The Security Plan Your Tax Firm Is Supposed to Have in Writing

Here's a question worth answering honestly: if a client asked to see your firm's written plan for protecting their Social Security number, could you hand them a document? Not a description of the software you use. An actual, written plan, with a name on it.

For most small tax and accounting firms, the honest answer is no. And a common reaction to that is "we're a small shop, that requirement is for the big firms."

It isn't. It's for you.

What is a WISP (Written Information Security Plan)?

A Written Information Security Plan, or WISP, is the document that says what client data your firm holds, who is responsible for protecting it, what safeguards are in place, and what you'll do if that data is exposed. The name comes from the IRS. The legal requirement behind it comes from the Federal Trade Commission.

It's a plan, not a policy binder. Written for a real small firm, it runs a modest number of pages, and most of it is a description of things you either already do or should be doing. The hard part isn't writing it, but making sure the document and the actual computers agree.

WISP requirements for accounting and tax firms

Under federal law, tax preparers are classified as financial institutions which is the same broad category as banks and lenders. That classification comes from the Gramm-Leach-Bliley Act, and it puts every paid preparer under the FTC Safeguards Rule, which requires a written information security program. The IRS translates this into preparer terms in Publication 4557, and its name for the document is a WISP.

There's no small-firm exception to the core requirement. A solo enrolled agent working from a home office is covered. So is a two-partner CPA firm. Firm size changes how long the plan is, not whether you need one.

The Safeguards Rule sets out what the program has to have: one named person in charge (the rule calls this the Qualified Individual), a written risk assessment, safeguards that address the risks it finds, staff training, oversight of the vendors who touch your data, and a written plan for responding to a breach.

Is a WISP required for a PTIN?

Yes. When you renew your Preparer Tax Identification Number each year, you confirm your data security responsibilities as part of the renewal. The IRS expects any preparer to be able to produce a current WISP on request.

Signing that renewal without a plan behind it is the kind of gap nobody notices until the worst possible moment: after a breach, when the FTC, the IRS, and your liability insurer all ask for the document at the same time.

What should a WISP plan include?

Less than you might fear. A WISP for a small firm is typically a document that:

• Names a person. One individual responsible for the security program. In a small firm, that's usually an owner. The rule cares that someone owns it.
• Inventories the data. Where client information lives: tax software, email, file shares, portals, that box of paper files, and who can get at each.
• Assesses the risks. What could realistically go wrong, written down. Stolen laptop, phished email account, ex-employee with a password that still works.
• States the safeguards. What you actually do about those risks. The IRS's baseline here is what it calls the Security Six, covered below.
• Plans for the bad day. Who you call, what you preserve, and who gets notified if client data is exposed. Preparers have IRS reporting obligations after a data theft, and figuring out the steps during the incident is the wrong time.

The template-download versions floating around tend to fail in a predictable way: the document says encryption and MFA everywhere, and the firm's actual computers say otherwise. A WISP that doesn't match your real environment isn't compliance. After a breach, it's evidence.

IRS WISP guidance (Publication 4557)

Two IRS publications cover this, both of which are free:

Publication 4557, Safeguarding Taxpayer Data, is the IRS's guide to what tax professionals are expected to do: the basic security steps, how to recognize and report data theft, and how the FTC Safeguards Rule applies to preparers. It's at irs.gov/pub/irs-pdf/p4557.pdf.

Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice, is the one to open when you sit down to write. It walks through the requirements, gives an outline, and includes a sample plan you can adapt. It's at irs.gov/pub/irs-pdf/p5708.pdf.

If you read one, read 5708. It was written for firms your size.

WISP template for accounting firms

You don't need to buy a template. The sample plan inside IRS Publication 5708 is a workable starting point for a small accounting or tax firm, and it comes from the agency that will ask to see the finished document.

What a template can't do is fill itself in truthfully. Every blank in it is a claim about your firm: who the responsible person is, where client data lives, whether drives are encrypted, whether MFA is on. It doesn't take long to fill out the template, however, actually verifying the claims against your real computers is the work, and it's the part most firms skip.

Security requirements for tax preparers

The IRS's baseline for preparers is what it calls the Security Six:

1. Antivirus software on every device, set to update itself.
2. A firewall between your office and the internet.
3. Multi-factor authentication on email, tax software, and client portals.
4. Drive encryption on every computer, so a lost laptop is an inconvenience instead of a breach notification.
5. Secure disposal of old computers, drives, and printers that held client data.
6. Access controls so staff only see the client data their job requires.

Publication 4557 adds the habits around them: strong unique passwords, backups kept somewhere not permanently connected to the network, checking your EFIN and PTIN activity for returns you didn't file, and knowing what a phishing message aimed at a tax office looks like.

None of that is exotic. It's inventory and follow-through.

How often should a WISP be reviewed or updated?

At least once a year, and whenever something material changes: a new employee with data access, a move to hosted tax software, a new office, a breach. The IRS's own sample plan in Publication 5708 carries a "last reviewed" date and says to review and update at least annually, and the Safeguards Rule expects the responsible person to report on the program at least once a year.

The off-season is the time. A plan reviewed in June gets fixed in July. A plan reviewed in March gets a note that says "fix after April."

The part firms get wrong

The document is half the job. The other half is making the technology match what the document claims.

This is where a written plan quietly turns into an IT project. If the WISP says drives are encrypted, someone has to confirm every machine actually is. If it says MFA protects email and tax software, someone has to turn it on, including for the seasonal preparer who was set up in a hurry last January. If it says former staff lose access, someone has to check what happens to accounts when a person leaves.

It's exactly the kind of follow-through that slips when everyone in the building has a return deadline in front of them, which is why the gap between what firms sign and what firms run is so common.

What to check at your own firm

Four questions, answerable this week:

1. Does a written plan exist, and could you find it today? If it exists but nobody has opened it since it was downloaded, treat that as a no.
2. Does someone's name appear in it? A plan without an owner is a shelf document.
3. Is MFA actually on? Email, tax software, portals. Log in and look. Don't rely on the memory of whoever set it up.
4. Would the plan survive a comparison with your real computers? Pick one claim in it, encryption is a good one, and verify it against one actual machine.

If you got through those four cleanly, you're ahead of most of the profession. If a couple of them made you wince, that's fixable, and it's a lot cheaper to fix before it matters.

Writing the plan and making the technology match it is work we do for accounting firms. If you'd rather hand it off, book a 15-minute review and we'll look at where your firm stands, no strings attached. What that looks like for an accounting firm is at https://www.tech360solutions.com/it-support-for-accounting-firms.

_Tech 360 Solutions provides managed IT and cybersecurity for small businesses in the Kansas City metro. Built for HIPAA, FTC Safeguards, and other regulated environments._