COMPLIANCE GUIDE · UPDATED 2026
A Written Information Security Plan (WISP) is a documented, firm-specific plan describing how your practice protects client data — and under the FTC Safeguards Rule, every paid tax preparer who handles client returns is legally required to have one, regardless of firm size. A compliant WISP must name a person responsible for security, document a risk assessment, and put specific safeguards in writing (encryption, multi-factor authentication, an incident response plan, employee training, vendor oversight, and data-disposal rules). Not having one can bring an FTC consent order that runs 20 years and put your EFIN at risk under Revenue Procedure 2007-40 — which stops you from e-filing.
This guide explains exactly what a WISP requires in 2026, the eight sections a compliant plan needs, and the fastest way to produce one that would actually hold up.
Do tax preparers really need a WISP? (Yes — it's the law)
Yes. Two federal requirements make it mandatory:
- The FTC Safeguards Rule (under the Gramm-Leach-Bliley Act) treats tax and accounting firms as "financial institutions" and requires them to maintain a written information security program.
- IRS Publication 4557 (Safeguarding Taxpayer Data) is the IRS's tax-professional-specific playbook for meeting that rule, and having a WISP is tied to your ability to e-file.
In plain English: the FTC Safeguards Rule is the law, IRS Pub 4557 is the how-to for tax pros, and the WISP is the document that proves you did it. It applies whether you're a 200-person firm or a one-person shop preparing returns from a home office.
What happens if you don't have one?
A missing or inadequate WISP is not a paperwork technicality:
- An FTC consent order that dictates your security program, with outside assessments every two years for up to 20 years. The FTC cannot currently fine a first violation, but each violation of an order can cost up to $53,088 (2025).
- EFIN sanctions — the IRS treats a Safeguards Rule violation by an e-file provider as a violation of Revenue Procedure 2007-40, with sanctions up to expulsion from e-file.
- Loss of client trust after a reportable data breach.
The plan is also your first line of defense: if you do experience an incident, a current, followed WISP is evidence of due diligence.
The 8 sections a compliant WISP must cover
A defensible WISP maps to the safeguards required by Pub 4557 and the Safeguards Rule. These are the eight areas your plan should document:
| # | Section | What it must establish |
|---|---|---|
| 1 | Designated Security Coordinator | A named individual (the "Qualified Individual" / Data Security Coordinator) accountable for the program. |
| 2 | Risk Assessment | A written assessment of foreseeable internal and external risks to client data, rated and mapped to controls. |
| 3 | Multi-Factor Authentication & Access | MFA on systems that touch client PII; least-privilege access, reviewed regularly. |
| 4 | Encryption | Client data encrypted at rest and in transit; no unencrypted PII over email. |
| 5 | Incident Response Plan | A defined playbook to contain, assess, and report a breach (clients, IRS Stakeholder Liaison, state authorities, FTC). |
| 6 | Employee Security Training | Documented security-awareness training at hire and annually. |
| 7 | Vendor Management | Due diligence and written security obligations for third parties with data access. |
| 8 | Data Retention & Disposal | Rules for how long records are kept and how they are securely destroyed. |
The IRS provides Publication 5708 (a 28-page sample WISP) and Publication 5709 (step-by-step guidance). They're a solid starting point — but a generic template still has to be tailored to your firm, kept current, and actually adopted to be defensible.
Template vs. software: why a downloaded PDF often isn't enough
Most tax pros start with a free template — then it sits half-finished in a folder. A static template has three problems:
- It's generic. A blank template isn't your firm's plan until every section is completed with your specifics.
- It goes stale. The Safeguards Rule expects periodic risk assessments and annual review. A one-time PDF doesn't remind you.
- It's hard to prove adoption. Auditors and insurers want evidence the plan was adopted, staff trained, and reviews happened — not just that a document exists.
Purpose-built WISP software solves this by generating a firm-specific plan, tracking the required components (risk assessment, staff training, vendor register, incident log), and keeping the annual review on the calendar.
How to create a WISP for your tax practice (step by step)
- Designate your Security Coordinator. Usually an owner or partner.
- Run a risk assessment. Inventory where client data lives and the realistic threats to it.
- Write your safeguards. Complete each of the eight sections above with your firm's actual controls.
- Adopt it. Have leadership sign, and train your staff.
- Maintain it. Adjust it after any material change or incident (16 CFR 314.4(g)), and review it at least annually as IRS Publication 5708 recommends.
With CPA Hub, this is a guided flow: answer a short set of questions and the platform drafts each policy section for your firm, tracks training and vendors, and keeps your annual review on schedule.
Frequently asked questions
Dig deeper: the WISP compliance cluster
Sources & official references
- IRS Publication 4557 — Safeguarding Taxpayer Data: irs.gov/pub/irs-pdf/p4557.pdf
- IRS Publication 5708 — Sample WISP for tax professionals
- IRS Publication 5709 — How to create a WISP
- FTC Safeguards Rule (Gramm-Leach-Bliley Act), 16 C.F.R. Part 314
This guide is general information, not legal advice. Consult a qualified professional for your firm's specific obligations.