What goes in a WISP, and how to write yours.

The short answer

A WISP (written information security plan) is the document that explains how your practice protects client information, who is in charge of it, and what you'll do if something goes wrong. The FTC Safeguards Rule (16 CFR Part 314) treats tax preparers as financial institutions and requires a written information security program. The IRS calls that program a WISP and says federal law requires tax and accounting professionals to create and maintain one. Its PTIN application, Form W-12, even asks you to check a box acknowledging it.

In short, a WISP names the person responsible, lists where client data lives, assesses the risks, describes your safeguards, covers vendors and staff training, and explains how you'll respond to an incident and keep the plan current.

What the FTC rule says it must include

Section 314.4 of the rule lists the elements. In plain English:

• A Qualified Individual who oversees the program. It can be you, an employee or an outside provider. With a provider, your firm stays responsible and names a senior person to supervise them.
• A written risk assessment: what client information you hold, where it lives, and what could realistically go wrong.
• Safeguards for those risks: access limited to the people who need it, an inventory of your data and systems, encryption of client information stored and sent, multi-factor sign-in for anyone who reaches it, a way to check the security of the software you use, secure disposal (generally within two years of your last use of the information, unless the law or a real business need says keep it), change management, and logs of user activity.
• Testing: continuous monitoring, or a penetration test every year plus vulnerability scans at least every six months.
• Security-awareness training for your staff, kept up to date.
• Vendor oversight: choose providers that can protect the data, require it in their contracts, and check on them periodically.
• Keeping it current as your business, systems and risks change.
• A written incident response plan.
• A yearly written report from the Qualified Individual to the owner or board.

One more rule applies to every practice: if unencrypted information about 500 or more people is acquired without authorization, you must notify the FTC no later than 30 days after you discover it.

If you keep records on fewer than 5,000 people

Smaller practices get a lighter version. If you maintain information on fewer than 5,000 consumers, four items don't apply (section 314.6): the formal written-risk-assessment requirements, the monitoring-or-testing schedule, the written incident response plan and the yearly report. Count everyone whose information you keep, past clients included.

Everything else still applies: the written plan itself, a Qualified Individual, multi-factor sign-in, encryption, access controls, training and vendor oversight. We'd still write a short breach plan. It's the page you'll want on the worst day of tax season, and the IRS sample plan includes one.

How to write it, step by step

You can start from the IRS's free sample plan, Publication 5708, or from our builder. Either way, these are the steps:

• Name your Qualified Individual. In a small office it's usually the owner. Put the name in writing.
• List where client data lives: tax software, your client portal, email, computers and phones, cloud storage, backups, the scanner or copier, and paper files.
• Assess the risks in each place. Who can get in? What happens if a laptop is stolen or a password leaks? How bad would it be?
• Write down your safeguards, the ones you have and the ones you'll add, with a date for each. Start with multi-factor sign-in, encryption on every computer, a separate login for everyone and automatic updates.
• List your vendors (tax software, portal, IT help, cloud storage, shredding) and check that their contracts require them to protect your clients' data.
• Plan for a bad day: who decides, and who you contact in what order. The IRS asks tax pros to contact their local IRS Stakeholder Liaison right away after a data theft. Add the FTC notice for 500 or more people, and your state's rules: in Texas, the Attorney General must be told within 30 days when 250 or more Texans are affected.
• Train your team, and have everyone sign that they've read the plan.
• Set a review date. The IRS says to review, test and update the plan regularly. Put it on the calendar at least once a year, and revisit it whenever you change software, offices or vendors.

The mistakes that make a WISP useless

• Downloading a template and never filling it in.
• Describing safeguards you don't have. A plan that says every laptop is encrypted when it isn't is worse than an honest to-do list.
• No named person in charge.
• Forgetting vendors and paper files.
• Writing it once and never opening it again.

Three ways to get yours done

Free: our WISP Builder asks about 25 plain-English questions and fills in a plan built on the structure of IRS Publication 5708 and the elements of 16 CFR 314.4, with a to-do list for every gap. It takes about 15 minutes, nothing you type is sent anywhere unless you choose to, and you can print it or download it for Word.

Done for you, $497 one time: a 30-minute video interview, then we write the plan with you, fill in every attachment and check multi-factor sign-in, encryption and backups with you. It's delivered in 5 business days.

Kept current all year, $249 a month: Safeguards Essentials, for offices of 1–5 people. We act as your Qualified Individual (you stay responsible under the rule and name a senior person to oversee us), hold a quarterly check-in and the annual review, and train your staff every year.

Compare all three on our WISP for tax preparers page. Rather keep it up yourself? Safeguards Tracker reminds you when each item is due, for $49 a month after a 14-day free trial.

Quick answers

What is a WISP? A written information security plan: the document that explains how a tax or accounting practice protects client information, who is responsible for it, and what happens if something goes wrong. The FTC Safeguards Rule calls it a written information security program; the IRS calls it a WISP.

What must a WISP include? Under the FTC Safeguards Rule: a Qualified Individual, a risk assessment, safeguards such as access controls, encryption and multi-factor sign-in, testing or monitoring, staff training, vendor oversight, a way to keep it current, an incident response plan and a yearly report to the owner. Offices with information on fewer than 5,000 people don't need the formal written risk assessment, the testing schedule, the written incident response plan or the yearly report.

Is there a free WISP template for tax preparers? Yes. The IRS publishes a free sample plan, Publication 5708. Our free WISP Builder uses the same structure and fills it in from your answers in about 15 minutes.

How often should a WISP be updated? Review it at least once a year and whenever something material changes, like new software, a new office, a new vendor or a security incident. The IRS says plans should be reviewed, tested and updated regularly, and the FTC rule requires adjusting the program as your business changes.

Who can be the Qualified Individual in a small tax office? Usually the owner, but it can be an employee or an outside provider. With a provider, your firm stays responsible under the rule and names a senior person to oversee them.

Sources

• FTC Safeguards Rule, 16 CFR Part 314 (sections 314.2, 314.4 and 314.6)
• FTC: Safeguards Rule, what your business needs to know
• IRS: tax pros need a Written Information Security Plan (IR-2026-92)
• IRS Publication 5708, the sample WISP
• Instructions for Form W-12
• IRS: data theft information for tax professionals
• Texas Business and Commerce Code, chapter 521

This article is general information, not legal advice.