Resources

A WISP for Tax Preparers: What It Is and How to Start

September 26, 2026

Filing season is a few months away, and the IRS has been repeating one message to tax professionals all year: you need a written information security plan. If you prepare returns or keep books for clients, a WISP for tax preparers isn’t optional paperwork. Federal law requires it, and the IRS repeated that in its August 2026 reminder to the profession.

The good news is that a WISP doesn’t have to be a binder nobody reads. For a small practice, it can be a few clear pages that describe how you actually protect client data.

Why tax and accounting firms need a WISP

Under the Gramm-Leach-Bliley Act, tax preparers and accountants count as financial institutions. That puts them under the Federal Trade Commission’s Safeguards Rule, which requires a written plan for protecting customer information.

Since May 2024, the rule has one more piece: if a security event exposes unencrypted information about 500 or more people, the firm must report it to the FTC, generally within 30 days of finding out.

Firms that hold records on fewer than 5,000 people are excused from a few parts of the rule, such as the formal written risk assessment. They still need the plan itself.

What goes into a WISP for tax preparers

According to the FTC’s requirements, as summarized by the IRS, your plan should cover at least:

1. A named coordinator. One person is responsible for the security program. In a small office, that may be the owner.
2. Your risks. Where client data lives (computers, tax software, email, paper files, phones) and what could go wrong in each place.
3. Your safeguards. The protections you use, and how you check that they work. Think two-step sign-in, encrypted laptops, locked file cabinets and limits on who can see what.
4. Your service providers. Which outside companies touch client data, such as your tax software, cloud storage and IT provider, and how you make sure they protect it too.
5. Training. How staff learn to spot scams, especially the fake “new client” emails that hit tax offices every season.
6. What happens when something goes wrong. Who calls whom, how you lock things down, and how you decide whether to notify clients and regulators.

The IRS publishes a free template, Publication 5708, written for small tax and accounting practices. It is the easiest place to start.

Where small practices usually get stuck

The template asks questions that sound simple until you try to answer them. Who has the administrator password to your email? Does two-step sign-in cover every account that can reach client files, including the old one your seasonal preparer used? When did anyone last restore a file from backup to prove it works?

Those questions are technical, and the honest answers often live in different people’s heads. Gather them before you start writing, so the plan describes what you really do instead of what you hope you do.

What to do this week

1. Download IRS Publication 5708 and read it once, start to finish.
2. Name your security coordinator.
3. List every place client data lives, including phones and paper.
4. Turn on two-step sign-in for email, tax software and cloud storage if it isn’t already on.
5. Book one hour on the calendar to fill in the template, and set a reminder to review it each year before filing season.

If you would like a second set of eyes, our IT consulting and strategy services start with a plain-language review of how your office is set up today, and our page for professional services firms explains how we support accounting and tax practices.