A written information security plan (WISP) is the document that says how your firm protects client information: who is in charge, what the risks are, which safeguards you use and what you do when something goes wrong. Tax and accounting firms have to have one. In August 2026 the IRS and its Security Summit partners put it plainly: “Federal law requires tax and accounting professionals to create and maintain a Written Information Security Plan.”
The federal law behind it is the FTC Safeguards Rule (16 CFR Part 314), which applies to tax preparers as financial institutions under the Gramm-Leach-Bliley Act. The IRS publishes a sample plan, Publication 5708, built for smaller practices.
Talk to an advisor
Ask about your own setup.
We ask what you’re trying to accomplish and tell you what we’d look at first. It costs nothing to talk, and no price comes up on this call.
What a WISP must include under the FTC Safeguards Rule
Section 314.4 lists the elements. The plain-language version:
| Element | What it means for a firm | Rule |
|---|---|---|
| A Qualified Individual | One person oversees the program. It can be an employee or an outside provider. | 314.4(a) |
| A written risk assessment | Where client data lives, what could go wrong, and how well current safeguards hold up | 314.4(b) |
| Safeguards | Access limited to people who need it, encryption in transit and at rest, multi-factor authentication for anyone accessing your systems, secure disposal, change management, and logging of user activity | 314.4(c) |
| Testing | Continuous monitoring, or a yearly penetration test plus vulnerability scans at least every six months | 314.4(d) |
| Staff training | Security awareness training, updated as risks change | 314.4(e) |
| Vendor oversight | Choose providers that can protect the data, require it in the contract and check on them | 314.4(f) |
| Keep it current | Update the plan when the firm, its systems or its risks change | 314.4(g) |
| Incident response plan | Written steps for responding to and recovering from a security event | 314.4(h) |
| Annual report | The Qualified Individual reports in writing at least once a year to the owners or a senior officer | 314.4(i) |
| FTC notification | Tell the FTC within 30 days of discovering an event involving 500 or more consumers | 314.4(j) |
Firms with customer information on fewer than 5,000 consumers are exempt from four items: the written risk assessment, the penetration testing schedule, the written incident response plan and the annual report (16 CFR 314.6). Everything else still applies, and the IRS still expects a written plan. We’d write the incident response plan anyway. You need it on the worst day of the year, not for the rule.
Louisiana adds its own requirements
If your firm does business in Louisiana, state law also requires “reasonable security procedures and practices” for personal information, secure destruction of records you no longer keep, and notice to affected residents no later than 60 days after discovering a breach (La. R.S. 51:3074). Your WISP should name both the federal and the state steps.
How to write a WISP that holds up
- Name your Qualified Individual and the senior person who oversees them.
- List where client data lives: tax software, the document portal, email, file shares, scanned paper, laptops, phones and backups.
- Write the risk assessment against that list.
- Write down the safeguards you actually use, not the ones in the template. A plan that describes controls you don’t have is worse than a short honest one.
- Add the incident response steps, including who calls the IRS Stakeholder Liaison and the state.
- Set a date to review it every year, and after any change in staff, software or offices.
What a WISP looks like in practice
A plan is only as good as the controls under it. For our accounting and financial clients, those include multi-factor authentication on every account (phishing-resistant keys for administrators), backups that run hourly, copy off-site daily and can’t be altered once written, ongoing phishing simulations with short training when someone clicks, and same-day shutoff of access when someone leaves. We write the policies, and every new client goes through our compliance checklist at onboarding.
If your WISP was downloaded, filled in once and filed, it’s worth a second look before tax season. Book a 15-minute call and we’ll tell you what we’d check first. See how we work with accounting and financial firms.
Frequently asked questions
What does WISP stand for?
Written information security plan. It’s the document that describes how a business protects the customer information it holds. The FTC Safeguards Rule calls it an information security program.
Does a solo tax preparer need a WISP?
Yes. The IRS says tax professionals are legally required to have a written plan, and it built Publication 5708 with smaller practices in mind. The Safeguards Rule’s small-firm exemption removes some items, but not the plan itself.
Is a WISP required for tax preparers?
Yes. The FTC Safeguards Rule requires tax preparers, as financial institutions under the Gramm-Leach-Bliley Act, to have a written information security program. The IRS reminds preparers of this in Publication 4557 and publishes a sample plan in Publication 5708 that firms can adapt.
How often should a WISP be updated?
Review it at least once a year and whenever something important changes, such as a new software system, an office move, a new vendor with access to client data or a security incident. Under the FTC Safeguards Rule, the person running the program must report on it in writing at least annually to the firm’s owners or board.
Sources
Next step
Let us handle this for you.
We tell you which rules apply, put safeguards in place and hand you the policies.
- 15 minutes
Tell us which question brought you here and how your office runs.
We’ll tell you how it applies to you and what we’d look at first.
If we’re not the right fit, we’ll say so.
15 minutes
