Do tax preparers really need a WISP? A plain-English guide.

If you prepare tax returns, federal rules require you to have a written information security plan, usually called a WISP. It doesn't matter if you're a large firm or a one-person office. Here's what that means in plain words.

Why tax preparers need one

The Gramm-Leach-Bliley Act treats tax preparers as financial institutions, regardless of size. The Federal Trade Commission's Safeguards Rule, which carries out that law, requires a written information security program to protect your clients' information.

The IRS reminds preparers about it too. In August 2026 the IRS and its Security Summit partners reminded tax pros that federal law requires them to create and maintain a WISP. And when you apply for or renew your PTIN, Form W-12 asks you to confirm you know you're required to have a data security plan.

What a WISP is

It's a document that explains how your office protects client information: who is in charge, what information you have, what could go wrong, and what you do about it. It doesn't have to be long. The IRS guide, Publication 5708, says a sole practitioner can use a shorter plan than a large firm.

What the FTC rule asks for

• Someone in charge. One person coordinates security. It can be you. The rule calls this person the Qualified Individual.
• A risk assessment. Know what client data you have, where it is, and what could happen to it.
• Safeguards. Limit who can see client data, encrypt it, use multi-factor authentication (a code on top of the password) for anyone who accesses it, and securely get rid of what you no longer need.
• Training so your staff knows the rules and can spot scams.
• Vendors you can trust. Check that companies handling your client data, like your tax software or IT help, can protect it, and require it in your contracts.
• Testing and updates. Check that your safeguards work and update the plan when things change.
• Reporting. If a breach affects 500 or more people, tell the FTC within 30 days.

If your office is small

If you keep information on fewer than 5,000 people, a few parts don't apply: your risk assessment and incident response plan don't have to be written down, and you don't need ongoing monitoring or yearly break-in tests. Everything else does, including the written plan itself.

What goes in the plan

Publication 5708 suggests these parts:

1. The plan's purpose and what it covers
2. Who is responsible, by name
3. Your risk assessment: what information you handle and what could go wrong
4. A list of your computers and devices, and what each one is used for
5. Your safeguards: logins and passwords, updates, Wi-Fi, remote access, and how you collect, keep and dispose of data
6. What to do if something happens, and who you must notify
7. Rules for your team, including training and removing access when someone leaves
8. A signed and dated statement that the plan is in effect

Can you write it yourself?

Yes. Publication 5708 includes a template, and it's free. Where people get stuck is filling it in honestly. A plan that says “we use multi-factor authentication” when you don't isn't protection. It's a liability. Set aside a few hours, go section by section, and fix what you find.

If you'd rather have it done for you, I write WISPs for small tax and accounting offices: $599 for the written plan (offices of up to 3 people), or $1,499 for the full package with a security check-up, staff training and help with cyber insurance forms.

Checklist before tax season

• Name the person in charge of security
• List where client data lives: computers, phones, cloud and paper
• Turn on multi-factor authentication for email and tax software
• Back up client files, and test getting one back
• Train everyone to spot fake emails
• Write it down, sign it, and set a yearly review date

I'm a certified security professional, not a lawyer. This guide is a plain summary, not legal advice. Check the official sources below.