What is a WISP? A plain answer for tax preparers

The short answer

WISP stands for written information security plan. It is a written plan for the data and system security protections that cover your clients' information. The IRS uses the term WISP. The FTC rule behind it says you must keep an information security program that is "written in one or more readily accessible parts."

Who has to have one

If you prepare returns for pay, you do. The FTC Safeguards Rule, 16 CFR Part 314, implements the Gramm-Leach-Bliley Act. Section 314.2 says "an accountant or other tax preparation service that is in the business of completing income tax returns is a financial institution." Section 314.3(a) then says "You shall develop, implement, and maintain a comprehensive information security program" and lists what it must contain.

The IRS says the same thing in two publications. Publication 4557: "According to the FTC Safeguards Rule, tax return preparers must create and enact security plans to protect client data." Publication 5708: "tax and accounting professionals are considered financial institutions, regardless of size."

The IRS also asks you about it. Form W-12 (Rev. 10-2026), line 11, has you check Yes or No to this statement: "I am aware that paid tax return preparers are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information." See the W-12 line 11 guide.

Publication 4557 adds: "Failure to do so may result in an FTC investigation."

What goes in it, at a glance

Section 314.4 lists what the program must contain. In one line each:

• A Qualified Individual who oversees, implements, and enforces the program.
• A written risk assessment.
• Safeguards for the risks you found, including access controls, encryption, and multi-factor authentication.
• Regular testing or monitoring of those controls.
• Staff training.
• Oversight of service providers.
• Updates when your business or risks change.
• A written incident response plan.
• A written report from the Qualified Individual, at least once a year, to your board or, if you have none, a senior officer.
• Notice to the FTC of a notification event involving at least 500 consumers.

Section 314.6 says four paragraphs do not apply to offices that maintain customer information concerning fewer than 5,000 consumers: the written risk assessment (314.4(b)(1)), continuous monitoring or penetration testing and vulnerability assessments (314.4(d)(2)), the written incident response plan (314.4(h)), and the Qualified Individual's written report (314.4(i)). The rest still apply. The full list, paragraph by paragraph, is in the musts guide.

Publication 5708 organizes a plan differently. Its outline has seven parts: objectives, purpose and scope; a qualified individual; risk assessment; hardware inventory; safety measures in place; an implementation clause; and attachments.

How long is it

There is no set length. Publication 5708: "There is no one-size-fits-all WISP. For example, a sole practitioner can use a more abbreviated and simplified plan than a 10-partner accounting firm." The rule says the same about scale: the safeguards must be "appropriate to your size and complexity, the nature and scope of your activities, and the sensitivity of any customer information at issue."

A shorter plan still has to cover the elements that apply to you. Publication 5708 says: "Be sure you incorporate all the required elements in your plan, but scale the comprehensiveness to your firm's size and type of operation."

Where to get one

• Publication 5708 contains a sample template meant to help smaller practices write their own plan. The Pub 5708 guide goes through it section by section.
• The free WISP generator on this site makes a draft from your answers.
• Publication 5708 says its sample is not meant to "serve as a substitute for developing your own plan based upon the specific needs and requirements of your business or firm." It also says a WISP "is intended to be an evergreen document that is regularly reviewed, tested, and updated along with changes to the size, scope, and complexity of your business."

Sources

• 16 CFR 314.2, 314.3, 314.4, 314.6 (eCFR, 2026-10-01): ecfr.gov, Part 314
• IRS Publication 4557 (Rev. 6-2024): irs.gov/pub/irs-pdf/p4557.pdf
• IRS Publication 5708 (Rev. 8-2024): irs.gov/pub/irs-pdf/p5708.pdf
• IRS Form W-12 (Rev. 10-2026): irs.gov/pub/irs-pdf/fw12.pdf

This is general information, not legal advice.