Under the WISP requirements, what must a tax return preparer do?

The short answer

Section 314.2 of the FTC Safeguards Rule (16 CFR Part 314) says "an accountant or other tax preparation service that is in the business of completing income tax returns is a financial institution". The rule says you "shall develop, implement, and maintain a comprehensive information security program" that is "written in one or more readily accessible parts" (section 314.3(a)). Section 314.4 then lists what the program must include, in paragraphs (a) through (j). IRS Publication 5708 calls the written program a WISP, a written information security plan.

This page does not know any course's answer key. The list below is what the rule says.

What section 314.4 requires, paragraph by paragraph

Section 314.4 opens: "In order to develop, implement, and maintain your information security program, you shall:"

• (a) A Qualified Individual. Designate a "qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program." This person may be employed by you, an affiliate, or a service provider. If you use a service provider or affiliate, you keep responsibility for compliance, name a senior member of your own personnel to oversee that person, and require the provider or affiliate to maintain an information security program that protects you under the rule. See who the Qualified Individual is.
• (b) A written risk assessment. Base the program on a risk assessment of reasonably foreseeable internal and external risks to customer information. The assessment "shall be written" and must include criteria for categorizing risks, criteria for assessing confidentiality, integrity and availability, and requirements for how each risk is mitigated or accepted. You must also "periodically perform additional risk assessments." See the risk assessment guide.
• (c) Safeguards for the risks you found. Paragraph (c) has eight parts:
  • (c)(1) Access controls, reviewed periodically, so only authorized users get in and each sees only the customer information they need for their duties.
  • (c)(2) Identify and manage your data, people, devices, systems and facilities according to their importance to the business.
  • (c)(3) Encrypt customer information in transit over external networks and at rest. If you decide encryption is infeasible, you may instead use "effective alternative compensating controls reviewed and approved by your Qualified Individual."
  • (c)(4) Adopt secure development practices for applications you build in-house, and procedures for testing the security of outside applications you use with customer information.
  • (c)(5) Multi-factor authentication for any individual accessing any information system, unless your Qualified Individual has approved in writing "reasonably equivalent or more secure access controls." See the MFA guide.
  • (c)(6) Procedures for secure disposal of customer information "no later than two years after the last date the information is used" for the customer's product or service. The rule lists exceptions, such as information needed for business operations or required to be kept by law or regulation. You must also periodically review your data retention policy.
  • (c)(7) Procedures for change management.
  • (c)(8) Policies, procedures and controls to monitor and log what authorized users do, and to detect unauthorized access to, use of, or tampering with customer information by them.
• (d) Testing and monitoring. Regularly test or monitor the key controls, including those meant to detect attacks and intrusions. For information systems that means continuous monitoring or periodic penetration testing and vulnerability assessments. Absent effective continuous monitoring or other systems that detect, on an ongoing basis, changes that may create vulnerabilities, you must conduct annual penetration testing. You must also run vulnerability assessments "at least every six months; and whenever there are material changes to your operations or business arrangements; and whenever there are circumstances you know or have reason to know may have a material impact on your information security program."
• (e) Staff. Give personnel security awareness training, updated as the risk assessment requires. Use qualified information security personnel, from you, an affiliate or a service provider, sufficient to manage your risks. Give them updates and training, and verify that key ones take steps to keep current on changing threats and countermeasures.
• (f) Service providers. Take reasonable steps to select and retain providers able to maintain appropriate safeguards, require them by contract to do so, and periodically assess them.
• (g) Keep it current. Evaluate and adjust the program in light of testing and monitoring results, material changes to your operations or business arrangements, new risk assessment results, and other circumstances you know or have reason to know may materially affect it. See how often to update a WISP.
• (h) A written incident response plan. It must be designed to promptly respond to and recover from a security event materially affecting customer information, and must address seven areas: goals; internal response processes; roles, responsibilities and decision-making authority; external and internal communications; remediation of weaknesses found; documentation and reporting; and evaluation and revision as necessary after an event.
• (i) A written report to leadership. Require the Qualified Individual to report in writing, "regularly and at least annually," to your board of directors or equivalent. With no board, the report goes to a senior officer responsible for the program. It covers status, compliance and material matters.
• (j) Notify the FTC. If a notification event involves the information of at least 500 consumers, you must notify the FTC "as soon as possible, and no later than 30 days after discovery of the event," electronically on the FTC's form. See the breach notice guide.

Which of these do not apply under 5,000 consumers

Section 314.6 says: "Section 314.4(b)(1), (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers." Those are the risk assessment criteria, the testing detail, the incident response plan, and the report to leadership. The test counts consumers, not staff. Everything else above still applies, including (j) and MFA. The Safeguards Rule guide covers this in detail.

What IRS Pub 5708 adds

Publication 5708 (Rev. 8-2024), "Creating a Written Information Security Plan (WISP) for your Tax & Accounting Practice," was prepared by the Security Summit, a partnership of the IRS, state tax agencies, private-sector tax groups and tax professionals. It says that the law requires a WISP, and that "Your WISP must be written and accessible."

It also gives a sample template and a seven-part outline: objectives, purpose and scope; a qualified individual; risk assessment; hardware inventory; safety measures in place; an implementation clause; and attachments. The outline says: "Be sure you incorporate all the required elements in your plan, but scale the comprehensiveness to your firm's size and type of operation." Pub 5708 says it is "not intended to replace your own research."

Some of what it lists is advice, not rule text. It says "It is a good idea to create" an employee acknowledgment document, and calls an offsite or cloud copy "a recommended best practice." Those are not requirements in section 314.4. For the free draft, use the WISP generator.

Sources

• 16 CFR 314.2, 314.3, 314.4, 314.6 (eCFR, as of 2026-10-01): ecfr.gov, Part 314
• IRS Publication 5708 (Rev. 8-2024): irs.gov/pub/irs-pdf/p5708.pdf

This is general information, not legal advice.