The IRS Expects Every Tax Preparer to Have a Written Security Plan. Here's What Goes in One.

If you prepare tax returns for pay, federal law requires you to keep a written information security plan, or WISP. The FTC's Safeguards Rule treats tax preparation firms as financial institutions, and the IRS says that applies regardless of firm size. The quickest place to start is the free WISP template for tax preparers in IRS Publication 5708 (opens in a new tab), written by the IRS and its Security Summit partners. A finished WISP names who is in charge, lists the client data you hold and where it lives, documents your safeguards, spells out what happens after a breach, and is signed, taught to staff and reviewed at least once a year.

This is general information, not legal advice. If you are unsure how the rules apply to your practice, ask your attorney.

Which tax preparers need a WISP, and why the IRS keeps asking#

The requirement comes from the Gramm-Leach-Bliley Act. The FTC's rule under that law lists "tax preparation firms" among its examples of financial institutions, and it requires a written information security program with administrative, technical and physical safeguards, according to the FTC's Safeguards Rule guidance for businesses (opens in a new tab). Publication 5708 is blunt: tax and accounting professionals count as financial institutions "regardless of size," and "the law requires you to have one."

The IRS puts the requirement in front of you every year. PTINs must be renewed annually (opens in a new tab), and line 11 of Form W-12 (opens in a new tab), the PTIN application and renewal form (October 2025 revision, current as of September 2026), reads: "I am aware that paid tax return preparers are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information."

The IRS and its Security Summit partners repeated the point on August 18, 2026, in news release IR-2026-92 (opens in a new tab): tax professionals "are legally required to have a written, accessible plan and should review, test, and update it regularly."

Solo preparers are not exempt. Publication 5708 says a sole practitioner "can use a more abbreviated and simplified plan than a 10-partner accounting firm." Shorter is fine. Missing is not.

The IRS WISP template for tax preparers: seven parts of Publication 5708#

Publication 5708 (revised August 2024) gives a seven-part outline plus a fill-in sample template. Here is each part in plain English.

1. Objective, purpose and scope#

A few paragraphs on why the plan exists (compliance with the Gramm-Leach-Bliley Act and the FTC Safeguards Rule), what it protects, and where its limits are. The template defines protected information as a taxpayer's, spouse's or dependent's name combined with items such as a Social Security number, income and tax filing data, or financial account numbers. Most firms can adapt this section from the template with light edits.

2. The people in charge#

Name a Data Security Coordinator to run the plan day to day. The FTC calls this role the "Qualified Individual." Name a Public Information Officer too: the one voice for clients, police and the press after an incident. Publication 5708 says that in most firms with two or more practitioners, these should be different people. This part also lists every authorized user and what each one can access.

Your IT provider can fill the Qualified Individual role, but the FTC says "the buck still stops with you," and you must designate a senior employee to supervise that person.

3. Risk assessment#

List the kinds of information you handle (client tax data, employee records and business financials, on paper and electronic), how it could be lost (theft, remote access takeover, accidental disclosure, fire or a tornado), and how you will watch for new risks.

4. Hardware inventory#

Record every device that touches taxpayer data, where it sits, and what it stores or processes: workstations, laptops, business phones, printers, the router, USB drives, and the server that runs your tax software. If Lacerte runs on a server in your office, that server goes on this list, along with how staff reach it from home. Our Lacerte IT support page covers that server and remote access side.

5. Safety measures#

Publication 5708 suggests nine policies: data collection and retention, data disclosure, network protection, user access, electronic data exchange, Wi-Fi access, remote access, connected devices, and reportable incidents, plus an employee code of conduct. The sample template gets specific: multi-factor authentication (MFA) for remote login, no shared passwords or accounts, encrypted or password-protected files with the password sent by a different channel, guest Wi-Fi kept separate from the firm's network, and default passwords changed on printers and copiers.

6. Implementation clause#

A short statement with the effective date, the firm name and the rules the plan complies with, signed and dated by the owner and the Data Security Coordinator.

7. Attachments#

The template includes six: a record retention policy, rules of behavior for staff, breach procedures and notifications, an employee and contractor acknowledgment, a hardware inventory, and a list of everyone authorized to access client data.

What the FTC Safeguards Rule adds to the WISP template#

Publication 5708 is guidance. The legal requirements live in the Safeguards Rule, 16 CFR Part 314 (opens in a new tab), and several are specific:

• MFA for any individual accessing any information system, unless your Qualified Individual approves an equivalent control in writing.
• Encryption of customer information in transit over external networks and at rest, or approved alternative controls where encryption is not feasible.
• Secure disposal no later than two years after you last used the information to serve that client, unless a legitimate business need or a legal requirement says to keep it.
• Logging of authorized users' activity, plus change management.
• Testing: continuous monitoring, or else annual penetration testing and vulnerability assessments at least every six months.
• Training for staff, and contracts that require your service providers to maintain safeguards.
• A written incident response plan, and an annual written report from the Qualified Individual to your board or, if you have none, a senior officer.
• Breach reporting: if the unencrypted information of 500 or more consumers is acquired without authorization, you must notify the FTC as soon as possible and no later than 30 days after discovery. That requirement took effect May 13, 2024.

The small-firm exemption, and what it does not cover#

Firms that maintain customer information on fewer than 5,000 consumers are exempt from four provisions: the requirement to put the risk assessment in writing, the penetration testing and six-month vulnerability assessment schedule, the written incident response plan, and the annual report. You still have to assess risk and test your safeguards. Everything else applies too, including the written plan itself, MFA, encryption, disposal, training, vendor oversight and FTC breach reporting.

The rule counts consumers whose information you maintain, so retained prior-year files may matter, not only this season's clients. If you are near the line, ask your attorney. Either way, Publication 5708 recommends that your WISP include both an incident response plan and a breach notification plan.

Common WISP gaps to fix before you sign#

1. The template is still a template. Bracketed placeholders, or policies that describe controls you do not have. Publication 5708 says there is "no one-size-fits-all WISP" and that it is not a substitute for developing your own plan.
2. MFA on the tax software, but not everywhere else. The rule covers any individual accessing any information system. Check email, remote access, the client portal and every administrator account.
3. Remote access with no rules. Publication 5708 calls nights and weekends "high threat periods for Remote Access Takeover data theft" and suggests considering a no-after-hours remote access policy.
4. Vendors left off the list. Publication 5708 says to include contractors "such as your IT professionals, hosting vendors, and cleaning and housekeeping" who can reach client data. The FTC rule says your contracts must require them to maintain safeguards.
5. Keeping everything forever. Retention is a security decision. Beyond the FTC's two-year disposal rule, Wisconsin statute 134.97 (opens in a new tab) says a tax preparation business may not dispose of records containing personal information, which includes tax return data, unless they are shredded, erased or made unreadable first, or otherwise kept out of unauthorized hands until destroyed. A violation can mean a forfeiture of up to $1,000 plus liability for damages. Old PCs, copier drives and archive boxes all count.
6. No phone list for a bad day. The template's breach attachment lists who to notify: your IRS Stakeholder Liaison, the state attorney general and state tax agencies, the FBI's Internet Crime Complaint Center for cybercrime, the FTC, local police, your tax software vendor, your insurance carrier and legal counsel. Wisconsin firms also have Wisconsin's data breach notification law to follow. Put names and numbers in the plan now.
7. No signatures, no training record. Publication 5708 recommends a signed acknowledgment from every employee and contractor, refreshed at annual training.
8. Written once, never reviewed. The template says to review and update at least annually. The FTC rule also requires you to re-evaluate and adjust the program after material changes to your operations, such as new software or a new office, and in light of what your security testing finds.

How to finish your WISP before January#

Start in November, before filing season prep takes over December. Here is a five-step schedule.

1. Week 1: Name your Data Security Coordinator and Public Information Officer. Download Publication 5708 and save a working copy. List everyone, staff and vendors, who can reach client data.
2. Week 2: Walk the office. Build the hardware inventory and note every place client data lives: server, laptops, portal, cloud storage, filing cabinets and archive boxes.
3. Week 3: Check your controls against the rule. Is MFA on for email, remote access, the portal and admin accounts? Are laptops and USB drives encrypted? When did someone last run a vulnerability scan or test a backup restore?
4. Week 4: Write the policies and attachments: retention schedule, rules of behavior, and the incident contact list with your local IRS Stakeholder Liaison.
5. Early December: The owner and coordinator sign the implementation clause. Train staff, collect signed acknowledgments, and store a copy offsite or in the cloud, as Publication 5708 recommends.

For the server, network and backup side of busy season prep, see the November checklist in accounting firm IT: Lacerte, Drake and the software that runs your whole year.

Book a WISP review#

Coulee Tech supports accounting firms and tax preparers with FTC Safeguards compliance management: gap analysis, policy development, technical controls and staff training. We do not certify compliance, and we are not your attorney. Our job is to help the plan match what actually happens in your office. An initial gap analysis takes 2 to 4 weeks, so a November start leaves time to act on the findings before filing season. Our La Crosse area team works from our Holmen office and serves the Coulee Region, and we also have offices in Eau Claire and Fort Myers.

Send us your current WISP, or tell us you do not have one yet. We will compare it against Publication 5708 and the Safeguards Rule and show you what to fix first. See our IT services for CPA firms and tax preparers for the rest of what we do for tax practices.

Frequently asked questions#