A WISP template for a small tax office, and what it covers

Leer en español

The IRS publishes a free WISP template for tax offices. It is Publication 5708, "Creating a Written Information Security Plan for your Tax & Accounting Practice" (Rev. 8-2024). This page lists what it covers.

Who wrote it and who it is for

The Security Summit prepared it. That is a partnership of the IRS, state tax agencies, private-sector tax groups and tax professionals. The publication says it is meant to help tax professionals, particularly smaller practices. It also says it is not exhaustive and does not replace your own research.

It states that there is no one-size-fits-all WISP. A sole practitioner can use a more abbreviated plan than a 10-partner accounting firm.

The seven parts of the outline

1. Define the objectives, purpose and scope.
2. Designate a qualified individual, and list authorized users with their access levels and responsibilities.
3. Assess risks: the types of information you handle, the ways it could be lost, and how you will monitor and test those risks.
4. Inventory hardware, with the location of each item and the information it stores or processes.
5. Document the safety measures in place.
6. Draft an implementation clause.
7. Add attachments.

Policies the outline suggests

For part five, the publication suggests policies on data collection and retention, data disclosure, network protection, user access, electronic data exchange, Wi-Fi access, remote access, connected devices and reportable incidents. It also suggests an employee code of conduct.

The sample attachments

Publication 5708 includes six: A, record retention policies. B, rules of behavior and conduct for safeguarding client PII. C, security breach procedures and notifications. D, employee or contractor acknowledgement of understanding. E, firm hardware inventory containing PII data. F, firm employees authorized to access PII.

Finishing and keeping it current

The implementation clause should be signed by the principal operating officer or owner and the Data Security Coordinator, and dated. Keep the finished plan in a format others can read, such as PDF or Word. The publication recommends storing a copy offsite or in the cloud. It also recommends signed and dated acknowledgments from staff, updated at annual training.

The publication calls a WISP an evergreen document that is regularly reviewed, tested and updated. The title page of its sample says to review and update at least annually.

It also says a WISP is just one part of what tax professionals need to protect their clients and themselves.

To see how the rule behind the template reads, try the Safeguards Rule guide. For the renewal form, see W-12 line 11.

Sources

• IRS Publication 5708 (Rev. 8-2024): irs.gov/pub/irs-pdf/p5708.pdf

This is general information, not legal advice.