Do Tax Preparers Need a WISP? Here’s Where to Start

If your tax practice has two people, one laptop and a stack of client returns, you still need a Written Information Security Plan, commonly called a WISP. The requirement isn’t reserved for large firms.

And no, downloading a template and saving it on your desktop isn’t the same as having a plan.

What is a WISP, really?

A WISP is a written explanation of how your firm protects taxpayer information. It should identify the systems that hold client data, who can access them, the safeguards you use and what happens when something goes wrong.

Think about your tax software, client portal, email, cloud storage, employee devices and paper files. If any of those touch taxpayer information, they belong in the conversation.

At a minimum, a useful plan should address who is responsible for security, how you assess risk, access controls, encryption, multi-factor authentication, employee training, vendors, data disposal and incident response.

Start by writing down where information moves. A prospective client fills out an organizer. Documents arrive through a portal. Staff work in tax software. Final PDFs are stored somewhere. Messages go through email or text. Each handoff is a place to think about access and security.

A WISP should describe your actual process, including who approves new staff accounts, how you verify a client before resetting a login and who handles backups. If the plan says you use an encrypted portal but staff regularly ask clients to email sensitive documents, the document and the practice do not match.

Small firm doesn’t mean no rules

The FTC Safeguards Rule includes limited exceptions to certain requirements for businesses holding information about fewer than 5,000 consumers. But those exceptions do not eliminate the need for a written security program. They also don’t remove fundamental safeguards such as access controls and appropriate training.

Count the people whose information you retain—not just the returns you prepared this season—before assuming an exception applies.

The smaller-firm exception is also easy to misunderstand. Fewer than 5,000 consumers doesn’t automatically mean fewer than 5,000 annual tax returns. Think about prior-year records, spouses and dependents whose information is retained. Some Safeguards Rule requirements are scaled back for smaller firms, but access limits, encryption, staff training and vendor oversight remain serious responsibilities.

Three places to look for trouble first

Shared logins. If everyone signs into your tax software using one account, you can’t easily tell who accessed or changed a client’s file. Give each team member their own access.

Email attachments. Sending W-2s and IDs back and forth through ordinary email creates avoidable exposure. Give clients a secure way to upload documents and teach your staff to use it consistently.

Former staff access. A seasonal preparer should not still have portal, software or cloud access in July. Offboarding is a security task, not just an HR task.

There are two more areas worth checking during your first WISP review. Vendors: know who provides your portal, tax software, cloud backup and IT support, and what protections they offer. Data disposal: record why you retain client information and how you securely destroy it when the retention period ends. Tax preparers have record-retention obligations, so “delete everything after two years” is not a safe blanket policy.

Make the plan usable. A short annual review with dated notes about changes to your systems is better than a beautiful document that hasn’t been touched since the year you bought it.

What if client data is exposed?

Have a response plan before you need it. IRS reporting requirements can apply quickly to e-file providers. Separately, the FTC’s breach notification rule generally requires notification no later than 30 days after discovery of a qualifying event involving the information of at least 500 consumers. State obligations may also apply.

This is not the morning to discover that no one knows who your IT contact is.

For an incident, your team needs a one-page contact list and a first-response sequence: secure affected accounts, preserve what you can about the event, contact your security lead and get qualified help determining the reporting obligations. Don’t assume every suspicious email is the same as a confirmed data breach, and don’t delay reporting once the requirements are triggered.

You can start with IRS Publication 5708 as a reference, but customize it. A solo preparer and a firm with remote seasonal staff won’t have identical workflows. Your WISP should show the difference.

Need a starting point? Get Tax Pros 360’s free WISP & Security Resources. The customizable template includes sections for your firm’s data inventory, security responsibilities, safeguards and review process. Fill it out for your actual practice—and remember, downloading a template is not the same as implementing a compliant security program.

Official source: IRS — Written Information Security Plans are essential.

For general education for tax professionals; reviewed October 23, 2026. Confirm current forms and guidance before relying on tax-law details.