Does a CPA firm need a WISP?

The short answer

If the firm is in the business of completing income tax returns, yes. The FTC Safeguards Rule, 16 CFR Part 314, lists that kind of firm as a financial institution, and the rule tells a financial institution to have a written information security program. The rule's example is about firms "in the business of completing income tax returns." This page covers only that case.

What section 314.2 says

Section 314.2 gives examples of financial institutions. One of them reads:

"An accountant or other tax preparation service that is in the business of completing income tax returns is a financial institution because tax preparation services is a financial activity listed in 12 CFR 225.28(b)(6)(vi) and referenced in section 4(k)(4)(G) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(G)."

Section 314.1(b) also lists "tax preparation firms" among the entities subject to the FTC's enforcement authority.

What follows from being a financial institution

Section 314.1(b) says Part 314 "applies to the handling of customer information by all financial institutions over which the Federal Trade Commission (“FTC” or “Commission”) has jurisdiction." Section 314.3(a) then says:

"You shall develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical, and physical safeguards that are appropriate to your size and complexity, the nature and scope of your activities, and the sensitivity of any customer information at issue."

Section 314.4 lists what the program contains. It opens: "In order to develop, implement, and maintain your information security program, you shall:". The elements run from (a) to (j). The musts guide goes through them.

The small-institution note

Section 314.6 is short:

"Section 314.4(b)(1), (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers."

It names four paragraphs. It counts consumers, not staff, and it does not remove the rest of section 314.4. See the Safeguards Rule guide for what those four paragraphs cover.

Form W-12, line 11

Every PTIN application and renewal on Form W-12 (Rev. 10-2026) carries line 11, "Data Security Responsibilities":

"I am aware that paid tax return preparers are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information."

The form says "You must check a box." It then says: "See IRS Publication 5708 and 4557 for more information about your responsibilities." Line 12 of the same form lists "Certified Public Accountant (CPA)" as a professional credential, so a CPA who applies or renews on this form answers line 11 and can check the CPA credential on line 12. The IRS PTIN FAQ says attorneys and CPAs "do not need to obtain a PTIN unless they prepare for compensation all or substantially all of a federal tax return or claim for refund." A CPA who needs a PTIN under that test meets line 11 when applying or renewing on Form W-12. More in the line 11 guide.

What the IRS publications say

These are IRS publications, not the rule.

• Publication 5708 (Rev. 8-2024), titled "Creating a Written Information Security Plan (WISP) for your Tax & Accounting Practice," says: "Under the GLBA and Safeguards Rule, tax and accounting professionals are considered financial institutions, regardless of size."
• Publication 4557 (Rev. 6-2024) says: "Data security is now a necessity for every tax professional, whether a partner in a large firm or a sole practitioner, and every Authorized IRS e-File Provider."
• Publication 4557 also says: "According to the FTC Safeguards Rule, tax return preparers must create and enact security plans to protect client data."

Publication 5708 describes itself as sample information. It says it is "not intended to replace your own research" or "to create reliance."

Next step

Read what a WISP is, then make a draft with the free WISP generator.

Sources

• 16 CFR 314.1, 314.2, 314.3, 314.4, 314.6 (eCFR, 2026-10-01): ecfr.gov, Part 314
• IRS Form W-12 (Rev. 10-2026): irs.gov/pub/irs-pdf/fw12.pdf
• IRS PTIN FAQ, "Do I need a PTIN?": irs.gov, FAQ: Do I need a PTIN
• IRS Publication 4557 (Rev. 6-2024): irs.gov/pub/irs-pdf/p4557.pdf
• IRS Publication 5708 (Rev. 8-2024): irs.gov/pub/irs-pdf/p5708.pdf

This is general information, not legal advice.