Back to Blog
    what-is-a-wisp
    how-to-write-an-information-security-policy
    security-program-guidelines
    data-protection-plan
    information-security-policy

    Written Information Security Program: 7 Items Tax Pros Must Document

    Dustin CollettOctober 17, 2026

    A written information security program (WISP) is a documented plan that spells out how your firm protects customer data, and the FTC Safeguards Rule makes it a legal requirement for tax and accounting professionals. Before anything else, check key controls: a designated Qualified Individual who runs the program, a written risk assessment, and multifactor authentication plus encryption. An incident response plan completes the basics.

    TL;DR:

    • Without continuous monitoring, firms must conduct annual penetration testing and vulnerability assessments at least every six months, then update controls and risk assessments using findings.
    • The FTC requires electronic notification for unauthorized acquisition of unencrypted customer information involving at least 500 customers, so encryption can limit reportable events.
    • Map systems and data within 30 days, document risks, controls, and owners by day 90, then complete response planning and staff training by day 180.
    • Use IRS Publication 5708 as a starting point, but adapt its sample language to your systems and staff, and document the reasons for each change.
    • Include vendor contract requirements and access rules in the written controls; service provider oversight is a common gap for small firms.

    Table of Contents

    Why does the Safeguards Rule require a WISP?

    The FTC treats tax and accounting professionals as financial institutions, whatever the size of the firm. Under the FTC Safeguards Rule, you must develop, implement, and maintain a written information security program to protect customer data. The formal citation is 16 CFR Part 314, and the IRS confirms the same expectation in its reminder to tax pros.

    The program has several goals:

    • Keep customer information secure and confidential.
    • Protect against anticipated threats to that information.
    • Prevent unauthorized access that could cause substantial harm to customers.

    The FTC scales its expectations to your size and the sensitivity of your data, but even small firms handling tax data typically need controls like MFA and encryption to meet the "reasonable" standard. Certain security incidents also trigger a duty to notify the FTC, which we cover below.

    What does a compliant WISP have to include?

    Think of the Safeguards Rule as a checklist. For each element, write down what you do, who owns it, and when you last verified it.

    • Qualified Individual: Name one person to coordinate the program and set a written reporting line to your owners, board, or a senior officer. The FTC's FAQ guidance explains this role.
    • Risk assessment and inventory: Document the threats you face and list every system, device, and repository that touches customer data.
    • Administrative safeguards: Written policies, staff training, access control lists, and oversight of service providers.
    • Technical safeguards: MFA, encryption of customer information at rest and in transit, logging and monitoring, and change management.
    • Physical safeguards: A hardware inventory and locked storage for paper records.
    • Testing: Continuous monitoring, or annual penetration testing plus vulnerability assessments at least every six months.
    • Incident response plan: Written steps for containing, investigating, and reporting an event.

    Pro Tip: Write each control as a sentence a new hire could verify, such as "MFA is required on email, tax software, and remote access," instead of a vague promise to "use strong security."

    How do you draft and roll out a WISP?

    Use this sequence to guide implementation. Our compliance roadmap for the Safeguards Rule goes deeper on timing.

    1. Define scope (first 30 days): List the customer information, systems, and processes the plan covers, and map how data flows between them.
    2. Inventory assets (first 30 days): Record hardware, software, and data repositories, and note where sensitive data lives, as the NIST quick-start guide recommends.
    3. Assess risk (by day 90): Write your criteria, then document threats, likelihood, and impact.
    4. Select controls (by day 90): Choose and document safeguards, including vendor contract requirements and access rules.
    5. Assign roles (by day 90): Name the Qualified Individual and deputies, and write down their responsibilities.
    6. Draft incident response (by day 180): Spell out steps, internal and external contacts, and the notification workflow. Our incident response playbooks can help.
    7. Publish, train, and schedule reviews (by day 180): Share the plan, train staff, and set recurring reviews plus triggers for earlier ones, as the IRS recommends.

    What happens after the WISP is written?

    A WISP is a living document. Whenever your software, staff, or technology stack changes, the plan needs to change with it.

    Continuous monitoring is the preferred way to prove your controls work. Without it, the Safeguards Rule requires annual penetration testing and vulnerability assessments at least every six months, which is a common pitfall for small and mid-sized firms. Use every test result to update your controls and your risk assessment.

    • Log and track security events so unusual activity stands out.
    • Feed findings from tests and incidents back into the plan.
    • Record who must sign off before any incident notification goes out.

    Notification threshold: Under the Rule, a notification event is the unauthorized acquisition of unencrypted customer information involving at least 500 customers, and you report it to the FTC electronically. Encryption therefore does double duty, protecting data and limiting what counts as reportable.

    Which templates and official resources should you start from?

    You do not need to start from a blank page. IRS Publication 5708 gives tax and accounting firms an outline and sample text, including objectives, a Data Security Coordinator, and risk assessment steps. The IRS also lists related publications on its guidance page.

    Never adopt a template verbatim. Keep a written record of how you tailored it to your systems and people.

    Where do small firms usually go wrong?

    In our experience, small firms skip two things: testing and vendor oversight. Both are inexpensive to fix compared with the cost of a breach, so start there. A tailored plan with documented decisions is far easier to defend during an audit or inquiry than a template with the blanks filled in. And when your team cannot run monitoring and testing in house, handing that work to a managed provider is a practical way to keep the program alive.

    , Dustin Collett

    How can we help you get a compliant WISP in place?

    If you want a faster route to a defensible plan, our IT & Security Assessment can help you get started on a WISP. From there, our managed services can run monitoring and vendor oversight as ongoing work, so the plan stays current instead of gathering dust. Book your assessment, or start with our free IT risk score to see where you stand.

    Collett Systems LLC

    This article is general information, not a substitute for advice from a qualified financial advisor. Consult a qualified financial professional about your own circumstances before acting on anything here.

    FAQ

    What are information security requirements for tax firms?

    Tax and accounting firms must run a written program with a designated coordinator, regular risk assessments, MFA, encryption, and a written incident response plan. The FTC Safeguards Rule sets these baseline expectations.

    What is a WISP for tax preparers?

    It is the written plan that documents how a tax practice protects client data. The IRS points preparers to Publication 5708 as a starting template and urges tailoring it to the firm's size, systems, and data.

    What are the main protection goals of information security?

    The Safeguards Rule's program goals include keeping customer information secure and confidential, protecting against anticipated threats, and preventing unauthorized access that could cause substantial harm. Your written controls should trace back to these aims.

    What is the definition of an information security program?

    It is a documented, maintained set of administrative, technical, and physical safeguards, along with the people and processes that run them. It is built from risk assessment, assigned responsibility, testing, and incident response.

    Sources