How to Choose a WISP Provider for Your Tax or Accounting Firm

Every paid tax preparer and accounting firm needs a Written Information Security Plan under the FTC Safeguards Rule and IRS Publication 5708. What the rules don't tell you is how to get one. This guide compares the four common routes — a free template, WISP software, an IT consultant or MSP, and a managed service bundled with hosting — and gives you the questions to ask any provider before you commit.

The four ways firms get a WISP

Free template. The sample plan in IRS Publication 5708 is a sound starting point and costs nothing. You get structure, not a finished plan: you still have to describe how your firm actually handles data, name your Qualified Individual, and keep it current. It proves a plan exists — nothing more. It fits solo preparers who are comfortable doing the work themselves.

WISP software. Software walks you through building the plan and usually adds review reminders, training records, and a change log. Effort is lower, and what it proves depends on the product: some manage the document, others check your systems against it. It fits firms from solo to multi-office that want the plan tracked during the year.

IT consultant or MSP. An outside IT provider can write a plan around the systems they already manage. Your effort is low, but upkeep depends on the engagement — a one-time project leaves you with a document that ages. It fits firms that already trust an IT provider with their environment.

Managed WISP bundled with hosting. Some hosting providers offer a WISP alongside hosted tax software. It's convenient, but it tends to describe the hosted environment well and the rest of the firm — email, laptops, phones, paper files — less thoroughly. It fits firms already on a hosting platform that cover the gaps separately.

The question that matters most: does it prove anything?

A WISP is a set of claims about your firm: MFA is required on every account, former employees lose access the day they leave, client data isn't forwarded to personal email. A document can state all of that and still be wrong. Evidence is what shows the claims are true — the MFA status of every account, a list of disabled former-staff accounts, a check for forwarding rules sending mail outside the firm.

I've reviewed firms whose WISP said MFA was required for all users, when it was only turned on for the owner. Nobody lied; the plan was written once and never checked against the systems it described. That gap is exactly what an insurer or investigator finds after an incident. When you compare options, ask what each one checks, not just what it writes.

What firm size changes

Solo preparer. You are the Qualified Individual, the plan is shorter, and a template or simple software can work — as long as you actually review it and keep your settings matching it. See our sole proprietor WISP guide.

5–20 person firm. Staff changes, role-based access, training records, and vendor oversight now change during the year. A plan reviewed once a year falls behind; you need something that tracks changes and checks every account, not just the owner's.

Multi-office. Multiple locations, devices, and vendors make a single static document hard to keep accurate. Look for central tracking of every office's controls and evidence.

One note on the size threshold: firms that maintain information on fewer than 5,000 consumers are exempt from only four items — the written risk assessment, continuous monitoring or annual penetration testing, the written incident response plan, and the annual written report. Every other requirement, including naming a Qualified Individual, still applies.

Questions to ask any provider

• Who is our Qualified Individual? The rule requires a named person. Make sure the plan names one and that person agrees.
• Does it cover systems outside our hosted software? Email, laptops, phones, file sharing, and paper records all belong in the plan.
• Does it check our actual Microsoft 365 or Google Workspace settings? Or does it only record what we tell it?
• Who updates it when staff change? New hires, departures, and role changes should flow into the plan.
• Does it include staff training? And does it keep a record of who completed it and when?
• What evidence will we have for an insurer? Applications increasingly ask for proof of controls, not yes-or-no answers.
• Is there onboarding help? Someone to walk you through setup makes the difference between a plan that's finished and one that's abandoned.

Where WISPWolf fits

WISPWolf was built by a cybersecurity MSP for tax and accounting firms. Instead of only producing a document, it checks your controls against your real systems — so if the plan says MFA is on for everyone and it isn't, you find out before an insurer does. Plans start at $39 a month. See plans and pricing or book a consultation to talk it through.

Frequently asked questions

Get Your Compliance Score