Written Information Security Plan (WISP) for Tax and Accounting Firms

Updated 10/14/2026. Sources at the end.

A written information security plan, the WISP, is the document a tax or accounting firm keeps to show how it protects client information. Under the Gramm-Leach-Bliley Act, the FTC Safeguards Rule treats tax and accounting professionals as financial institutions, whatever their size, and IRS Publication 5708 states that a WISP is one of the rule’s requirements.

The IRS asks about it

Form W-12, the application and renewal form for a Preparer Tax Identification Number, carries a Data Security Responsibilities line. Every preparer answers Yes or No to this statement:

I am aware that paid tax return preparers are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information.

What the plan covers

Section 314.4 of the Safeguards Rule lists the elements of the program: a Qualified Individual, a written risk assessment, safeguards for the risks found, testing, staff training, oversight of service providers, a written incident response plan, an annual written report, and notice to the FTC after an event that involves the information of at least 500 consumers. The checklist takes them one at a time. Publication 5708 lays the plan out in seven parts, which our Word template follows.

Keeping it current

The rule requires a written report on the program at least once a year and periodic risk assessments; Publication 5708’s sample plan reviews the security measures at least annually. See the annual WISP review.

The WISP pages

Frequently asked questions

Who must have a written information security plan?

Tax and accounting firms of every size. IRS Publication 5708 states that under the Gramm-Leach-Bliley Act and the FTC Safeguards Rule, tax and accounting professionals are financial institutions, and that a WISP is a requirement of the rule.

Does the PTIN application ask about a WISP?

Yes. Line 11 of Form W-12 (Rev. 10-2025), Data Security Responsibilities, asks every preparer to answer Yes or No to a statement that paid preparers are required by law to keep a written information security plan.