IRS Publication 5708, explained: the sample WISP, section by section

What it is

Publication 5708 (Rev. 8-2024) is titled "Creating a Written Information Security Plan for your Tax & Accounting Practice." It was prepared by the Security Summit, "a partnership of the Internal Revenue Service, state tax agencies, private-sector tax groups as well as tax professionals." It is meant "to help tax professionals, particularly smaller practices, develop a Written Information Security Plan or WISP."

It is sample material: the publication says it "is intended to provide sample information." It is also "not intended to replace your own research" or "serve as a substitute for developing your own plan based upon the specific needs and requirements of your business or firm." It also says: "There is no one-size-fits-all WISP." A sole practitioner "can use a more abbreviated and simplified plan than a 10-partner accounting firm."

The legal duty comes from elsewhere. The publication says the Gramm-Leach-Bliley Act and the FTC Safeguards Rule treat tax and accounting professionals as financial institutions, "regardless of size," and that a requirement of the Safeguards Rule is "implementing and maintaining a WISP." The rule itself has one exception: four of its paragraphs do not apply to a firm that keeps customer information on fewer than 5,000 consumers (16 CFR 314.6). The written program itself is still required. For the rule itself, see the FTC Safeguards Rule guide.

How the document is laid out

It has five parts: a short requirements list, a "Getting Started" page, a seven-item outline, a sample template, and added detail for each outline item. Six sample attachments, A through F, come after that.

The requirements list is the publication's own summary of what the FTC requires. It includes designating a qualified individual, assessing risks, designing a safeguards program and regularly monitoring and testing it, selecting service providers whose contracts require safeguards and overseeing them, evaluating and adjusting the program, and multi-factor authentication "unless your qualified individual has approved in writing the use of reasonably equivalent or more secure access controls." It also says to report a security event affecting 500 or more people to the FTC "as soon as possible, but no later than 30 days from the date of discovery."

The template, section by section

The template has seven numbered sections. Text in square brackets is the part you replace.

I. Objective

States why the plan exists and defines PII (personally identifiable information). The blank is your firm name. The definition lists data elements such as Social Security numbers, driver's license numbers, income and tax filing data, and financial account numbers.

II. Purpose and III. Scope

Purpose has three goals: keep PII secure and confidential, protect it against anticipated threats, and protect against unauthorized access that creates a substantial risk of identity theft or fraud. Scope has five protocols, from identifying foreseeable risks to regular monitoring. These two sections arrive written. The added detail explains why scope matters: "you should not be legally held to a standard that was unforeseen at the writing or periodic updating of your WISP."

IV. Identified responsible officials

You fill in two roles. The first is the Data Security Coordinator (DSC), who "will implement, supervise, and maintain the WISP." The listed duties include verifying that employees finish training, evaluating third-party service providers (the template excludes those directly involved in tax preparation and e-filing), reviewing the plan's security measures at least annually or whenever there is a material change in business practices, and running an annual training session. The second is the Public Information Officer (PIO), the firm's spokesperson, including for client communications, law enforcement, and news media.

The requirements list says to designate a "qualified individual." The template uses the title Data Security Coordinator. The added detail says the DSC and the PIO should be different people: "In most firms of two or more practitioners, these should be different individuals." See the qualified individual guide.

V. Inside the firm risk mitigation

Four sample policies: PII collection and retention, personnel accountability, PII disclosure, and reportable events. Your decisions here include where PII is stored, how long records are kept, and who may receive PII. The template lists background checks for new employees with access to PII, and says the firm "may require" non-disclosure agreements for highly sensitive accounts. It also leaves insurance and legal counsel to what the principal ownership deems "prudent and necessary." The review date is another blank.

VI. Outside the firm risk mitigation

Seven sample policies: network protection, user access control, electronic exchange of PII, Wi-Fi access, remote access, connected devices, and information security training. Several contain specific numbers, such as passwords changed "every 365 days, or under specific conditions, such as user requests or when there is evidence of a compromise," event log review "at random intervals not to exceed 90 days," and a top-down security review "at least every 30 days." Those numbers are written into the sample text. Check each one against how your office works before you keep it.

The user access policy cites "Section 314.4(c.5)" on multi-factor authentication. The template's remote access policy reads: "Remote access will only be allowed using multi-factor Authentication (MFA) in addition to username and password authentication." Which MFA method you use is your decision. The template names a text message or an app. See the MFA guide.

VII. Implementation

The effective date, plus signature lines for the owner or principal operating officer and the DSC. The added detail also says to add state regulatory requirements "if additional state regulatory requirements apply."

The attachments

The publication suggests keeping task-level procedures in separate attachments. Its stated reason: "If regulatory records retention standards change, you update the attached procedure, not the entire WISP." The six samples are:

• A: record retention policies
• B: rules of behavior and conduct for safeguarding client PII
• C: security breach procedures and notifications
• D: employee and contractor acknowledgement of understanding
• E: firm hardware inventory containing PII
• F: firm employees authorized to access PII

The hardware inventory asks you to list each item's description and physical location, and the types of information it stores or processes. The added detail includes paper storage such as filing cabinets, and cloud storage.

What is yours to decide

• Names of the DSC and PIO, the firm name, and the dates.
• Your record retention and destruction rules.
• Where PII lives, on which devices, and who may reach it.
• Which sample numbers and named tools you keep or change, as long as the Safeguards Rule's requirements are still met.
• Which state requirements apply to your office, so you can add them.

The publication calls a WISP "an evergreen document that is regularly reviewed, tested, and updated." The template's cover page carries the note "Should review and update at least annually."

If you want a free first draft built from your answers, try the WISP generator. For a plain walk through a small-office plan, see the WISP template guide.

Sources

• IRS Publication 5708 (Rev. 8-2024): irs.gov/pub/irs-pdf/p5708.pdf
• 16 CFR Part 314 (eCFR, 2026-10-01): ecfr.gov, Part 314

This is general information, not legal advice.