A WISP template built element by element from the Safeguards Rule
A written information security plan is not optional for a tax practice. The FTC's Safeguards Rule treats tax preparers as financial institutions, and the IRS has preparers acknowledge the requirement on Form W-12, the PTIN application and renewal.
A WISP, or written information security plan, is the document in which a tax or accounting firm sets out how it protects the client information it holds: who is responsible, what the risks are, the safeguards against them, and what happens after a breach. The requirement comes from the Gramm-Leach-Bliley Act and the FTC's rule under it, 16 CFR Part 314. The rule names "tax preparation firms" among the businesses it covers, and says an accountant or other tax preparation service in the business of completing income tax returns is a financial institution. The plan must be written, in one or more readily accessible parts, and appropriate to the firm's size and complexity and the sensitivity of the information it holds.
Last reviewed against 8 primary sources.
Free download
WISP template
The elements and what each must document, as a printable PDF, as an Excel workbook, and as a CSV you can use to track which parts of your plan are written.
Download the PDF Download for Excel Download the CSVNo email required.
Answer a short form and get a draft written information security plan on IRS Publication 5708's outline. Nothing you type is stored.
The IRS points to the same rule. Line 11 of Form W-12, the PTIN application and renewal, has the preparer confirm they are aware that paid preparers are required by law to create and maintain a written information security plan. IRS Publication 5708, prepared with the Security Summit, includes a sample WISP for a small practice, and Publication 4557 covers safeguarding taxpayer data more broadly.
This WISP template is organized by the elements in section 314.4 of the rule, which is what the plan is measured against. Each group is one element; each line is something the plan should document. Use it to check a plan you have, or as the outline for one you are writing with Publication 5708 alongside.
What your WISP must document
Grouped by the elements of 16 CFR 314.4. Where the rule relieves a firm holding information on fewer than 5,000 consumers, the note says so. Replace the bracketed text with your firm's details.
Scope and objectives
- What the plan covers, including paper records, devices and cloud systems
- The kinds of customer information the firm holds, and where each is kept Publication 5708's outline starts here: list the information you handle before you assess the risks to it.
- The date the plan takes effect, and who in the firm adopted it
- How often the plan is reviewed, and the date of the last review
Qualified Individual — §314.4(a)
- The name of the Qualified Individual who oversees and enforces the plan
- If that person is outside the firm, the senior person who directs and oversees them The Qualified Individual may work for a service provider, but the firm keeps responsibility for compliance, and the provider must maintain a security program that protects the firm.
- Authorized users, their access levels and responsibilities
- The date each user's access was granted, and the date it ended Publication 5708's Attachment F is a table for exactly this: name, role, duties, access level, and the dates access was granted and terminated.
Risk assessment — §314.4(b)
- The written risk assessment, with the criteria used to rate each risk A firm with customer information on fewer than 5,000 consumers is exempt from the requirement that the risk assessment be written (§314.6). It still has to assess the risks.
- How the confidentiality, integrity and availability of systems and data were assessed
- How each identified risk will be mitigated or accepted
- When the next risk assessment is due
Safeguards — §314.4(c)
- Access controls, limiting each user to the customer information their duties need
- An inventory of the data, people, devices, systems and facilities the firm relies on
- Encryption of customer information in transit over external networks and at rest Where encryption is infeasible, the rule allows compensating controls, but only ones reviewed and approved by the Qualified Individual. Record that approval.
- Multi-factor authentication for anyone accessing any information system The only exception is an equivalent or stronger control the Qualified Individual has approved in writing.
- How the firm evaluates the security of software and services it did not build
- Secure disposal within two years of last use, unless the law or a business need requires keeping it The rule also requires a periodic review of the retention policy. Your own retention obligations still apply: the two-year rule yields to information "required to be retained by law or regulation".
- Change management procedures
- Monitoring and logging of what authorized users do with customer information
Testing and monitoring — §314.4(d)
- How the key controls are regularly tested or monitored
- Continuous monitoring, or else annual penetration testing and six-monthly vulnerability assessments A firm with information on fewer than 5,000 consumers is exempt from this paragraph, §314.4(d)(2), but not from regular testing or monitoring under (d)(1).
- The dates and results of the last tests, and what was fixed
- Extra tests after material changes to the firm's operations or systems Where the six-monthly vulnerability assessments apply, the rule also requires one after material changes to operations or business arrangements.
Staff and training — §314.4(e)
- Security awareness training for all staff, updated for the risks the assessment found
- Who manages information security, in the firm or at a provider
- How security staff keep current with threats and countermeasures
- A signed acknowledgement from each employee and contractor Publication 5708 includes one as Attachment D, and suggests renewing it at each annual training.
Service providers — §314.4(f)
- Every service provider with access to customer information, and what each holds
- How each was selected as capable of maintaining appropriate safeguards
- The contract terms that require each provider to maintain those safeguards
- When each provider was last assessed, and the result The rule asks for periodic assessment based on the risk each provider presents. A document portal, a tax software vendor and an outsourced IT provider all belong on this list.
Incident response and notification — §314.4(h) and (j)
- The written incident response plan, with its goals and internal response process Firms holding information on fewer than 5,000 consumers are exempt from the written plan requirement (§314.6). The FTC notification requirement below still applies.
- Roles, responsibilities and who has authority to decide what
- Internal and external communications, including who speaks for the firm
- How weaknesses are fixed, and how incidents are documented and reported
- Review and revision of the plan after an incident
- FTC notification within 30 days of discovering an event affecting 500 or more consumers Required since May 13, 2024 for unencrypted customer information acquired without authorization, on the FTC's online form.
- Who else to notify, including your IRS Stakeholder Liaison and state tax agencies Publication 4557 asks preparers to report client data theft to their local IRS Stakeholder Liaison, and to the states they file returns in.
Review and reporting — §314.4(g) and (i)
- What triggers a revision, such as test results, a new office or a new system
- Changes made after each risk assessment, and the reason for each
- The Qualified Individual's written report, at least annually, to the owners or a senior officer The report covers the program's status and material matters such as risk decisions, provider arrangements, test results and security events. Firms under the 5,000-consumer threshold are exempt (§314.6).
- [Firm name]'s record of each review, with the date and the changes made
Before you use this
Supplied as-is, with no guarantee. These templates are general information, not legal advice, and not a substitute for it. Have your own legal adviser review and adapt one to your practice and your jurisdiction before you put it in front of a client. FirmHello accepts no responsibility or liability for any use made of them.
Questions tax practices ask about the WISP
Each answer starts with the short version. The sources are the FTC Safeguards Rule, the FTC's own guide to it, and the IRS publications named at the foot of the list.
Do tax preparers need a WISP?
Yes. The FTC Safeguards Rule counts an accountant or other tax preparation service that completes income tax returns as a financial institution, and requires it to keep a written information security program.
The IRS asks the same question on Form W-12: line 11 has every preparer confirm, when applying for or renewing a PTIN, that they know paid preparers must create and maintain a written plan. A small firm is not exempt from the plan. Holding information on fewer than 5,000 consumers removes four requirements, not the rule.
What should a WISP include for a tax practice?
Every element in section 314.4 of the rule: a named Qualified Individual, a risk assessment, safeguards, regular testing, staff training, oversight of service providers, an incident response plan, and a yearly report to the owners or a senior officer.
The safeguards are spelled out: access limited to what each person's duties need, encryption in transit and at rest, multi-factor authentication, secure disposal, change management and logging of what users do. The plan also has to fit the firm, in proportion to its size and complexity and the sensitivity of what it holds. The list above takes each element in turn.
What risk assessment does a tax practice need for its WISP?
A written assessment of the reasonably foreseeable internal and external risks to the security, confidentiality and integrity of client information, with the criteria used to evaluate them and how each risk will be mitigated or accepted.
It also assesses whether the safeguards already in place are enough. The rule calls for periodic reassessment, and the FTC's guide ties that to changes in the firm's operations rather than a fixed interval. A firm holding information on fewer than 5,000 consumers does not have to put the assessment in writing, but it still has to make one.
Who can write a WISP for my tax practice?
Anyone the firm chooses, but the firm stays responsible for it. The rule has the firm designate a Qualified Individual to oversee and implement the program, and the FTC's guide says that person does not need a particular degree or title.
The Qualified Individual can be an employee, or work for an affiliate or a service provider. If an outside provider fills the role, the firm keeps responsibility for compliance, names a senior person to direct and oversee the provider, and requires the provider to keep its own security program.
IRS WISP template or a custom WISP?
Use the IRS template as the starting point and make it custom. Publication 5708's sample is free and written for a small practice, but it says itself that it is not a substitute for a plan built on your own firm's needs.
The same holds for a free template against a paid WISP service. The rule measures the plan by whether its safeguards are appropriate to your firm, so whoever drafts it, the finished plan has to name your systems, your people and your providers, with dates. The list on this page is a way to check either version against the rule.
The Safeguards Rule's numbers
The figures a tax practice's WISP is measured against, with the part of the rule each comes from.
| Figure | Amount | Applies to | Source |
|---|---|---|---|
| Small-firm relief | Fewer than 5,000 consumers | Exempts four requirements; current rule, October 2026 | 16 CFR 314.6 |
| Notifying the FTC of a breach | 500 or more consumers, within 30 days of discovery | Events from May 13, 2024 | 16 CFR 314.4(j) and 314.5 |
| Testing without continuous monitoring | Penetration test each year, vulnerability assessment every six months | Firms with 5,000 or more consumers | 16 CFR 314.4(d)(2) |
| Disposal of client information | No later than two years after last use, unless an exception applies | All covered firms | 16 CFR 314.4(c)(6) |
| Qualified Individual's written report | At least once a year | Firms with 5,000 or more consumers | 16 CFR 314.4(i) |
Rule text read on the eCFR on October 17, 2026. Check it again before you rely on it.
How do I create a WISP for my accounting firm?
Start from the IRS sample plan in Publication 5708, fit it to your firm, check it against the rule element by element, and set a date to review it. Those four steps, in order:
-
1
Start with Publication 5708
The IRS sample WISP gives you policy wording for a small practice, and attachments for retention, staff conduct, breach procedures, hardware and authorized users. Use its text and this list together.
-
2
Check it against the rule, element by element
A sample plan copied without edits describes someone else's firm. Work through each group here and make sure your plan says what your firm actually does, with names and dates.
-
3
Count your consumers
The rule relieves firms holding information on fewer than 5,000 consumers from four requirements. Know which side of the line you are on, and write it in the plan.
-
4
Put a review date in the calendar
Both Publication 5708 and the rule treat the plan as a living document. Tie the review to something that happens anyway, such as the start of each filing season.
Where WISPs go wrong
A template with the firm name typed in
The plan names systems the firm does not use and misses the ones it does. The rule asks for safeguards appropriate to your firm, which a plan written for another firm cannot show.
Service providers left off
Most small firms' customer information lives with vendors: tax software, cloud storage, email, a document portal. Each is a service provider under §314.4(f), and each needs a contract term and a periodic assessment.
MFA everywhere except where it matters
The rule requires multi-factor authentication for anyone accessing any information system, unless the Qualified Individual approves an equivalent control in writing. An old shared login to a vendor portal is where that gap usually sits.
Where a client portal fits in your WISP
If your firm exchanges documents with clients through FirmHello, list it as a service provider in your plan, like your tax software and your email host, and assess it the way §314.4(f) asks: whether it can maintain appropriate safeguards, what your agreement with it says, and when you last reviewed it. Publication 5708's sample plan allows a password-protected portal for exchanging documents that contain personal information once the firm's security coordinator approves its protocols. That approval is the firm's decision to make, and nothing on this page makes it for you. The questions worth asking of any portal before you approve it are on the secure client portal for accountants page.
Questions about the WISP
What is IRS Publication 4557?
"Safeguarding Taxpayer Data: A Guide for Your Business". It explains the Safeguards Rule for tax professionals, lists security practices, and says how to report data theft to the IRS and the states. For the plan itself it points to Publication 5708.
Is there an IRS WISP template?
Publication 5708, "Creating a Written Information Security Plan for your Tax & Accounting Practice", contains a sample template. It says itself that it is not a substitute for developing your own plan based on your firm's needs. This page lists what the rule requires the plan to cover, so you can check the sample against it.
What changes for a firm with fewer than 5,000 consumers?
The rule defines a consumer as an individual who obtains a financial product or service, such as tax preparation, for personal, family or household purposes. Count every individual client, current or former, whose information you still hold. A firm holding customer information on fewer than 5,000 consumers is exempt from four parts of §314.4: the written risk assessment, the continuous monitoring or annual penetration testing requirement, the written incident response plan and the annual report. It still needs a written plan covering everything else, including multi-factor authentication, encryption, service-provider oversight and FTC notification.
Does using a secure portal make my firm compliant?
No tool makes a firm compliant. The rule applies to the firm's whole program: its people, its devices, its vendors and its procedures. A portal is one service provider in that program, to be listed and assessed like the others.
Do I need to register my client portal with the IRS?
If you are an authorized e-file provider, Publication 3112 requires you to register, in your e-file application, the address of every website you use to collect taxpayer information for electronically filed federal returns, directly or through third parties. Check whether your portal is one, and have your own adviser review the plan as a whole.
Sources
The primary sources this page is written against, last read against it on . Check them before relying on a detail; rules and thresholds change.
- Electronic Code of Federal Regulations 16 CFR Part 314, Standards for Safeguarding Customer Information
- IRS Form W-12, IRS PTIN Application and Renewal (Rev. October 2025)
- IRS Form W-12 line 11 instructions (Rev. October 2025)
- IRS Publication 5708 (Rev. 8-2024)
- IRS Publication 4557 (Rev. 6-2024), Safeguarding Taxpayer Data
- IRS Publication 3112 (Rev. 11-2025)
- Federal Trade Commission FTC Safeguards Rule: What Your Business Needs to Know
- Electronic Code of Federal Regulations 16 CFR Part 314, Standards for Safeguarding Customer Information (eCFR text)
What changed
- Added an Excel (.xlsx) copy of the checklist beside the PDF and CSV.
Send the list once, and let it chase
Each line becomes something the client uploads against. Reminders go out on your schedule until the list is complete, and every file lands in the client's vault.
No card and no sales call. If you would rather tell us about your firm first, use the longer form.