In a hurry? Get your free Compliance Score, then come back to this guide.
Take the Free Quiz View Sample WISPThis page explains the difference between the written plan and the ongoing security program behind it. The phrase "written information security program" appears in the FTC Safeguards Rule, in state breach laws like Massachusetts 201 CMR 17.00, and in nearly every cyber insurance application. It refers to the same obligation tax and accounting firms know as a WISP — with one important nuance. A plan is the document; a program is the document plus the operational activities that keep it true.
Program vs one-time document
A one-time WISP PDF sitting in a shared drive does not satisfy the Safeguards Rule. The rule explicitly requires the program to be "regularly tested or otherwise monitored," with results reported to a qualified individual and the governing body. See why one-time WISPs fail for the practical implications.
Mapping program elements to IRS Pub 5708, FTC Safeguards, and GLBA
The seven operational elements every program should contain:
- Risk assessment — required by 16 CFR § 314.4(b); see the risk assessment template.
- Safeguards — administrative, technical, and physical, designed against the risks identified. Pub 5708 and Pub 4557 both spell these out.
- Employee training — at hire and annually, with attendance records.
- Vendor management — written due diligence, contract clauses, ongoing review.
- Incident response — see the incident response plan template.
- Annual review — see the annual review checklist.
- Evidence collection — training logs, vendor attestations, MFA reports, patch status.
How the documents and program fit together
- The WISP is the umbrella document — see how to write one step by step.
- The WISP template (for tax preparers or for CPA and accounting firms) is the structure you start from.
- The program is the recurring operation that keeps the WISP current.
- The FTC Safeguards checklist is the grading rubric.
- The cyber insurance application checklist is how insurers verify the program is real.
Evidence — the missing half of every program
A program is only as defensible as its evidence. Auditors and underwriters do not grade the WISP document on style; they ask for proof that each control is operating. Maintain a single, indexed evidence folder: training logs, vendor SOC 2 reports, MFA enforcement screenshots, patch status, backup test results, incident logs, and the annual review approval.
Educational content, not legal advice. Refer to 16 CFR Part 314 and IRS Publications 4557 and 5708 for the authoritative requirements.
Is your information security program living or static?
Take the 15-question quiz to see how your program measures up against IRS Pub 5708 and the FTC Safeguards Rule.
Frequently asked questions
What is a written information security program?
It is the combination of a written security plan and the operational activities that bring it to life: risk assessments, safeguards, employee training, vendor oversight, incident response, annual review, and evidence collection. The FTC Safeguards Rule uses this term in 16 CFR § 314.3.
How is a written information security program different from a WISP?
A WISP is the document. A program is the document plus the program activities. In practice the two terms are used interchangeably, but a program implies ongoing operation while a plan can suggest a one-time deliverable.
Where does the FTC define a written information security program?
16 CFR § 314.3 requires covered financial institutions to 'develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts.' The nine required elements are in § 314.4.
What elements must a written information security program contain?
The Qualified Individual, a written risk assessment, administrative/technical/physical safeguards, vendor oversight, employee training, monitoring and testing, an incident response plan, and an annual report to the governing body (for firms with 5,000+ consumers).
Does a tax preparer need a written information security program or a WISP?
Both terms refer to the same obligation. IRS Pub 5708 says WISP; the FTC Safeguards Rule says written information security program. A tax preparer satisfies one by satisfying the other.
Is a sample written information security program available?
Yes. IRS Publication 5708 Appendix B is the most widely used sample. WISPWolf publishes a structured starter program in the Compliance Starter Kit.
Can I see an example of a written information security program?
Yes. See the sample WISP in our free Compliance Starter Kit. Use any example as a structure only. Your program must reflect your own systems, staff, and vendors.
Sources & References
Primary regulatory and standards sources used throughout WISPWolf's compliance guidance.
- IRS Publication 5708 — Creating a Written Information Security Plan
- IRS Publication 4557 — Safeguarding Taxpayer Data
- FTC Safeguards Rule (16 CFR Part 314)
- Gramm-Leach-Bliley Act (GLBA) Safeguards
- IRS Tax Security — Protect Your Clients, Protect Yourself
- NIST Cybersecurity Framework
- Microsoft Security Documentation
Get the free WISPWolf Compliance Starter Kit
Download the starter kit and identify your compliance gaps. Includes an IRS WISP starter template (not a completed customized WISP), FTC Safeguards Rule checklist, GLBA checklist, risk assessment worksheet, cyber insurance guide, and tax preparer compliance checklist.
Get Your Free WISP Compliance Score
See how your firm's security practices compare to FTC Safeguards Rule and IRS WISP expectations. Answer 15 questions and get a personalized scorecard in minutes.
IRS Pub 5708 Compliant · FTC Safeguards Rule · AES-256 Encrypted · No Credit Card Required