Guide

How to write a WISP for your tax practice

Updated October 25, 2026 · About 8 minutes to read

If you prepare tax returns for pay, federal law requires you to have a Written Information Security Plan, or WISP: a document that says how your office protects clients' personal information. This guide explains where the requirement comes from, what the plan must cover, and how to write yours in an evening.

Who needs a WISP

Every paid preparer of individual returns, from a seasonal solo practice to a multi-office firm. The FTC treats tax preparers as financial institutions under the Gramm-Leach-Bliley Act, so the FTC Safeguards Rule (16 CFR Part 314) applies to you. The rule requires a written information security program. The IRS calls it a WISP and publishes a sample outline in Publication 5708.

The rule protects information about consumers: people who used your services for personal, family or household purposes, which in practice means individual (Form 1040) clients. A firm that prepares only business returns, such as Forms 1120 and 1065, generally doesn't hold consumer information under the rule. Almost every retail tax office prepares individual returns, so almost every one is covered.

There's no size exemption from having a plan. Offices that keep information on fewer than 5,000 consumers are excused from a few parts of the rule (a written risk assessment, continuous monitoring or annual penetration testing, a written incident response plan, and a yearly report to the owner), but they still need the plan itself and every other safeguard. Count carefully: the 5,000 isn't just this season's clients. It includes former individual clients whose records you still keep, and can include spouses and dependents on the returns you've filed. Doing those parts anyway is good practice, and they're where most real incidents are caught.

What the plan must cover

The Safeguards Rule lists the elements. In plain terms:

Element	What it means for a tax office
Qualified Individual	One named person who runs the program. In a solo practice, that's you.
Risk assessment	What could go wrong with client data (phishing, stolen passwords, lost laptops, ransomware) and how likely and harmful each is.
Safeguards	Access limited to people who need it, an inventory of where data lives, encryption, multi-factor sign-in, secure disposal, and watching for unusual activity.
Testing	Checking that the safeguards actually work.
Training	Security awareness training for everyone who touches client data.
Service providers	Choosing vendors that can protect data, requiring it in their contracts, and checking on them.
Incident response	What you'll do if client data is stolen or exposed, including the FTC notice described below.
Review	Updating the plan when your office changes, and at least once a year.

Step by step

Name your Qualified Individual. Write down who is responsible and who they report to.
List where client data lives. Every computer, phone, tax program, email account, cloud service, portal and filing cabinet. You can't protect what you haven't listed.
Assess your risks. For each common threat, note how likely it is, how bad it would be, and which safeguard reduces it. Be honest about gaps; the plan should say what you'll fix and when.
Put the core safeguards in place. The ones that stop most attacks on tax offices:
- Multi-factor sign-in on tax software, email and cloud storage.
- A separate login for each person, with only the access their job needs.
- Full-disk encryption (BitLocker on Windows, FileVault on Mac) on every computer.
- Automatic updates and antivirus.
- Daily backups during filing season, with a restore you've actually tested.
- A router with a changed default password and a separate guest network.
- Shredding paper and wiping old drives. Client information should be disposed of within two years of last use unless you need it longer.
Train your staff before each filing season and when someone new starts, with special attention to phishing and phone scams that impersonate clients.
Check your vendors. Make sure your tax software, email, cloud storage and IT provider are required by contract to protect client data, and review them yearly.
Plan for an incident. Know who you'll call (your IRS Stakeholder Liaison, your tax software provider, your insurer) and what you'll do first.
Write it down in the Publication 5708 outline: objectives and scope, Qualified Individual, risk assessment, inventory, safety measures, implementation, and attachments such as your incident steps.
Review it every year, ideally in the fall before PTIN renewal, and whenever you add staff, software or locations.

If client data is exposed

Since May 2024, the Safeguards Rule requires you to notify the FTC within 30 days of discovering that unencrypted information about 500 or more clients was acquired without authorization. Report data theft to your IRS Stakeholder Liaison right away as well, and check your state's breach notification law for notices to clients. Your incident plan should list these steps so nobody has to look them up under stress.

Common mistakes

Downloading a template and never filling it in. A plan that doesn't describe your actual office won't help you, and won't hold up if anyone asks.
Writing it once. Staff, software and threats change every season.
Shared logins for tax software, which make it impossible to know who did what.
No proof. Keep screenshots of your settings, training records and vendor reviews, so you can show the plan is in practice.

The fastest way to write yours

Wardstep turns 15 plain-English questions into a finished WISP in the Publication 5708 outline, with how-to steps for anything you're missing. The checklist and the plan are free. Wardstep Pro keeps it current with staff training links, evidence, vendor reviews, drills and a breach kit.

Build your WISP free

Sources

This guide is general information, not legal advice. Check the current rules and your state's laws for your situation.