Does a one-person tax office need a WISP?

Leer en español

The sources we read say yes. A WISP is a written information security plan. This page shows where that comes from, what 16 CFR 314.6 lifts for a small office, and what still applies.

What the sources say

• Section 314.1(b) of the FTC Safeguards Rule lists "tax preparation firms" among the businesses it covers. Section 314.2 gives "an accountant or other tax preparation service that is in the business of completing income tax returns" as an example of a financial institution.
• IRS Publication 5708 says tax and accounting professionals are financial institutions "regardless of size". Publication 5709 says federal law, enforced by the FTC, requires professional tax preparers to create and maintain a written data security plan.
• Line 11 of Form W-12, the PTIN form, asks you to check Yes or No on this statement: "I am aware that paid tax return preparers are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information." The form is signed under penalties of perjury. See the W-12 line 11 guide.

A small plan can be short

The rule asks for safeguards that fit your size and complexity, the nature of your activities and the sensitivity of the information. Publication 5708 says there is no one-size-fits-all WISP. A sole practitioner can use a more abbreviated and simplified plan than a 10-partner firm. The program must still be written in one or more readily accessible parts and include the elements in section 314.4.

What section 314.6 lifts

If you keep customer information on fewer than five thousand consumers, four parts of 314.4 do not apply to you:

• the requirements in (b)(1) that the risk assessment be written and include set criteria;
• the continuous monitoring or penetration testing and vulnerability assessment requirements in (d)(2);
• the written incident response plan in (h); and
• the written report to a board or senior officer in (i).

What still applies

The rest of 314.4 stays. Among other things:

• Designate a Qualified Individual to oversee the program.
• Base the program on a risk assessment and repeat it periodically. Section 314.6 lifts only (b)(1), the requirement that it be written and include set criteria.
• Limit users' access to the customer information they need for their duties.
• Encrypt customer information in transit over external networks and at rest. If you determine encryption is infeasible, you may use alternative controls only if your Qualified Individual reviews and approves them.
• Use multi-factor authentication for anyone accessing an information system, unless your Qualified Individual approves in writing a reasonably equivalent or more secure control.
• Dispose of customer information securely, generally no later than two years after it was last used for the customer. The rule lists exceptions.
• Monitor and log what authorized users do, and regularly test or otherwise monitor your key controls.
• Train your people and oversee your service providers, including by contract.
• Tell the FTC as soon as possible, and no later than 30 days after discovery, if a notification event involves 500 or more consumers.

Under 5,000 consumers means a shorter list. The rest of the rule still applies. For the full rule, read the Safeguards Rule guide. For breach steps, read the data theft guide.

Sources

• 16 CFR 314.2, 314.3, 314.4, 314.5, 314.6 (eCFR, 2026-10-01): ecfr.gov, Part 314
• IRS Publication 5708 (Rev. 8-2024): irs.gov/pub/irs-pdf/p5708.pdf
• IRS Publication 5709 (Rev. 5-2024): irs.gov/pub/irs-pdf/p5709.pdf
• Form W-12 (Rev. 10-2025): irs.gov/pub/irs-pdf/fw12.pdf

This is general information, not legal advice.