HOW-TO GUIDE · UPDATED 2026
To create a compliant Written Information Security Plan (WISP), you: (1) designate a Security Coordinator, (2) run and document a risk assessment, (3) write your safeguards across eight required areas, (4) formally adopt the plan and train your staff, and (5) review it at least annually. This is required of every paid tax preparer under IRS Publication 4557 and the FTC Safeguards Rule. Done from a blank template it takes a few focused hours; with a guided tool it takes minutes.
Before you start: what you'll need
- A named owner for the plan (usually a firm principal).
- An inventory of where client data lives — software, cloud storage, email, laptops, paper files, portable media.
- A list of vendors that can access client data.
- Your current security controls (MFA status, encryption, backups, who has access to what).
Gather these first and the writing goes quickly.
The 5 steps to a compliant WISP
| # | Step | What it involves |
|---|---|---|
| 1 | Designate your Data Security Coordinator | Name one accountable individual (the "Qualified Individual"). In a solo shop, that's you. They own risk assessments, training, vendor oversight, and incident response. |
| 2 | Conduct and document a risk assessment | Write down the foreseeable internal and external risks to client data, rate likelihood and impact, and note the control for each. The written record is what the Safeguards Rule expects. |
| 3 | Write your safeguards (the 8 sections) | Complete each required area with your firm's specifics — coordinator, risk assessment, MFA/access, encryption, incident response, training, vendor management, and data retention/disposal. |
| 4 | Adopt the plan and train your team | A WISP only counts once it's in effect. Have leadership formally adopt and sign it, distribute it, and complete initial security training — and keep the records. |
| 5 | Maintain it (where most firms fail) | Review at least annually, update after any material change, re-run the risk assessment, re-train staff each year, and log incidents. |
Step 3 in detail — the 8 sections your plan must document
- Designated Security Coordinator — who's responsible and their duties.
- Risk Assessment — your findings and how each risk is controlled.
- Multi-Factor Authentication & Access — require MFA on anything touching client PII; least-privilege access, reviewed regularly; revoke on staff departure.
- Encryption — encrypt client data at rest (e.g., AES-256) and in transit (TLS); full-disk encryption on laptops; never email unencrypted PII.
- Incident Response Plan — a written playbook: contain, assess scope, preserve evidence, and notify affected clients, the IRS Stakeholder Liaison, state authorities, and the FTC where required.
- Employee Security Training — at hire and annually; document completion.
- Vendor Management — vet vendors with data access, bind them to written obligations, keep a current register.
- Data Retention & Disposal — how long records are kept and how they're securely destroyed.
The IRS's Publication 5708 (sample WISP) and 5709 (step-by-step guidance) are useful references for the language in each section — but a generic template still has to be tailored to your firm, adopted, and kept current to be defensible.
Common mistakes to avoid
- Leaving a template half-finished. A blank template in a folder is not a plan.
- Never adopting it. No signatures, no training = no evidence of compliance.
- Letting it go stale. A plan dated two years ago signals it isn't being followed.
- Emailing unencrypted PII despite what the plan says — practice must match policy.
- Ignoring vendors. Third parties with data access are explicitly in scope.
The maintenance is what trips firms up. CPA Hub drafts each section and keeps your risk assessment, training, vendor register, and annual review current.
Frequently asked questions
How long does it take to create a WISP?
From a blank template, a few focused hours to complete all eight sections properly. With a guided tool like CPA Hub, a firm-specific draft takes minutes.
Do I need a lawyer to write a WISP?
Not necessarily — the IRS provides sample templates (Pub 5708/5709) and guided software can draft one. For complex firms or specific legal questions, consult a qualified professional.
Can I use the IRS sample WISP?
Yes, as a starting point. IRS Publication 5708 is a sample plan, but you must tailor every section to your firm, adopt it, and keep it current to be compliant.
Who needs to sign the WISP?
At minimum, firm leadership (owner/principal) and the designated Security Coordinator. Keeping signed adoption records demonstrates the plan is in effect.
How often should I update it?
At least annually, plus after any material change to your systems, staff, or vendors, or after a security incident.
Keep reading
WISP Compliance Guide
The complete pillar guide: what a WISP is, the 8 sections, and why every preparer needs one.
WISP Requirements Checklist
The printable list of everything your plan must include — check your work.
Template vs. Software
Write it yourself or generate it — which route fits your firm.
What Happens Without a WISP
The penalties that make this worth doing today.
Sources & official references
- IRS Publication 4557 — Safeguarding Taxpayer Data: irs.gov/pub/irs-pdf/p4557.pdf
- IRS Publication 5708 — Sample WISP; Publication 5709 — Creating a WISP
- FTC Safeguards Rule (Gramm-Leach-Bliley Act), 16 C.F.R. Part 314
This guide is general information, not legal advice. Consult a qualified professional for your firm's specific obligations.