISP template for tax professionals is Publication 5708, "Creating a Written Information Security Plan for your Tax & Accounting Practice." The IRS released it with its Security Summit partners, the state tax agencies and tax industry groups it works with. The current revision is dated August 2024. It is a sample to adapt, not a form to file.

The IRS announced the updated version in IR-2024-208 (August 13, 2024), describing it as "a 28-page template designed to help tax pros, particularly smaller practices." The same release says "The sample is not intended to be the final word on written security plans," and that it is meant to give tax professionals "a place to start."

IRS Publication 5708 (Rev. 8-2024) is direct about its limits. It "is not intended to replace your own research, to create reliance or serve as a substitute for developing your own plan based upon the specific needs and requirements of your business or firm."

That is what "IRS mandated" does and does not mean. The legal duty to keep a written plan comes from the FTC Safeguards Rule, which Publication 5708 cites: "A requirement of the Safeguards Rule is implementing and maintaining a WISP." The IRS template itself is not mandatory. A firm can write its plan in another format, as long as the plan covers what the rule requires. Who must keep a plan and the full list of required elements are set out in the required elements of a tax preparer WISP.

The template has seven numbered parts: objective, purpose, scope, identified responsible officials, inside-the-firm risk mitigation, outside-the-firm risk mitigation, and implementation. Six sample attachments follow: record retention, rules of behavior, breach procedures, staff acknowledgment, hardware inventory, and an authorized-access list. Publication 5708 also lists IRS Publication 4557, Safeguarding Taxpayer Data as a resource to review before starting.

Sample outline for Birchwood Lane Tax Group (example)

Birchwood Lane Tax Group is a fictional three-person firm: an owner who is an enrolled agent, one staff preparer (Ana Ruiz), and an office manager. Every name and detail below is an example, written one paragraph per template section.

I. Objective. Birchwood Lane Tax Group keeps this plan to protect the personal information of its individual and small-business clients and its own staff, and to meet its obligations under the Gramm-Leach-Bliley Act and the FTC Safeguards Rule.

II. Purpose. The plan sets out how the firm keeps client information confidential, guards it against foreseeable threats, and prevents access that could lead to identity theft.

III. Scope. The plan covers paper files in the locked cabinet in the back office, the three firm laptops, the office manager's firm phone, the tax software account, the firm email accounts, the document intake tool and the encrypted backup drive.

IV. Responsible officials. Maria Chen, owner, is the Data Security Coordinator and the Qualified Individual under the Safeguards Rule. Leo Park, office manager, is the Public Information Officer and handles all client and press communication after an incident.

V. Inside the firm. Access to client files is limited to the three staff. Each person has a unique login with multi-factor authentication. Staff sign an acknowledgment at hire and at the annual training in May. Departing staff lose access on their last day, and the authorized-access list records the date.

VI. Outside the firm. Each laptop runs the operating system's built-in antivirus and firewall with automatic updates. Drive encryption is on for every laptop. Guest Wi-Fi is a separate network from the office network. Remote access is allowed only with multi-factor authentication.

VII. Implementation. Effective June 2, 2026, signed and dated by Maria Chen as owner and as Data Security Coordinator, with a note that no additional state requirements were identified at the last review.

Attachments. A record retention schedule, the rules of behavior sheet posted by the printer, the breach contact page, the signed acknowledgments, the hardware inventory and the authorized-access list.

Template section one: the firm's data and device inventory

The data and device inventory lists every place client information is stored or processed: computers, phones, network equipment, paper files and online accounts. Publication 5708 calls it "Inventory Hardware" and asks for a description and physical location of each item and the types of information it stores or processes. Its Sample Attachment E is the form.

Publication 5708's own example lines show the level of detail: a business cell phone "located with Jane Doe, processes emails from clients," and a network router "located in the back storage room." Short, specific and current.

The template's inside-the-firm section suggests where to look. Its list of places client information may be stored includes servers and removable drives, filing cabinets and off-site storage firms, workstations and laptops, client portals and electronic document management, online and cloud applications, and bookkeeping and tax software.

A useful inventory line has four parts:

• What it is, such as "laptop, serial ending 4821" or "firm email account."
• Where it is, a room, a person, or "cloud" with the account owner's name.
• What client data it holds, such as returns, scanned source documents, or email with attachments.
• Who can access it, by name.

Online accounts are the lines most often missed. Each one that receives or stores client documents belongs on the list, including the tax software, the email system, any file-sharing service and any document intake tool. A firm that collects documents through Schema CPA, for instance, would add a line noting that each client's uploads, emailed attachments and phone photos land in that client's file there. The workflow section of the homepage describes how those files arrive.

Paper counts too. Publication 5708 tells firms to "Include paper records by listing filing cabinets, dated archive storage boxes, and any alternate locations of storage that may be off premises." How a firm names and files client folders, which makes the inventory easier to keep, is covered in the organizing client files category.

Template section two: the risk list and the safeguards that answer it

The risk list names each way client information could be lost, exposed or made unavailable, and pairs it with a safeguard and the person who owns that safeguard. Publication 5708's "Assess Risks" step asks firms to list the types of information handled, the potential types of loss, and the procedures for monitoring and testing.

Publication 5708 gives examples of loss to consider: "physical theft of paper or electronic files, electronic data theft due to Remote Access Takeover of your computer network, and loss due to fire, hurricane, tornado or other natural cause." It also asks firms to think about "unauthorized access and disclosure and loss of access."

The Safeguards Rule sets out what a written risk assessment must contain. 16 CFR 314.4(b)(1) (eCFR, current as of October 14, 2026) requires criteria for categorizing risks, criteria for assessing confidentiality, integrity and availability, and requirements "describing how identified risks will be mitigated or accepted."

A three-column format keeps each risk tied to its answer:

Writing the owner's name next to each control is what turns the list into a plan. The six technical protections the IRS calls the Security Six, which answer many rows in a table like this, are explained in IRS Security Six: the six protections.

The template's sixth part, outside-the-firm risk mitigation, is where the safeguards are written as policies: network protection, user access, electronic exchange of client information, Wi-Fi, remote access, connected devices and training. Rewrite each sample policy to match what the firm does.

Template section three: the incident response page

The incident response page tells staff what to do in the first hours after a suspected breach: who to call, in what order, and with what numbers. Publication 5708's Sample Attachment C, "Security Breach Procedures and Notifications," is the template, and it says the attachment "will need to be updated annually for accuracy."

Attachment C lists who the firm notifies if client information is stolen or lost:

• The IRS Stakeholder Liaison.
• The state Attorney General's office.
• State tax agencies, through the state-by-state "Report a Breach" page the attachment points to.
• The FBI's Internet Crime Complaint Center, for a cybercrime involving electronic data theft.
• The Federal Trade Commission, for security events affecting 500 or more people, within 30 days of discovery.
• Local law enforcement.
• The tax software vendor, the liability insurance carrier and legal counsel.

Fill in each line with a name, a phone number and the date it was last checked, before anything happens. Looking up the local Stakeholder Liaison during an incident wastes the hours that matter most. The full sequence of steps for reporting a theft is in how to report data theft to the IRS as a tax preparer.

The Safeguards Rule lists what a written incident response plan addresses. Section 314.4(h) names seven areas, including "The definition of clear roles, responsibilities, and levels of decision-making authority" and "External and internal communications and information sharing." Publication 5708's two roles map onto these: the Data Security Coordinator runs the response and the Public Information Officer speaks for the firm.

Add the firm's IT contractor to the page too, and fill in the carrier and counsel lines only if the firm has them. Publication 5708's template makes the coordinator responsible for "any Data Theft Liability Insurance, Cyber Theft Insurance Riders, or Legal Counsel on retainer."

Which template sections can a sole proprietor shorten?

A sole proprietor can shorten the template's roles, inventory, training records and policy text to fit a one-person office. The elements the Safeguards Rule requires for every firm stay, including a named Qualified Individual, multi-factor authentication, encryption, a risk-based set of safeguards and service-provider oversight.

Publication 5708 expects this. It says "a sole practitioner can use a more abbreviated and simplified plan than a 10-partner accounting firm" and asks firms to "scale the comprehensiveness to your firm's size and type of operation."

Sections a one-person practice can often state in a line or two:

• Responsible officials. "Jordan Ellis, owner, serves as Data Security Coordinator and Public Information Officer."
• Personnel accountability. With no employees, background checks and termination procedures can be noted as not applicable until the first hire.
• Training. A dated note of the owner's own annual review.
• Authorized-access list. One name, plus any IT contractor with access.

Sections that stay full length even for one person are the inventory, the risk list, the safeguards and the breach contact page. These describe the data and what protects it, and they do not get shorter with fewer staff.

The Safeguards Rule removes four specific provisions for firms with customer information on fewer than 5,000 consumers. Which four provisions that exemption removes is set out in Safeguards Rule exemptions for small tax firms.

Template pitfall: signing a plan that names tools the firm does not use

The most damaging template mistake is signing a plan that describes tools, schedules and controls the firm does not have. Publication 5708's implementation clause asks the owner and the coordinator to sign and date the plan. A signature under boilerplate turns every unmet promise in it into a written statement the firm made and did not keep.

The sample template contains several specific commitments that a small firm may copy without noticing:

• Event logs reviewed by the coordinator or IT partner "at random intervals not to exceed 90 days."
• A "top-down security review at least every 30 days."
• Antivirus "tested weekly to ensure the protection is current."
• A firewall "secured and maintained by the Firm's IT Service Provider."
• Named example products for authenticator apps and password managers.

Each is reasonable for some firms. For a firm without an IT provider, or that uses different tools, each is a sentence that does not describe reality. If the plan is ever read after an incident, the gap between the written control and the actual practice is the first thing anyone will see.

The fix is to edit, not delete. For each sample commitment, either change it to what the firm actually does ("antivirus updates automatically; the owner checks status monthly") or adopt the control as written and start doing it. Then note the change in the plan's review history.

Brackets left in place are the other giveaway. A signed plan that still reads "[Your Firm Name]" or "[Employee’s Name]" shows it was never finished. Search the document for "[" before signing.