Guides › WISP for tax preparers: what the IRS and FTC require
WISP for tax preparers: what the IRS and FTC require
Do tax preparers need a Written Information Security Plan? Yes. What the FTC Safeguards Rule and IRS Publication 5708 require, what to include, and how to finish yours today.
If you prepare tax returns for pay, you are required to have a Written Information Security Plan, usually called a WISP. The requirement comes from the FTC Safeguards Rule, and the IRS reinforces it in Publication 5708 and on the PTIN application and renewal form.
This guide explains who needs one, what it must contain, and the fastest way to get a plan that actually fits your office.
Who needs a WISP?
The FTC Safeguards Rule (16 CFR Part 314) applies to "financial institutions" under the Gramm-Leach-Bliley Act, and that definition includes professional tax preparers. In practice, that means:
- Solo preparers and seasonal offices
- Enrolled agents and CPA firms
- Bookkeepers and payroll providers who handle client financial data
- Electronic Return Originators (EROs) with an EFIN
Size doesn't exempt you. Firms with records on fewer than 5,000 consumers are excused from a few parts of the rule (such as a written risk assessment and an annual report to a board), but they still need a written information security program.
What the IRS says
The IRS and its Security Summit partners publish Publication 5708, "Creating a Written Information Security Plan for Your Tax & Accounting Practice", last updated in August 2024. It includes a sample plan and stresses that "there is no one-size-fits-all WISP": your plan should match your firm's size, complexity, and the data you handle.
The PTIN application and renewal form (Form W-12) also asks you to confirm you know that paid preparers must create and maintain a written plan. That question is an acknowledgment, not a certification that your plan is done. But checking it without a plan is a risk you don't need.
What a WISP must include
Based on the Safeguards Rule and Publication 5708, a small office's plan covers:
- A Qualified Individual: the person responsible for the program. In a solo practice, that's you.
- A data inventory: where taxpayer information lives, from tax software and email to phones, cloud storage, and paper files.
- A risk assessment: what could go wrong with that data and how likely and harmful it would be.
- Safeguards: access controls, encryption, multi-factor authentication (now expected for anyone accessing your systems), secure disposal, and physical security.
- Staff training: including seasonal and part-time help.
- Service provider oversight: how you choose and monitor vendors that touch client data.
- An incident response plan: what you do in a breach, including notifying the IRS, your state, and the FTC if 500 or more people are affected (within 30 days of discovery).
- Regular review: at least once a year and after any big change.
The three ways to get one
| Option | Time | Cost | Best for |
|---|---|---|---|
| Fill in the IRS sample from Publication 5708 | 4 to 10 hours | Free | People who enjoy writing policy documents |
| Hire a consultant or IT provider | 1 to 3 weeks | Hundreds to thousands of dollars | Larger firms with complex systems |
| Answer questions and let software write it | About 10 minutes | From $49 | Solo and small offices that want it done today |
How WispMint works
WispMint asks about 10 minutes of plain questions about your office: how many people work there, which tax software you use, where files are stored, whether you use MFA, and so on. You never enter client data.
You can also describe your practice in a sentence and AI fills in the answers for you to check. You see a free readiness score that shows the gaps in your current setup. Then AI writes a plan tailored to your answers, built from Publication 5708 and the Safeguards Rule, and you download it as PDF and Word.
WispMint was designed by a cybersecurity professional with 25 years of experience.
Frequently asked questions
Is a WISP really required for a one-person tax office?
Yes. The Safeguards Rule has no exemption for solo preparers. Your plan can be short, but it must be written and it must match how you actually work.
Do I file my WISP with the IRS?
No. You keep it and follow it. Be ready to show it if the IRS, FTC, a cyber insurer, or a client asks.
How often should I update it?
At least once a year, and whenever you change software, add staff, or move offices. WISP Plus lets you edit your answers and keep version history.
Does a WISP make me compliant?
The written plan is a required part of compliance. You also have to do what it says. The readiness score shows what's missing so you can fix it.
Build your WISP in 10 minutes
Answer plain-English questions, see your free security score, and download a plan built from IRS Publication 5708 and the FTC Safeguards Rule, or FTC and NIST guidance for other businesses. From $49.
Start free See a sample plan