Written Information Security Plan (WISP): The Complete Guide

What a WISP actually is

A Written Information Security Plan — almost always shortened to WISP — is the document that proves your firm has thought through, written down, and operationalized how it protects sensitive client information. It is not a marketing page on your website. It is not a folder of vendor invoices. It is a single, governed document (with supporting appendices) that a regulator, insurer, or new employee can read and understand.

For tax, accounting, and financial-services firms, the WISP is the central artifact that ties together five obligations: the FTC Safeguards Rule, the Gramm-Leach-Bliley Act, IRS Publication 5708, IRS Publication 4557, and — for PTIN holders — the annual attestation on Form W-12.

Who needs a WISP

The short list of firms required to maintain a WISP includes paid tax return preparers, CPA firms, enrolled agents, bookkeepers, payroll companies, financial planners, and any small business that "engages in financial activities" under GLBA. See our WISP guide for bookkeepers and enrolled agents for how non-PTIN roles inherit the same obligations.

Solo practitioners are not exempt. A one-person tax practice with a single laptop still needs a documented WISP — the document scales down, but the obligation does not disappear.

How IRS Pub 5708, Pub 4557, FTC Safeguards, and GLBA fit together

These four documents are layered, not redundant:

• GLBA (1999) — the federal statute that defines who is a "financial institution" and triggers safeguarding duties.
• FTC Safeguards Rule, 16 CFR Part 314 — the implementing regulation. Lists the nine required elements of an information security program. See our GLBA Safeguards Rule guide and the FTC Safeguards checklist.
• IRS Publication 4557 — plain-English IRS guidance for tax preparers on safeguarding taxpayer data. Background reading in our Pub 4557 guide.
• IRS Publication 5708 — the WISP template. Fillable structure tailored to tax practices. Walkthrough in our Pub 5708 guide.

A current WISP must satisfy all four. The 2026 WISP requirements page summarizes which elements changed most recently.

WISP vs WISP policy vs security plan vs information security program

The terminology overlaps in confusing ways. Here is how the words actually relate:

• WISP / Written Information Security Plan — the umbrella document.
• WISP policy — a single rule inside the WISP (acceptable use, password, encryption).
• WISP plan — informal synonym for WISP; same thing.
• Security plan — generic term; in tax context it usually means the WISP.
• Written Information Security Program — the operational, living version of the WISP: the document plus the activities (training, reviews, monitoring) that bring it to life. The FTC Safeguards Rule technically requires a "comprehensive, written information security program," which is why the words are interchangeable in regulatory text.

Our companion written information security program guide covers the program side; this page covers the document side.

Sample WISP structure

The eleven-section structure most aligned with Pub 5708 and 16 CFR § 314.4:

1. Purpose, scope, and definitions
2. Roles and responsibilities — including the Qualified Individual
3. Risk assessment methodology and current findings
4. Administrative safeguards — policies, training, hiring
5. Technical safeguards — MFA, encryption, EDR, patching, backups
6. Physical safeguards — office, paper, devices
7. Vendor and service-provider oversight
8. Incident response plan
9. Employee training program
10. Continuous monitoring and testing
11. Annual review and approval

Our full WISP template article walks through each section with sample language, and the WISP template landing page compares free vs paid options.

Common WISP mistakes

• Treating the WISP as a one-time PDF. The Safeguards Rule requires the program to evolve — see why a one-time WISP fails.
• No documented risk assessment. Use our risk assessment template.
• Missing incident response plan. The incident response plan template closes this gap.
• No annual review report. See the annual review checklist.
• Vendor list without written diligence. Insurers and the FTC both ask for written vendor controls.
• Generic template without firm-specific systems. Auditors recognize unedited templates instantly.

Evidence and documentation

A WISP without supporting evidence is just a document. Keep, in a single secure location:

• Signed acknowledgement of the WISP by every employee
• Training completion records (at hire and annually)
• Most recent risk assessment with dates
• Vendor list with current SOC 2 / security attestations
• Patching, MFA, encryption, and backup status reports
• Annual review minutes and approval by the Qualified Individual
• For firms over 5,000 customers: annual report to the governing body

For cyber-insurance purposes the same evidence answers the questionnaire — see the cyber insurance application checklist.

Frequently asked questions

Open the FAQ section above each question for the full answer.

Educational content, not legal advice. Confirm your obligations with qualified counsel or your IRS Stakeholder Liaison.