The IRS publishes a free sample written information security plan (WISP) for tax professionals in Publication 5708. If you don't have a WISP yet, it's a good place to start. But it isn't a finished plan, and treating it as one is a common mistake.
Why tax professionals need a WISP at all
Tax preparers count as "financial institutions" under the FTC Safeguards Rule (16 CFR Part 314), so federal law requires a written information security program. The IRS and the Security Summit, its partnership with states and the tax industry, remind preparers of this every year. And when you renew your PTIN, Form W-12 asks you to check a box acknowledging that paid preparers are required to have a WISP.
What the template gets right
- It covers the main topics the rule expects.
- It uses plain language, written for small practices.
- It costs nothing and is easy to start with.
What a template can't do
1. Describe your actual office. A plan has to reflect your tax software, your client portal, your cloud storage, your staff and how data really moves through your practice. Blanks filled in with generic answers won't hold up if anyone looks closely.
2. Put the controls in place. The plan says you use multi-factor authentication, encrypt client data and dispose of old records securely. Someone has to actually do those things, and be able to prove it.
3. Name someone who owns it. The rule requires a Qualified Individual who oversees and enforces the program. A template can have a blank for the name, but it can't do the job.
4. Stay current. New staff, new software and new vendors all change your risk. A plan written once and filed away is out of date by the next filing season.
A practical path
- Start with Publication 5708 if you're doing it yourself, or have a professional build the plan around your practice.
- Close the gaps it reveals, starting with MFA everywhere, encrypted storage and backups, and access limited to the people who need it.
- Name a Qualified Individual. This can be an outside provider.
- Review the plan every year before filing season.
If you'd rather hand this off, that's what we do. Get in touch and we'll tell you what's missing. More on WISPs for tax preparers, or get the tax checklist to see where your office stands.
References: IRS Publication 5708, IRS Publication 4557, 16 CFR Part 314. General guidance, not legal advice.