IRS WISP Template for Tax and Accounting Practices
A tax or accounting firm must keep a written information security plan, the WISP. Under the Gramm-Leach-Bliley Act, the FTC Safeguards Rule treats tax and accounting professionals as financial institutions, whatever their size, and the rule requires a written program.
A Word document that follows the seven parts of IRS Publication 5708, with a field for every fact the plan needs from your firm and the six attachments the publication describes.
Download the WISP template (.docx)
What goes in a WISP
Publication 5708 builds the plan in seven parts:
- Objective, purpose and scope State why the firm keeps this plan (the Gramm-Leach-Bliley Act and the FTC Safeguards Rule), what client information it protects, and where the plan stops.
- Qualified Individual and responsible people Name one person who runs the program. List everyone who may see client information and what each may see.
- Risk assessment Write down the kinds of client information the firm handles, where it could be lost or exposed (inside and outside the office), and how the firm checks those risks.
- Hardware inventory List every device that stores or processes client information, where it sits, and what it holds.
- Safeguards in place Describe each control the firm uses. Pub 5708 suggests a policy for each of these:
- Implementation Record who approved the plan and when it takes effect. Review it at least once a year and whenever the firm, its systems or its vendors change.
- Attachments Record retention, rules of behavior, breach procedures, staff acknowledgments, the hardware inventory and the list of people with access.
What the FTC Safeguards Rule requires
Section 314.4 of the rule sets nine elements every program must cover:
- Name a Qualified Individual to run and supervise the program.
- Assess the risks to client information in writing, after taking stock of what the firm holds and where.
- Put safeguards in place for the risks you find: access controls, an inventory of data and systems, encryption in storage and in transit, multi-factor authentication for anyone who reaches client information, secure disposal no later than two years after the information was last used, change management, and a log of what authorized users do.
- Test the safeguards: monitor continuously, or run a penetration test every year and vulnerability scans every six months.
- Train your staff.
- Choose service providers who can protect the information, write your expectations into their contracts, and check their work.
- Keep the program current as the firm and its risks change.
- Write an incident response plan.
- Have the Qualified Individual report in writing, at least once a year, to the board or the senior officer responsible.
The FTC exempts firms that hold information on fewer than 5,000 consumers from certain of these provisions; read section 314.6 before you rely on it. Every firm, whatever its size, must report a security event involving the information of at least 500 consumers to the FTC within 30 days of discovering it.
Keep it current
Publication 5708 calls the WISP an evergreen document. Review it whenever your staff, software, vendors or offices change, and at least once a year. Have each employee and contractor sign the acknowledgment again after each year’s training.
Frequently asked questions
Do tax preparers need a written information security plan?
Yes. The FTC Safeguards Rule treats tax and accounting professionals as financial institutions, whatever their size, and requires a written information security program. IRS Publication 5708 explains how to write one.
Does the IRS publish a WISP template?
Yes. IRS Publication 5708 (Rev. 8-2024), written by the Security Summit, includes a sample plan and six sample attachments. Our Word template follows the same outline.
How often should a WISP be updated?
Whenever the firm changes, and at least once a year. The Safeguards Rule requires firms to keep the program current, and Publication 5708 calls the plan an evergreen document.
What must a firm report after a breach?
The Safeguards Rule requires a notice to the FTC as soon as possible, and no later than 30 days after discovery, when a security event involves the information of at least 500 consumers. State law sets its own notices.
More on the WISP
- What a WISP is and who must keep one
- The FTC Safeguards Rule as a checklist
- PTIN renewal: the WISP question on Form W-12
- The annual WISP review