WISP Requirements Checklist for Tax Preparers

← WISP Compliance Guide

CHECKLIST · UPDATED 2026

A compliant Written Information Security Plan must include nine things: a designated Security Coordinator, a documented risk assessment, specific technical safeguards (access controls, encryption, MFA, secure disposal), regular testing/monitoring, employee security training, service-provider oversight, an incident response plan, formal adoption, and a scheduled annual review. Use the checklist below to see exactly where your firm stands under IRS Publication 4557 and the FTC Safeguards Rule.

The WISP requirements checklist

1. Governance

  • ☐A Data Security Coordinator / Qualified Individual is named and accountable
  • ☐Leadership has formally adopted the plan (signed)
  • ☐A review date is scheduled (at least annually)

2. Risk assessment

  • ☐A written risk assessment identifies foreseeable internal & external risks
  • ☐Each risk is rated (likelihood × impact) and mapped to a control
  • ☐Areas covered: employee access, remote work, email, portable media, physical security, vendors

3. Technical safeguards

  • ☐Multi-factor authentication (MFA) on all systems accessing client PII
  • ☐Encryption of client data at rest and in transit
  • ☐Least-privilege access controls, reviewed regularly and revoked on departure
  • ☐Anti-malware, firewalls, patching, and secure, tested backups
  • ☐Secure disposal of data no longer needed

4. People

  • ☐Security-awareness training at hire and annually
  • ☐Training completion is documented

5. Vendors

  • ☐A current vendor register of third parties with data access
  • ☐Vendors bound by written security/confidentiality obligations
  • ☐Vendor safeguards reviewed periodically

6. Incident response

  • ☐A written incident response plan (contain → assess → notify)
  • ☐Notification path defined: clients, IRS Stakeholder Liaison, state authorities, FTC
  • ☐An incident log is maintained

7. Data lifecycle

  • ☐Retention schedule per IRS/state requirements
  • ☐Secure destruction method for paper and media

8. Documentation

  • ☐All of the above is written down in the WISP
  • ☐The plan is accessible and current

Miss any boxes? That's your gap list. CPA Hub turns each unchecked item into a guided step and keeps them checked over time.

How firms usually score

Most firms have some technical safeguards (MFA, encryption) but are missing the written pieces — the documented risk assessment, the adoption signatures, the training records, the vendor register, and the scheduled review. Those "paper" items are exactly what an auditor or cyber-insurer asks to see.

Turn your gap list into a finished, documented plan — and keep it current automatically.

Frequently asked questions

What are the core WISP requirements?
A designated Security Coordinator, a documented risk assessment, technical safeguards (access controls, encryption, MFA, secure disposal), testing/monitoring, employee training, vendor oversight, an incident response plan, formal adoption, and an annual review.
Is MFA required for a WISP?
Yes — multi-factor authentication on systems that access client data is an explicit expectation under the updated Safeguards Rule and IRS guidance.
Do I need to document staff training?
Yes. Security-awareness training at hire and annually must be provided and its completion documented as evidence of compliance.

Keep reading

WISP Compliance Guide
The complete pillar guide: what a WISP is, the 8 sections, and why every preparer needs one.
How to Create a WISP
Turn your gap list into a plan: the 5 steps to compliance.
Template vs. Software
Why the "paper" items on this list are where template users fall out of compliance.
What Happens Without a WISP
The penalties for missing these requirements.

Sources

  • IRS Publication 4557 — Safeguarding Taxpayer Data: irs.gov/pub/irs-pdf/p4557.pdf
  • FTC Safeguards Rule (Gramm-Leach-Bliley Act), 16 C.F.R. Part 314
  • IRS Publication 5708 (Sample WISP) / 5709 (Guidance)

This guide is general information, not legal advice. Consult a qualified professional for your firm's specific obligations.