Guides › IRS Publication 5708 explained in plain English

IRS Publication 5708 explained in plain English

A plain-English summary of IRS Publication 5708, the IRS guide to creating a Written Information Security Plan for tax and accounting practices, with what each section asks of you.

IRS Publication 5708, "Creating a Written Information Security Plan for Your Tax & Accounting Practice," is the IRS and Security Summit guide to writing a WISP. It was first published in 2022 and updated in August 2024. It is about 28 pages and includes a sample plan.

Here is what it asks of you, section by section, in plain terms.

1. Know the rules that apply to you

Tax and accounting firms are covered by the FTC Safeguards Rule. Publication 5708 tells you to read it alongside IRS Publication 4557, "Safeguarding Taxpayer Data," which lists practical security steps.

2. Name who is responsible

Choose a Qualified Individual to run your security program. In small offices, that's often the owner. If an outside IT provider helps, you still stay responsible.

3. Know what data you have and where it lives

List the taxpayer information you collect and every place it's stored or passes through: tax software, email, laptops, phones, cloud storage, backup drives, and paper files.

4. Assess the risks

For each place your data lives, ask what could go wrong (phishing, a stolen laptop, a careless employee, a vendor breach) and how bad it would be. Firms with fewer than 5,000 consumer records don't need a formal written risk assessment under the Safeguards Rule, but thinking it through still shapes your plan.

5. Put safeguards in place

This is the core of the plan. The 2024 update highlights:

• Multi-factor authentication for anyone accessing your systems, unless your Qualified Individual approves an equally strong alternative in writing
• Encryption of client data stored on devices and sent over the internet
• Access controls so people only see what they need
• Secure disposal of old devices and paper
• Monitoring for unusual activity

6. Train your people

Everyone who handles client data, including seasonal staff, should be trained on the plan and on spotting phishing.

7. Oversee your vendors

Choose service providers that can protect your data, put security expectations in their contracts, and check them periodically.

8. Plan for incidents

Write down what you'll do in a breach. The 2024 update adds that if 500 or more people are affected, you must notify the FTC as soon as possible and no later than 30 days after discovery. Also contact your IRS Stakeholder Liaison and your state tax agency.

9. Keep it current

Review the plan at least yearly and after any significant change.

The hard part: making it yours

The sample in Publication 5708 is a starting point full of blanks. The IRS says "there is no one-size-fits-all WISP," which means you have to adapt every section to your office.

WispMint does that adaptation for you. Answer about 10 minutes of questions, or describe your practice in a sentence and let AI fill them in. You get a plan that follows Publication 5708's structure with your office's details, plus a readiness score that shows what to fix. From $49, downloaded as PDF and Word.

Build your plan