How often should a tax office update its WISP?

Leer en español

Two texts answer this. IRS Publication 5708 gives a yearly review in its sample plan. The FTC Safeguards Rule, 16 CFR Part 314, gives triggers and a few set intervals.

What Publication 5708 says

The publication calls a WISP an evergreen document that is regularly reviewed, tested and updated along with changes to the size, scope and complexity of your business. The title page of its sample says "Should review and update at least annually."

The sample text goes further. It suggests reviewing the scope of the security measures at least annually, or whenever a material change in business practices affects the security or integrity of records containing personal information. It suggests reviewing all security measures annually beginning on a calendar date you choose, and amending the plan at any time it is warranted. The sample says employees are informed in writing when it is amended.

The publication also suggests updating Attachment C, the breach procedures, annually. It recommends that staff acknowledgments be updated at annual training intervals and kept on file. These are sample suggestions.

What the rule says

Section 314.4(g) says to evaluate and adjust your program in light of:

• the results of the testing and monitoring you do;
• any material changes to your operations or business arrangements;
• the results of risk assessments; and
• any other circumstances you know or have reason to know may have a material impact on the program.

That list is triggers. The paragraph gives no calendar interval.

Duties with a timing word, for every office

• Perform additional risk assessments periodically (314.4(b)(2)).
• Review access controls periodically (314.4(c)(1)).
• Review your data retention policy periodically (314.4(c)(6)(ii)).
• Assess your service providers periodically, based on the risk they present (314.4(f)(3)).
• Update security awareness training as necessary to reflect the risks you found (314.4(e)(1)).
• Regularly test or otherwise monitor your key controls (314.4(d)(1)).

Fixed intervals, for offices with 5,000 or more consumers

Section 314.6 lifts these for offices that hold information on fewer than five thousand consumers. Offices with 5,000 or more consumers must do them.

• Unless you have effective continuous monitoring or other systems that detect changes on an ongoing basis, run penetration testing every year and vulnerability assessments at least every six months. Also run one when operations or business arrangements change materially, or when you know or have reason to know of circumstances that may have a material impact on your program (314.4(d)(2)).
• Have your Qualified Individual report in writing to your board, or a senior officer if there is no board, regularly and at least annually (314.4(i)).

Smaller offices still follow the first list, including regular testing or monitoring in general, and the FTC notice for 500 or more consumers, due as soon as possible and no later than 30 days after discovery, still applies. See the one-person office guide and the data theft guide.

Sources

• 16 CFR 314.2, 314.3, 314.4, 314.5, 314.6 (eCFR, 2026-10-01): ecfr.gov, Part 314
• IRS Publication 5708 (Rev. 8-2024): irs.gov/pub/irs-pdf/p5708.pdf

This is general information, not legal advice.