If you prepare tax returns for pay, federal law requires your firm to have a written information security plan, usually called a WISP. This guide covers four questions:
- who needs a WISP
- what the plan has to cover
- what the IRS asks preparers to confirm
- how to build one without starting from a blank page
It reflects the FTC rule and IRS guidance as of November 7, 2026. It's general information, not legal advice.
The short answer
- Paid preparers need one.
- The FTC's Safeguards Rule treats an accountant or other tax preparation service that completes income tax returns as a financial institution [2].
- It requires every financial institution it covers to keep a written information security program [1].
- The IRS calls it a WISP and says the requirement applies regardless of firm size [3].
- You've probably confirmed it already. The PTIN application and renewal form asks preparers to confirm they know the law requires a WISP [4].
- There's a free template. IRS Publication 5708, prepared by the Security Summit, includes a sample plan and sample attachments [3].
- The plan has to match how your firm really works. It must:
- name a Qualified Individual
- rest on a risk assessment
- describe real safeguards, such as multi-factor authentication, encryption, staff training and vendor oversight [5]
- Small firms get a partial break. Firms with customer information on fewer than 5,000 consumers are exempt from four requirements, including the written risk assessment and the written incident response plan. They still need the plan itself [6].
- Breaches have a deadline. Since May 13, 2024, a breach of unencrypted information about 500 or more consumers must be reported to the FTC as soon as possible, and no later than 30 days after discovery [5] [7].
Who needs a WISP
The Safeguards Rule covers a long list of businesses it calls financial institutions. One of its examples is "an accountant or other tax preparation service that is in the business of completing income tax returns" [2]. The FTC's own guide to the rule lists tax preparation firms among its examples too [8]. IRS Publication 5708 says that under the Gramm-Leach-Bliley Act and the Safeguards Rule, tax and accounting professionals are financial institutions regardless of size [3].
Size changes how detailed the plan needs to be, not whether you need one. The rule asks for safeguards appropriate to your size and complexity [1]. Publication 5708 says a sole practitioner can use a shorter, simpler plan than a 10-partner firm [3].
The IRS also asks you to confirm it. Form W-12 is the IRS application and renewal form for a preparer tax identification number (PTIN). It includes a data security statement that preparers confirm: they are aware that paid tax return preparers are required by law to create and maintain a written information security plan [4].
What if your firm doesn't prepare returns? Then the rule's tax preparer example may not apply to you, but other services can still bring a firm under the rule. The FTC's examples also include financial advisors and some investment advisors [8]. AICPA members in public practice also have confidentiality duties under the AICPA's Confidential Client Information Rule [9]. Your attorney can tell you which rules apply to your firm.
What your plan has to cover
The Safeguards Rule spells out what the program must include [5]. Here is each requirement in plain terms, and whether it applies to a firm with customer information on fewer than 5,000 consumers [6].
| Requirement | What it means for a small firm | Under 5,000 consumers |
|---|---|---|
| Qualified Individual | One person oversees and enforces the plan. It can be someone at your firm, an affiliate or an outside provider. If you use a provider or affiliate, your firm keeps responsibility, a senior person at your firm oversees them, and you must require them to keep a security program that protects your firm. | Applies |
| Risk assessment | Identify the internal and external risks to client data and check whether your safeguards are enough. Repeat it from time to time. | Applies, but it doesn't have to be written |
| Access controls | Only authorized people get in, and each person sees only the client data they need for their work. | Applies |
| Inventory | Know the data, people, devices, systems and facilities your firm relies on. | Applies |
| Encryption | Encrypt client information on your systems and when it travels over outside networks. If that isn't feasible, your Qualified Individual must approve other effective controls. | Applies |
| Software security | Have a way to check the security of outside software you use for client data, such as tax software and client portals. If you build your own software, follow secure development practices. | Applies |
| Multi-factor authentication | Required for anyone signing in to any information system, unless your Qualified Individual approves an equally or more secure method in writing. | Applies |
| Secure disposal | Dispose of client information no later than two years after you last used it to serve the client. You can keep it longer when you need it for business, the law requires it, or targeted disposal isn't reasonably feasible because of how it's stored. Review your retention policy from time to time. | Applies |
| Change management | Have a procedure for making changes to your systems. | Applies |
| Monitoring and logging | Monitor and log what authorized users do, and detect unauthorized access or tampering. | Applies |
| Testing | Regularly test or monitor your safeguards. Without continuous monitoring, the rule calls for annual penetration testing and vulnerability scans at least every six months. | Regular testing or monitoring applies. The requirement for continuous monitoring or penetration tests and vulnerability scans doesn't. |
| Staff training | Give staff security awareness training, keep it current, and use qualified security people, your own or a provider's. | Applies |
| Vendor oversight | Choose providers that can protect client data, require it in their contracts and check on them from time to time. | Applies |
| Keeping it current | Adjust the plan after tests, business changes or new risks. | Applies |
| Incident response plan | A written plan for responding to and recovering from a security event. | Doesn't apply |
| Annual report | The Qualified Individual reports in writing at least once a year to your board, or to a senior officer if you have no board. | Doesn't apply |
| FTC breach notice | Report a breach of unencrypted information involving 500 or more consumers as soon as possible, and no later than 30 days after you discover it. | Applies |
What the IRS adds
Publication 5708 gives you an outline to follow [3]. Its sample plan covers:
- Objectives, purpose and scope.
- Your Qualified Individual, and the authorized users with their access levels.
- A risk assessment.
- A hardware inventory.
- The safety measures in place, with suggested policies on:
- data collection and retention
- data disclosure
- network protection
- user access
- electronic data exchange
- Wi-Fi
- remote access
- connected devices
- reportable incidents
- An employee code of conduct.
- An implementation clause.
- Sample attachments:
- record retention
- rules of behavior
- breach procedures
- an employee and contractor acknowledgment
- a hardware inventory
- a list of people authorized to access client data
It also offers practical advice [3]:
- Cover physical, technical and administrative safeguards.
- Have every employee and contractor sign an acknowledgment, updated at each annual training.
- Keep the plan in a readable format such as PDF or Word, with a copy stored offsite or in the cloud.
- Treat it as a living document that you review, test and update as your firm changes.
The IRS calls its Security Six an essential starting point for protecting a tax office [10]:
- anti-virus software
- firewalls
- multi-factor authentication
- backup software or services
- drive encryption
- a virtual private network (VPN)
For a wider checklist, see IRS Publication 4557, Safeguarding Taxpayer Data [11].
How to build your WISP, step by step
- Name your Qualified Individual. Write down who it is. If it's an outside IT provider, also name the senior person at your firm who oversees them, and require the provider to keep a security program that protects your firm [5].
- List where client data lives. Include computers, phones, servers, tax software, cloud storage, client portals, email and paper files, and note who can reach each one.
- Assess the risks. For each place, ask what could go wrong and what protects it today. Examples include a phishing email, a lost laptop, a former employee's account that still works, or a breach at a vendor.
- Close the obvious gaps first. Turn on multi-factor authentication everywhere, encrypt laptops and backups, and put the rest of the Security Six in place [10].
- Write the policies. Start from the Publication 5708 template. Cover data retention and disposal, access, remote work, Wi-Fi, email and file exchange, and what to do when something goes wrong [3].
- Train your staff and collect signatures. Use a signed acknowledgment for every employee and contractor, and renew it at each annual training [3].
- Check your vendors. Make sure your contracts with tax software, cloud, IT and portal providers require them to protect client data [5].
- Test it. Restore a backup, and walk your team through your breach steps.
- Keep it current. Update the plan whenever your firm changes, for example with new software, new staff or a new office. Firms with customer information on 5,000 or more consumers also need a written report to the board or a senior officer at least once a year [5] [6].
If client data is stolen
- Report to the IRS. The IRS tells tax professionals to report client data theft to their local IRS Stakeholder Liaison [12].
- Work through the IRS's other steps. Its data theft page also covers contacting law enforcement, notifying state tax agencies through the Federation of Tax Administrators, checking whether you must notify each state's attorney general, and contacting affected clients [12] [13].
- Notify the FTC if 500 or more consumers are affected. The Safeguards Rule calls this a notification event: unencrypted client information acquired without authorization. If it involves 500 or more consumers, you must notify the FTC as soon as possible, and no later than 30 days after you discover it [5]. The FTC takes these reports through an online form [14].
Where IT help fits
A WISP is your firm's document, and your firm stays responsible for it. Many of the safeguards it describes are everyday IT work:
- multi-factor sign-in
- endpoint detection and response
- patching
- backups
GBTech's Managed IT handles those. Our free security assessment shows where your firm is exposed, from email and browsers to the internal network.
Start a free security assessment →
Prefer to talk first? Book a free 15-minute call, or write to sales@gbtech.ai. For more on how we work with firms like yours, see technology for accounting and CPA firms.
Frequently asked questions
Is a WISP the same as the FTC's "information security program"?
For practical purposes, yes. The rule requires a comprehensive information security program that is written in one or more readily accessible parts [1]. The IRS calls that document a written information security plan, or WISP [3].
Do I need a WISP if I'm a sole practitioner?
If you prepare returns for pay, yes. The IRS says the requirement applies regardless of size, though a solo practice can use a shorter plan [3].
Can I just use the IRS template?
It's a good starting point, but the IRS says it isn't a substitute for a plan based on your own business [3]. Your plan has to describe the systems, people and vendors you actually use.
Who can be our Qualified Individual?
Someone at your firm, an affiliate or a service provider. The FTC says the person doesn't need a particular degree or title; what matters is real-world know-how suited to your circumstances [8]. If you use a provider or affiliate, your firm keeps responsibility, a senior person at your firm must oversee them, and you must require them to keep a security program that protects your firm [5].
How long should we keep client records?
Paid preparers must keep a copy of each return they prepare, or a list of the taxpayers and returns, for three years after the close of the return period [15]. The Safeguards Rule asks you to dispose of client information no later than two years after you last used it, but it makes an exception for information the law requires you to keep, so retention rules like this one still apply [5].
What counts as a breach we have to report to the FTC?
The rule calls it a notification event: someone acquiring unencrypted client information without authorization. Unauthorized access counts as acquisition unless you have reliable evidence that the information wasn't, or couldn't reasonably have been, acquired. Information also counts as unencrypted if an unauthorized person got the encryption key [2]. You must report it to the FTC if it involves 500 or more consumers [5].
Sources
- eCFR, 16 CFR 314.3, Standards for safeguarding customer information (current to November 5, 2026): https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314/section-314.3
- eCFR, 16 CFR 314.2, Definitions, paragraphs (h)(2)(viii) and (m): https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314/section-314.2
- IRS, Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice (Rev. 8-2024): https://www.irs.gov/pub/irs-pdf/p5708.pdf
- IRS, Form W-12, IRS Paid Preparer Tax Identification Number (PTIN) Application and Renewal (Rev. October 2026), line 11: https://www.irs.gov/pub/irs-pdf/fw12.pdf
- eCFR, 16 CFR 314.4, Elements: https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314/section-314.4
- eCFR, 16 CFR 314.6, Exceptions: https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314/section-314.6
- Federal Register, Standards for Safeguarding Customer Information, final rule (November 13, 2023): https://www.federalregister.gov/documents/2023/11/13/2023-24412/standards-for-safeguarding-customer-information
- Federal Trade Commission, FTC Safeguards Rule: What Your Business Needs to Know (December 2024): https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know
- AICPA, Code of Professional Conduct, Confidential Client Information Rule (1.700.001): https://pub.aicpa.org/codeofconduct/ethicsresources/et-cod.pdf
- IRS, Security Summit warns tax pros to watch out for phishing emails and other attacks, IR-2026-85 (August 4, 2026): https://www.irs.gov/newsroom/security-summit-warns-tax-pros-to-watch-out-for-phishing-emails-and-other-attacks
- IRS, Publication 4557, Safeguarding Taxpayer Data (2024 revision): https://www.irs.gov/pub/irs-pdf/p4557.pdf
- IRS, Data theft information for tax professionals: https://www.irs.gov/individuals/data-theft-information-for-tax-professionals
- Federation of Tax Administrators, Report a Data Breach: https://www.taxadmin.org/report-a-data-breach/
- Federal Trade Commission, Safeguards Rule Security Event Reporting Form: https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act/safeguards-rule-form
- Cornell Law School, Legal Information Institute, 26 U.S. Code § 6107, Tax return preparer must furnish copy of return to taxpayer and must retain a copy or list: https://www.law.cornell.edu/uscode/text/26/6107