A WISP — Written Information Security Plan — is a documented data security program that every US tax preparer is required by federal law to create, maintain, and update. The obligation comes from the FTC Safeguards Rule (16 CFR Part 314) under the Gramm-Leach-Bliley Act, and the IRS asks whether you have one when you renew your EFIN. The IRS publishes a free template in Publication 5708.
It is not optional, it is not a best practice, and "we use good passwords" is not a plan. This guide covers who is covered, what the plan must contain, which requirements small firms are exempt from, and how to produce one without hiring a consultant.
Why a tax firm is a "financial institution"
The Gramm-Leach-Bliley Act directs the FTC to require safeguards at financial institutions. The FTC's definition is broad, and tax return preparers are explicitly included — the Safeguards Rule reaches any business significantly engaged in providing financial products or services to consumers, which covers preparers, CPAs doing tax work, and enrolled agents.
Firm size does not create an exemption from the rule itself. A sole practitioner with 200 clients is covered. Size only affects which requirements apply, covered below.
What the Safeguards Rule requires
The FTC substantially amended the Safeguards Rule in 2021, with full compliance required as of June 9, 2023. The amended rule replaced the old "reasonable safeguards" standard with nine specific, auditable elements. Your WISP is the document that shows you have them.
| # | Requirement | What it means for a tax firm |
|---|---|---|
| 1 | Designate a Qualified Individual | One named person accountable for the program. Can be an owner or an outside provider — but the firm retains responsibility. |
| 2 | Written risk assessment | Identify foreseeable internal and external risks to client data, and document the criteria used to evaluate them. |
| 3 | Design and implement safeguards | The eight technical controls listed below. |
| 4 | Test and monitor | Continuous monitoring, or annual penetration testing plus vulnerability assessments at least every six months. |
| 5 | Train personnel | Security awareness training for staff, kept current, plus qualified security personnel. |
| 6 | Oversee service providers | Select providers capable of safeguarding data, require safeguards by contract, and periodically reassess them. |
| 7 | Evaluate and adjust | Update the program as your systems, staff, or threats change. |
| 8 | Written incident response plan | A documented plan covering goals, roles, internal processes, communication, and post-incident revision. |
| 9 | Annual written report | The Qualified Individual reports at least annually to a board or senior officer on program status. |
The eight required safeguards
Element 3 breaks down into specific controls that your WISP must describe:
- Access controls — authenticate users and limit access to only what each role needs
- Data inventory — know what client data you hold, where it lives, and who can reach it
- Encryption of customer information both in transit and at rest
- Secure development practices for any application your firm builds in-house
- Multi-factor authentication for anyone accessing information systems — this one is not negotiable and is a frequent gap
- Secure disposal of customer information no later than two years after the last use, unless retention is otherwise required
- Change management procedures
- Monitoring and logging of authorized user activity, to detect unauthorized access or use
The small-firm exemption — and what it does not cover
If your firm maintains customer information concerning fewer than 5,000 consumers, you are exempt from four of the nine elements:
- The written risk assessment (element 2)
- Continuous monitoring or annual penetration testing and semiannual vulnerability assessments (element 4)
- The written incident response plan (element 8)
- The annual written report to the board (element 9)
Two cautions. First, the threshold counts consumers whose information you maintain, not active clients — prior-year records count, and firms cross 5,000 sooner than they expect. Second, everything else still applies: the Qualified Individual, all eight safeguards including MFA and encryption, training, service provider oversight, and program updates. The exemption trims documentation and testing burden; it does not make a small firm unregulated.
Breach notification: the 30-day clock
Since May 13, 2024, the Safeguards Rule has required covered financial institutions to notify the FTC of a notification event — unauthorized acquisition of unencrypted customer information involving 500 or more consumers — as soon as possible and no later than 30 days after discovery. Notice is filed through the FTC's online form and becomes part of a public database.
Note the word unencrypted. Encryption at rest is not only a control requirement; it is what keeps a lost laptop from becoming a public filing. State breach notification laws apply on top of this, and IRS incident reporting obligations apply separately.
Where the IRS fits
The IRS does not write the Safeguards Rule, but it enforces awareness of it through the e-file program:
- Publication 4557, Safeguarding Taxpayer Data — the checklist-style overview every preparer is pointed to
- Publication 5708, Creating a Written Information Security Plan — a fill-in-the-blanks WISP template built for small practices
- EFIN renewal asks whether you maintain a WISP. Answering yes without one is a problem of its own.
- Data theft affecting taxpayer data should be reported to the IRS Stakeholder Liaison promptly, in addition to FTC and state notification.
Failure to maintain a program can support FTC enforcement, and the IRS can suspend or revoke an EFIN — which, for a firm that e-files, is an existential outcome rather than a fine.
Building your WISP in a week
- Start from Pub 5708. It is free, IRS-authored, and structured for firms with a handful of staff. Do not buy a template first.
- Name your Qualified Individual in writing. In a small firm this is usually the owner or managing partner.
- Inventory your data. List every system holding client information: tax software, document portal, email, cloud drives, scanners, local machines, backups, and any offshore or contractor access. You cannot write controls around systems you have not listed.
- Assess and record risks against that inventory — phishing, lost devices, credential reuse, departing employees, vendor breach.
- Close the obvious gaps first. In practice the recurring findings at tax firms are the same four: MFA not enabled everywhere, no encryption at rest, shared logins, and no offboarding process.
- Document your vendors and confirm each contract includes a security obligation. This overlaps directly with your obligations under IRC §7216, which governs how you may use and disclose client tax data.
- Train your staff and log it. Date, attendees, topics. Undocumented training did not happen.
- Set a review date and put it on the calendar. An annual review is the difference between a plan and a PDF.
Frequently asked questions
Is a WISP legally required for a solo tax preparer?
Yes. The FTC Safeguards Rule applies to tax return preparers regardless of size. Firms holding information on fewer than 5,000 consumers are exempt from four documentation and testing elements, but the core program — including a Qualified Individual, MFA, encryption, and staff training — still applies.
How long does a WISP need to be?
Long enough to address the required elements against your actual systems. The Pub 5708 template produces a usable plan in roughly 10 to 20 pages for a small firm. Length is not the measure; coverage and accuracy are.
How often must a WISP be updated?
The rule requires evaluating and adjusting the program in light of testing results, material changes to operations, or anything else that materially affects safeguards. An annual review with interim updates when you change software, staff, or locations is the workable standard.
Does the IRS require me to submit my WISP?
No. There is no filing. You attest to having one at EFIN renewal and must be able to produce it if asked during an examination, an enforcement inquiry, or after an incident.
Does using cloud software satisfy the requirement?
No. A vendor's security posture is one input to your program, not a substitute for it. The Safeguards Rule specifically requires you to oversee service providers — which means the vendor's controls become something you evaluate and document, not something you delegate the obligation to.
What is the difference between a WISP and IRS Publication 1075?
Pub 1075 governs government agencies that receive federal tax information from the IRS. It is a useful security reference, but the rules that actually bind a private tax firm are the FTC Safeguards Rule, Pub 4557, and Pub 5708. If you are choosing what to align your practice with, start with those.
Where XyloDocs fits
Several Safeguards Rule controls are easier to evidence when client documents move through one auditable system rather than email threads and shared drives. XyloDocs is an AI tax workflow platform for tax firms — clients send documents by SMS, WhatsApp, email, or secure portal, everything is organized by client and tax year with encryption, access controls, and a complete audit trail, and finished packages export to your tax software.
That covers the data inventory, access control, encryption, and activity-logging elements for document intake specifically. It does not write your WISP for you, and no vendor can. See how XyloDocs handles security and client data or estimate what secure intake saves your firm in admin hours.
Last verified: August 9, 2026 This article is general information about federal data security requirements, not legal advice. Consult qualified counsel about your firm's specific obligations under the FTC Safeguards Rule and applicable state law.
Leave a Comment
Your comment is private and will only be visible to the author. We'll send you an email confirmation.