How to Write a WISP for Your Tax Practice: A Step-by-Step Guide Based on IRS Publication 5708
Every PTIN expires on December 31, so most tax preparers renew for 2027 in the coming weeks. The current Form W-12, the PTIN application and renewal form (Rev. October 2026), includes a data security line (line 11) where you must check Yes or No: you confirm you are aware that paid tax return preparers are required by law to create and maintain a written information security plan, or WISP, that protects all taxpayer information.
The IRS and its Security Summit partners repeated the message twice this year, in August and September 2026. A plan that is downloaded, signed and filed away does little, though. This guide shows how to write a WISP that actually fits a small tax office, step by step, following the IRS’s own template in Publication 5708.
Who needs a WISP
Under the Gramm-Leach-Bliley Act, tax and accounting professionals are treated as financial institutions, and the FTC Safeguards Rule requires financial institutions to have a written information security program. The IRS states that this applies regardless of the size of the practice. A solo preparer working from home needs a plan too; it can simply be shorter.
The FTC requires, among other things, that you:
- Name a person who coordinates the program (the “Qualified Individual”).
- Identify and assess the risks to client information and whether your safeguards control them.
- Put safeguards in place, then monitor and test them regularly.
- Choose service providers that can protect the data and require it in your contracts.
- Report certain security events affecting 500 or more people to the FTC, generally within 30 days of discovery.
The testing part has its own rules, which we cover in our guide to the FTC Safeguards Rule for tax preparers. This article focuses on writing the plan itself.
Writing your WISP in seven steps
IRS Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice, contains a template built for smaller firms. Its outline has seven parts. Here is what each one means in practice.
1. Define the objectives, purpose and scope
State in a few sentences why the plan exists (to protect client personal information), what it covers (all client data, on paper and electronically, in the office, at home and in the cloud) and who must follow it (everyone in the practice, including seasonal staff and contractors).
2. Name the Qualified Individual and list who has access
Write down who coordinates security. In a small office that is usually the owner. Then list every person and service that can access client data and what they can see: staff, the bookkeeper, your IT provider, your tax software vendor. If someone does not need access, remove it.
3. Assess the risks
List what you hold (Social Security numbers, bank details, prior returns, identity documents) and how it could be lost: phishing, a stolen laptop, a weak email password, an exposed client portal, a careless shared folder. Rank each risk by how likely and how damaging it is. This list drives everything else in the plan.
4. Inventory your hardware
For each computer, laptop, phone, external drive, printer or server, record what it is, where it is and what client information it stores or processes. Do not forget personal devices used for work.
5. Document the safety measures in place
Publication 5708 suggests short written policies on data collection and retention, data disclosure, network protection, user access, remote access, connected devices, reportable incidents and an employee code of conduct. Describe what you actually do, not what you wish you did.
The IRS’s Security Six are a good minimum to describe here:
| Security Six | What it looks like in a small office |
|---|---|
| Antivirus software | Active on every computer, updating automatically |
| Firewalls | Enabled on each computer and on the office router or firewall, with the admin page not reachable from the internet |
| Multi-factor authentication | On tax software, email, cloud storage, client portal and remote access |
| Backup software or services | Automatic, encrypted, stored separately, and tested by restoring a file |
| Drive encryption | Full-disk encryption on laptops and external drives |
| Virtual private network (VPN) | For working remotely or on public Wi-Fi |
6. Draft the implementation clause
A short statement, signed and dated, that the plan is in effect and who is responsible for it. Note when it will be reviewed next.
7. Add the attachments
The template includes attachments you can fill in: record retention policy, rules of behavior for handling client information, security breach procedures and notifications, an acknowledgment signed by each employee or contractor, the hardware inventory and the list of people authorized to access client data.
“A WISP that nobody has read since it was signed protects you about as well as a lock that was never fitted.”
NyorsoftExternal Security Review
The part most plans forget: what faces the internet
Most WISP templates focus on the office: computers, paper files and staff. But criminals usually start from the outside. Your risk assessment and inventory should also cover:
- Your email domain. Without SPF, DKIM and DMARC, anyone can send email that looks like it came from your practice, which is how fake “send your documents here” and payment-diversion emails reach your clients. See our guide to email spoofing and DMARC.
- Your website and client portal. Outdated software, exposed files or a portal without multi-factor authentication are direct routes to client data.
- Remote access. VPNs and firewalls exposed to the internet were the entry point in several attacks this year, including the k0t campaign.
You can see part of this yourself in seconds with our free website security check.
If client data is stolen
Your breach procedures (attachment C) should tell you exactly what to do. The IRS asks tax professionals to:
- Report the theft to their local IRS Stakeholder Liaison, so the IRS can watch for and block fraudulent returns.
- Report it to the state tax agencies concerned, through the Federation of Tax Administrators’ data breach page.
- Notify affected clients and recommend protective steps, such as an Identity Protection PIN.
Under the Safeguards Rule, a security event involving the information of 500 or more consumers must also be reported to the FTC, generally within 30 days. Check your state’s breach notification law too.
Keep it alive
- Review the plan at least once a year. PTIN renewal season is a natural reminder.
- Update it whenever something changes: new staff, new software, a move, a new client portal.
- Have every new employee or seasonal worker read it and sign the acknowledgment before tax season.
- Record what you tested and what you fixed. That record is what shows the plan is real.
Frequently asked questions
Do I need a WISP to renew my PTIN?
Line 11 of Form W-12 asks you to confirm, by checking Yes or No, that you are aware paid tax return preparers are required by law to create and maintain a written information security plan. The requirement itself comes from the FTC Safeguards Rule, so you need a plan whether or not you are renewing a PTIN.
Does a solo tax preparer need a WISP?
Yes. The IRS states that tax and accounting professionals are considered financial institutions regardless of size. A one-person practice can have a short plan, but it must be written, followed and kept up to date.
Is there an official WISP template?
Yes. IRS Publication 5708 includes a sample template for tax and accounting practices, with sections for scope, responsible people, risk assessment, hardware inventory, safety measures, an implementation clause and attachments.
What are the IRS Security Six?
Antivirus software, firewalls, multi-factor authentication, backup software or services, drive encryption and virtual private networks. The IRS recommends them as baseline protections for every tax practice.
How often should a WISP be updated?
At least once a year and whenever your practice changes, for example new staff, software, systems or office location, or when testing and monitoring reveal new risks.
Sources
- IRS (IR-2026-92): Tax pros need a Written Information Security Plan to protect client data
- IRS (IR-2026-111): Security Summit closes summer series with data security reminder
- IRS Publication 5708: Creating a Written Information Security Plan for your Tax & Accounting Practice
- IRS Publication 4557: Safeguarding Taxpayer Data
- IRS Form W-12: PTIN Application and Renewal
- eCFR: 16 CFR Part 314, Standards for Safeguarding Customer Information
This article is general information, not legal advice, and reflects IRS and FTC guidance as of November 1, 2026.
Not sure what your website exposes?
Our Public Website Security Check looks at your site the way an attacker does — TLS, security headers, email authentication and exposed services — and gives you a short, ranked list of what to fix.
Pavol brings IT analysis experience from banking and financial-sector projects to Nyorsoft’s external security reviews for small businesses. About our team