WISP Compliance Proof: What Records to Keep and How Long

Having a Written Information Security Plan and proving you have one are two different things. When the IRS opens a security review, the FTC follows a complaint, or a cyber insurer asks follow-up questions, they are not asking for a PDF with a signature. They are asking for evidence that the program is implemented, current, and reviewed. That means dated records, named controls, and a clear paper trail. This guide covers exactly what records the IRS, FTC, and cyber insurers expect, how long to keep them, and a practical way to organize them so you can produce them on short notice.

IRS Records You Should Keep

IRS guidance in Publication 5708 and Publication 4557 expects tax preparers to protect taxpayer data and be able to demonstrate that protection. The specific records that satisfy an IRS security review or PTIN renewal issue are:

• Current signed WISP. Dated within the last 12 months, signed by the responsible party, and aligned with the safeguards you actually operate.
• Annual review attestation. A dated, signed statement from the firm owner or designated manager confirming the WISP was reviewed and updated for the current year.
• Staff acknowledgement forms. Signed acknowledgements from every current staff member showing they have read, understood, and agreed to follow the WISP.
• Training log. A record of training date, attendees, and the topics covered — such as phishing, password handling, and data handling procedures.
• Risk assessment document. A completed risk assessment conducted within the last 12 months, identifying risks and any remediation steps taken.
• Incident log. A running record of any security events, even minor ones, including near-misses and the response or resolution applied.
• Vendor list with security agreement status. A current list of third-party service providers that access or store taxpayer data, plus the status of each security agreement.

The IRS cares less about the policy language and more about whether the controls actually protect taxpayer data. Every record should connect a policy statement to a real operational practice.

FTC Records You Should Keep

The FTC Safeguards Rule under 16 CFR Part 314 requires a written information security program and records that prove the program is active. The records that matter most in an FTC inquiry are:

• Written information security program. The complete WISP, including administrative, technical, and physical safeguards for customer information.
• Designation of Qualified Individual. A written record identifying who is responsible for the program and reporting to senior leadership.
• Risk assessment documentation. A written analysis of risks to customer information, with periodic updates and after material changes.
• Technical control evidence. MFA configurations, encryption settings, endpoint protection status, and access control enforcement.
• Service provider security agreements. Contracts or addenda showing that vendors with access to customer data maintain appropriate safeguards.
• Breach notification records. If applicable, copies of any breach notifications, discovery records, and proof of required consumer or regulator notifications.
• Annual program review documentation. Records showing the WISP is reviewed at least annually and updated when business or security conditions change.

Cyber Insurer Records You Should Keep

Cyber insurance underwriters increasingly require a WISP at application, and they often ask for evidence that the controls in the policy are real. The records most commonly requested are:

• Current WISP. Most carriers now require a written information security policy at application and renewal.
• MFA evidence. Screenshots or configuration exports showing multi-factor authentication is enforced on email, remote access, and privileged accounts.
• Compliance score or readiness assessment. A recent assessment documenting your security posture, control gaps, and remediation status.
• Incident response plan. A documented plan with defined roles, escalation steps, communication procedures, and legal notification contacts.
• Training records. Proof that staff complete security awareness training at least annually and after material changes.
• Vendor security documentation. Security agreements, questionnaires, or assessment results for vendors handling client data.

Insurers may deny claims if the documented controls were not in place at the time of a loss. Dated records protect both your compliance standing and your coverage.

How Long to Keep WISP Records

Retention rules vary by regulator and by document type. The following guidelines are defensible for most tax preparers and CPA firms:

• FTC Safeguards Rule records: Minimum of three years from the date the record was created.
• IRS tax-related records: Seven years from the date of the tax return, consistent with general IRS recordkeeping guidance.
• Investigation or litigation records: Indefinitely, until the matter is fully resolved and any applicable limitations periods have passed.

When in doubt, keep the record longer. Storage is cheap; a missing attestation or training log during an inquiry is expensive.

Organizing Your Documentation

A clean filing structure makes it easy to produce the right records quickly. Organize by year first, then by category. A practical structure looks like this:

• 2026
  • WISP Policy — current signed WISP, prior versions, and change log
  • Annual Review — owner attestation, review notes, and approval records
  • Risk Assessment — risk analysis, remediation tracker, and reassessment schedule
  • Staff Training — training materials, attendance logs, and acknowledgement forms
  • Technical Controls — MFA evidence, encryption settings, endpoint protection reports
  • Vendor Agreements — vendor list, security agreements, and due diligence records
  • Incident Log — security events, responses, and post-incident notes

Name every file with a date and version. A file called WISP-v3-2026-06-28.pdf is far more credible than WISP_final.pdf.

How WISPWolf Handles Compliance Evidence

WISPWolf's evidence collection is designed to organize records in the dashboard automatically. Signed attestations, training logs, and policy acknowledgements are timestamped and stored alongside the WISP they support. The audit-ready PDF export compiles everything into a single package for insurance underwriting, regulatory review, or client due diligence. Gap identification shows which records are missing or overdue, so the annual review becomes a continuous process instead of a last-minute scramble.

Sources

• IRS Publication 4557, Safeguarding Taxpayer Data
• IRS Publication 5708, Requirements for a WISP
• FTC 16 CFR Part 314, Safeguards Rule
• FTC guidance on record retention under the Safeguards Rule

Related Resources

• FTC Safeguards Rule WISP Checklist for Tax Preparers
• How to Document WISP Changes Year-Round
• Annual WISP Review Checklist for CPA Firms
• Cyber Insurance Questionnaire for Tax Preparers
• Security Awareness Training for Tax Preparers

Get Your Free Compliance Score →