Question 1

What is a WISP?

Accepted Answer

A Written Information Security Plan (WISP) is the document that describes how your firm protects client data, who's responsible, and how you keep it current. Paid tax preparers are required to have one under the FTC Safeguards Rule. Firms with fewer than 5,000 consumers are exempt from a few documentation items, but not from having a WISP.

Question 2

How do I write a WISP?

Accepted Answer

Start by naming the person responsible for the program, then document where client data lives and what threatens it. Write down your administrative, technical, and physical safeguards, training, vendor oversight, incident response, and annual review, and keep evidence that each control is in place.

Question 3

What's the difference between a security plan and a security program?

Accepted Answer

The plan is the written document. The program is the document plus the ongoing activities that keep it true: risk assessments, safeguards, training, vendor oversight, incident response, annual review, and evidence collection. The FTC Safeguards Rule uses the term "written information security program."

Question 4

Is there an official IRS WISP form?

Accepted Answer

No. There's no form to file with the IRS. IRS Publication 5708, last revised in August 2024, includes a sample template you adapt to your own practice.

Question 5

Do I need a WISP if I don't have clients yet?

Accepted Answer

The IRS expects paid tax preparers to have a written data security plan, and PTIN renewal asks whether you're aware of that requirement. If you don't handle client information yet, your plan will be simple, but it should be in place before you take your first client.

Question 6

I'm a one-person practice. Can I just fill in the IRS sample?

Accepted Answer

It's a reasonable starting point, but filling in blanks isn't enough. Your plan has to describe how you actually work, and sections written for larger firms should be removed so the plan reflects reality.

Question 7

Do bookkeepers need a WISP?

Accepted Answer

Yes. Enrolled agents who prepare returns for pay are covered by the FTC Safeguards Rule, and bookkeepers generally are too when they handle consumers' financial information. Both need a current WISP, a designated Qualified Individual, and regular reviews.

Question 8

Are small firms exempt?

Accepted Answer

Firms with fewer than 5,000 consumers are exempt from four items: the written risk assessment, continuous monitoring or annual penetration testing, the written incident response plan, and the annual written report. They still need a WISP, a Qualified Individual, and the required safeguards.

Question 9

What must a tax preparer's WISP include?

Accepted Answer

A designated Qualified Individual, a written risk assessment, and safeguards such as multi-factor authentication, encryption, and access limited to staff who need it. It also covers employee training, vendor oversight, an incident response plan, and regular monitoring and updates.

Question 10

What are the IRS Security Six?

Accepted Answer

The Security Six are the IRS's baseline technical protections: anti-virus software, firewalls, multi-factor authentication, backups, drive encryption, and a VPN for remote access. They are the technical floor your WISP should document.

Question 11

How often should I update my WISP?

Accepted Answer

At least once a year, and whenever something changes, such as a hire or departure, new software or vendors, or a security incident. Keep a dated, signed record of each review.

Question 12

Do I have to oversee my vendors?

Accepted Answer

Yes. The Safeguards Rule requires you to select service providers that can protect customer information, require safeguards in your contracts, and periodically assess them. That includes tax software, client portals, cloud storage, and IT providers.

Question 13

How do I secure seasonal tax staff?

Accepted Answer

Give each seasonal hire their own account with MFA before day one, limit access to what the role needs, and train them first. Disable their accounts, recover devices, and remove portal access on their last day.

Question 14

What happens if I don't have a WISP?

Accepted Answer

Firms without a WISP face FTC enforcement actions and civil penalties, possible consequences with the IRS, and a harder time getting or keeping cyber insurance. After a breach, the absence of a written plan makes every one of those outcomes worse.

Question 15

Where can I get a WISP template for tax preparers?

Accepted Answer

Our WISP template for tax preparers and enrolled agents is based on IRS Publication 5708. Treat any template as a structure to customize, not a finished document to print.

Question 16

Is there a template for CPA firms?

Accepted Answer

Yes. The CPA and accounting firm template is written for practices with multiple staff, where roles, access levels, and vendor oversight have to be documented for a whole team. It follows an eleven-section structure aligned with the FTC Safeguards Rule, GLBA, and IRS Publication 5708.

Question 17

How do I choose a WISP provider?

Accepted Answer

Firms get a WISP from a free template, WISP software, an IT consultant or MSP, or a managed service bundled with hosting. The deciding question is whether the option proves your controls are actually in place, not just whether it produces a document.

Question 18

Does Microsoft 365 or Google Workspace make me compliant?

Accepted Answer

No plan is compliant on its own. Compliance depends on configuration: MFA on every account, former employees disabled, access limited by role, and no automatic forwarding to personal email.

Question 19

How much does a WISP cost?

Accepted Answer

A WISP's cost has three parts: creating it, keeping it current, and the risk of not having one. WISPWolf plans start at $39 per month. Firms without a working plan face breach response costs, client notification, possible FTC enforcement, and the risk of denied insurance claims.

Question 20

Does cyber insurance require a WISP?

Accepted Answer

Cyber insurance applications increasingly ask for a written security program and evidence of controls such as MFA and backups. Underwriters often want screenshots, policies, or attestation, not just yes or no answers.

WISP FAQ for Tax Preparers & Accounting Firms

Basics

Who needs one

Requirements

Templates and tools

Cost and insurance