WISP checklist for tax preparers, from the rule text

What this list covers

This checklist follows 16 CFR 314.4, the elements list of the FTC Safeguards Rule. Section 314.2 treats "an accountant or other tax preparation service that is in the business of completing income tax returns" as a financial institution. Section 314.4 opens: "In order to develop, implement, and maintain your information security program, you shall:" and then lists paragraphs (a) through (j). That is ten items, one box each. The wording below stays close to the rule. For the detail behind each item, read what the WISP requirements say a preparer must do.

The ten elements of 16 CFR 314.4

• (a) Qualified Individual. Designate a qualified individual responsible for overseeing, implementing and enforcing your information security program. The Qualified Individual "may be employed by you, an affiliate, or a service provider." If a service provider or affiliate fills the role, you shall retain responsibility for compliance, designate a senior member of your personnel to direct and oversee the Qualified Individual, and require the provider or affiliate to maintain an information security program that protects you in accordance with the requirements of this part.
• (b) Risk assessment. Base your program on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality and integrity of customer information, and assesses the sufficiency of the safeguards in place. The risk assessment "shall be written" and shall include criteria for evaluating and categorizing risks, criteria for assessing confidentiality, integrity and availability, and requirements for how identified risks will be mitigated or accepted. You shall also periodically perform additional risk assessments. (314.6: (b)(1) does not apply to institutions that maintain customer information concerning fewer than five thousand consumers)
• (c) Safeguards. Design and implement safeguards to control the risks you identify, including by:
  • (1) implementing and periodically reviewing access controls;
  • (2) identifying and managing your data, personnel, devices, systems and facilities;
  • (3) protecting customer information by encryption in transit over external networks and at rest, or, if you determine encryption is infeasible, using "effective alternative compensating controls reviewed and approved by your Qualified Individual";
  • (4) adopting secure development practices for in-house developed applications you use to transmit, access or store customer information, and procedures for evaluating, assessing or testing the security of externally developed ones;
  • (5) implementing multi-factor authentication for any individual accessing any information system, "unless your Qualified Individual has approved in writing the use of reasonably equivalent or more secure access controls";
  • (6) procedures for secure disposal of customer information "no later than two years after the last date the information is used in connection with the provision of a product or service to the customer to which it relates," unless one of the rule's exceptions applies, and periodic review of your data retention policy;
  • (7) change management procedures; and
  • (8) policies, procedures and controls to monitor and log the activity of authorized users and detect unauthorized access.
• (d) Testing and monitoring. Regularly test or otherwise monitor the effectiveness of your key controls, systems and procedures. For information systems, this "shall include continuous monitoring or periodic penetration testing and vulnerability assessments." Absent effective continuous monitoring "or other systems to detect, on an ongoing basis, changes in information systems that may create vulnerabilities," you shall conduct annual penetration testing, and vulnerability assessments "at least every six months; and whenever there are material changes to your operations or business arrangements; and whenever there are circumstances you know or have reason to know may have a material impact on your information security program." (314.6: (d)(2) does not apply to institutions that maintain customer information concerning fewer than five thousand consumers)
• (e) People. Implement policies and procedures so personnel can enact the program: security awareness training updated as necessary, qualified information security personnel, who may be employed by you, an affiliate or a service provider, security updates and training for those personnel, and verifying that key information security personnel take steps to maintain current knowledge of changing threats and countermeasures.
• (f) Service providers. Take reasonable steps to select and retain service providers capable of maintaining appropriate safeguards, require them by contract to implement and maintain those safeguards, and periodically assess them.
• (g) Evaluate and adjust. Evaluate and adjust your program in light of testing and monitoring results, material changes to operations or business arrangements, risk assessment results, or any other circumstances that you know or have reason to know may have a material impact on your program.
• (h) Incident response plan. Establish a written incident response plan designed to promptly respond to, and recover from, any security event materially affecting customer information. It shall address seven areas, from goals and internal processes through roles, communications, remediation, documentation, and revision after an event. (314.6: does not apply to institutions that maintain customer information concerning fewer than five thousand consumers)
• (i) Report to leadership. Require your Qualified Individual to report in writing, "regularly and at least annually," to your board of directors or equivalent. If none exists, the report shall be timely presented to a senior officer responsible for the program. It covers the program's overall status and compliance, and material matters. (314.6: does not apply to institutions that maintain customer information concerning fewer than five thousand consumers)
• (j) Notify the FTC. For a notification event involving the information of at least 500 consumers, you must notify the FTC "as soon as possible, and no later than 30 days after discovery of the event," electronically on the FTC's form. See the breach notice guide.

The small-institution note in 314.6

Section 314.6 reads, in full:

"Section 314.4(b)(1), (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers."

It names four parts: (b)(1), (d)(2), (h) and (i). It counts consumers, not staff or offices. The rest of 314.4, including (b)(2) and (d)(1), is not named in it. See the Safeguards Rule guide.

What IRS Publication 5708 suggests a plan include

This is a recommendation, not law. Publication 5708 (Rev. 8-2024) says it is "not an exhaustive discussion of everything related to WISPs." Its outline of "the bare essentials" lists:

• Define the WISP objectives, purpose, and scope
• Designate a qualified individual, and list authorized users, their data access levels, and responsibilities
• Assess risks
• Inventory hardware
• Document safety measures in place, with "suggested policies" on data collection and retention, data disclosure, network protection, user access, electronic data exchange, Wi-Fi access, remote access, connected devices, and reportable incidents, plus a draft employee code of conduct
• Draft an implementation clause
• Attachments

The publication also says a WISP is "intended to be an evergreen document that is regularly reviewed, tested, and updated along with changes to the size, scope, and complexity of your business." See how often to update a WISP.

The free WISP generator makes a draft you can adapt.

Sources

• 16 CFR 314.2, 314.4, 314.6 (text as of 2026-10-01): ecfr.gov, Part 314, current version
• IRS Publication 5708 (Rev. 8-2024): irs.gov/pub/irs-pdf/p5708.pdf

This is general information, not legal advice.