A tax firm can have a written security plan and still leave important questions unanswered. Who removes a seasonal preparer’s access? Where do downloaded client documents go? Who takes charge if a mailbox is compromised during filing season?
A useful Written Information Security Plan, or WISP, connects those daily decisions to the firm’s security responsibilities. It should explain what information you protect, who is accountable, which safeguards you use, and how you check that they work. November is a practical time to resolve gaps before the next busy season.
What Should Your Tax Firm's WISP Cover?
A practical WISP should address these six areas:
- Security responsibility: Who oversees the firm's information security program?
- Client information: Where is sensitive taxpayer information stored, and how is it protected?
- Access controls: Who can access client records, and how is access removed when employees leave?
- Employee and vendor security: How are staff trained and outside service providers evaluated?
- Security testing: How does the firm review its safeguards and document improvements?
- Incident response: What happens if taxpayer information is exposed or stolen?
This checklist provides a starting point. The rest of the plan should explain how these responsibilities are handled in your firm's daily operations.
Understand the requirement and the limits of a template
The IRS’s June 2026 reminder for tax professionals states that a WISP is required by law. Tax preparation firms are among the businesses covered by the FTC Safeguards Rule. The plan must reflect the firm’s size, activities, and the sensitivity of its customer information.
There is a narrower exception that smaller firms should understand. Under 16 CFR 314.6, maintaining information concerning fewer than 5,000 consumers exempts a covered institution from specific provisions concerning the formal written risk assessment, prescribed testing, written incident response plan, and annual reporting. The written security program and underlying risk assessment remain required, along with other applicable safeguards. That threshold concerns consumers, not employee count.
Use IRS Publication 5708 as a starting framework. The publication expressly warns that its sample does not replace a plan built for your firm. Have the appropriate compliance adviser or legal counsel confirm applicability and exceptions. The recommendations below help make the plan usable; they are not a complete legal determination.
Name the people who own the work
The plan should identify the Qualified Individual responsible for overseeing the security program and explain how firm leadership supervises it. Outsourcing technical work does not transfer the firm’s responsibility for compliance.
Make responsibilities concrete. Who approves access, reviews provider reports, authorizes spending on a serious gap, and checks that a departed worker’s accounts are disabled? Identify a backup for each role that cannot wait while someone is away.
Avoid assigning every duty to “IT.” A technology provider can configure controls, but a partner may need to decide which employees should see sensitive client files. An office manager may coordinate training records. The WISP should show how those responsibilities meet, including what happens when an issue remains unresolved.
Follow client information through the practice
List the information your firm handles and trace how it arrives, moves, and leaves. Include tax software, client portals, email, cloud storage, laptops, scanners, and paper records. Add remote workers and outside service providers.
Then walk through one ordinary client engagement. An employee downloads a return from a portal, opens it on a laptop, prints a working copy, and emails a question. Each step can create another location that needs protection. A list of office computers alone will not show those copies.
Keep supporting inventories in controlled attachments so they can be updated without rewriting the entire policy. Record ownership and review dates. Limit access to detailed system information, and do not put passwords or recovery codes in a broadly distributed WISP.
Explain the safeguards in operational terms
The FTC’s Safeguards Rule guide covers access controls, encryption, multifactor authentication, application security, logging, and other safeguards. Your plan should describe how the applicable controls work in your practice and who verifies them.
Replace “employees use secure systems” with a practical description of the approved client portal, access approval process, and device requirements. Explain how staff report a lost laptop and how IT checks whether its protection was functioning.
Cover physical records as well. Decide where working papers may be stored, how visitors are supervised, and how documents are destroyed. Remote staff need guidance for printing and storage at home, where office procedures may not apply automatically.
Set a documented retention schedule with professional advice. The Rule includes a disposal requirement with exceptions for legitimate needs, legal retention, and certain technical limitations. A blanket instruction to delete all tax records after two years would be misleading. Make the approved schedule clear enough for staff to follow without guessing.
Address seasonal staff and outside providers
Consider a hypothetical 12 person tax practice that adds three temporary preparers. Before they begin, the firm should decide which client assignments they can access, provide individual accounts, complete training, and record an end date for access. When assignments change, access should change with them.
After the engagement ends, an assigned person should confirm that accounts, remote access, and any locally stored records have been handled according to policy. This example turns a general access statement into a process someone can complete and document.
The plan should also cover providers that handle customer information. Review their safeguards, include appropriate security requirements in contracts, and reassess them according to risk. For a client portal or cloud tax application, ask who reports an incident, how your firm gets its records back, and what evidence supports the vendor’s security claims.
Show how you test and maintain the program
A policy statement needs evidence behind it. Keep records such as training completion, access reviews, backup restoration results, identified weaknesses, and corrective actions. Give unresolved items an owner and a due date.
The Rule’s testing provisions depend in part on monitoring arrangements and the limited small institution exceptions. Have your adviser identify which requirements apply rather than assuming that antivirus reports satisfy every testing obligation. Where required, the Qualified Individual must also provide a written report to the governing body or responsible senior officer at least annually.
Review the WISP when the practice changes. A new office, acquisition, tax platform, or remote work arrangement can make an older description inaccurate. An annual calendar reminder is useful, but a significant change should not wait for that date.
Make incident instructions easy to find
Include a response procedure even where a particular formal plan requirement is exempted. Staff need a known way to report suspicious activity, and leadership needs a contact list that remains available if email fails. IRS Publication 4557 provides tax specific security and response guidance.
The IRS advises tax professionals who experience data theft to contact their local IRS Stakeholder Liaison. Build that step into the response process alongside IT, counsel, insurance, and applicable state reporting.
The FTC also requires notification as soon as possible, and no later than 30 days after discovery, for a qualifying event involving unauthorized acquisition of at least 500 consumers’ unencrypted information. Encrypted information can count if the key was accessed. Its notification guidance explains the trigger, including the presumption of acquisition after unauthorized access unless reliable evidence establishes otherwise. That is not a universal deadline for every notice; other obligations may apply.
Turn the document into a working plan
Ask a partner and the person responsible for IT to walk through one seasonal worker departure and one suspected data theft. If they cannot identify the next action, the owner, and the record that proves completion, revise that part of the plan.
Memphis Computer Support offers cybersecurity compliance support to help businesses align documentation and security practices. Contact MCS to discuss the technology controls, responsibilities, and evidence your tax practice needs to support its WISP before filing season.
