What is a WISP?
Written Information Security Plan
Short answer
A WISP is the written information security plan the FTC Safeguards Rule requires of tax preparers: who is responsible, what data the firm holds, the risks, the controls.
What it is
A WISP (Written Information Security Plan) is the document that shows a firm has a security program, not just security habits. It typically names the qualified individual, lists the systems and data the firm holds, records the risk assessment, describes each safeguard (passwords and MFA, encryption, backups, device rules, disposal), sets training and vendor review schedules, and lays out what happens after an incident.
The IRS and the Security Summit publish a template, Publication 5708, written for small tax practices. The plan is reviewed yearly and whenever the firm's systems change.
Why it matters for a tax firm
The WISP is the first thing a reviewer, an insurer, or the IRS asks for after a data incident. Writing it also forces the inventory question: where do client documents actually go, and which vendors see them.
How XyloDocs handles it
Firms list XyloDocs in the WISP's vendor section. The platform's access logs and the fact that document AI runs on private systems give the plan something concrete to cite.
Related terms
Read more on XyloDocs
Sources
Questions about WISP
Is a WISP required by law?
Yes. The FTC Safeguards Rule requires a written information security program for financial institutions, and tax preparers are financial institutions under the rule.
How long should a WISP be?
Long enough to be true. The IRS template runs about a dozen pages for a small firm. A plan nobody has read is worse than a short one the whole office follows.
Last reviewed: October 16, 2026. This glossary explains terms; it is not legal or tax advice. Check the cited source for the current rule.
Stop chasing documents and status calls
XyloDocs is the AI client communication platform for tax firms: bilingual calls and texts, document intake over WhatsApp and email, and status updates clients read before they phone.