The best WISP template for a tax or accounting firm is the free sample plan in IRS Publication 5708, written by the Security Summit and last revised in August 2024. Fill in its sections with your own qualified individual, risks, hardware, safeguards and attachments, then run the controls it describes. The plan is not optional: the FTC Safeguards Rule requires tax preparers of every size to keep a written information security plan, and the PTIN application and renewal form asks you to acknowledge that requirement.
Small firms are squarely in scope, and attackers know these offices hold Social Security numbers, bank details and full financial histories. In Verizon's 2025 Data Breach Investigations Report, ransomware was part of 88% of breaches at small and midsize businesses, compared with 39% at large organizations. This guide covers where to get the template, the sections to fill in and the questions accounting and tax firm owners ask us most.
Where can you get a WISP template?
Start with IRS Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice. It was prepared by the Security Summit, a partnership of the IRS, state tax agencies, private-sector tax groups and tax professionals, and its August 2024 revision is still the current one as of October 2026. It contains a one-page outline, a sample plan with blanks for your firm's details, added guidance for each section and six sample attachments. Publication 5709 is a one-page summary, and Publication 4557, Safeguarding Taxpayer Data, covers the safeguards themselves. The IRS suggests keeping the finished plan in a format anyone can read, such as PDF or Word, sharing it with staff for training and storing a copy offsite or in the cloud.
WISP template checklist: the sections to fill in
Publication 5708 organizes the plan into seven parts. Work through them in order, replacing every bracketed placeholder with what your firm actually does:
- Objectives, purpose and scope. Which offices, systems, people and client records the plan covers, and the date it was last reviewed. The sample asks for a review at least once a year.
- Qualified individual and authorized users. The person who coordinates the program, then everyone authorized to reach client data and their access level. Sample Attachment F holds the user list.
- Risk assessment. The types of information you handle, where it could be lost inside or outside the firm, and how you monitor and test those risks.
- Hardware inventory. Each computer, server, phone, scanner and storage device that holds client data, where it sits and what it stores. Sample Attachment E is the inventory form.
- Safety measures. Policies for data collection and retention, data disclosure, network protection, user access, electronic data exchange, Wi-Fi, remote access, connected devices and reportable incidents, plus an employee code of conduct. This is where you write down how you meet the Safeguards Rule's specific requirements, such as multifactor authentication and encryption.
- Implementation clause. The date the plan takes effect, your firm's name, a statement that the plan is meant to comply with the Gramm-Leach-Bliley Act and the FTC Safeguards Rule, and any state requirements that also apply.
- Attachments. The sample set covers record retention (A), rules of behavior for client data (B), breach procedures and notifications (C), employee and contractor acknowledgments (D), the hardware inventory (E) and authorized users (F).
Two parts deserve extra care when you fill it in. List every service provider that touches client data, such as your tax software, cloud storage and IT provider, with the contract terms that require them to protect it, because the Safeguards Rule requires that oversight. And check that the notification list in Attachment C matches your state's breach law as well as the federal steps. Our guide to vendor risk management covers the first.
Frequently asked questions
What is a WISP?
A Written Information Security Plan is a documented set of safeguards describing how your firm protects client data: who is responsible, what the risks are, and the specific controls you use to reduce them. It is a living document you maintain and follow, not a one-time form you file and forget about.
Is a WISP actually required, or just recommended?
Required. Under the Gramm-Leach-Bliley Act, firms that prepare tax returns count as financial institutions, and the FTC Safeguards Rule requires them to keep an information security program written in one or more readily accessible parts. The IRS reinforces it: line 11 of Form W-12, the PTIN application and renewal (revised October 2025), asks you to acknowledge that paid tax return preparers are required by law to create and maintain a written information security plan, and points to Publications 5708 and 4557.
Is a WISP the same as a data security plan?
Yes. IRS materials use both names: Publication 4557 tells preparers to create a data security plan, Publication 5709 calls it a written data security plan and Form W-12 calls it a written information security plan. If you maintain a current WISP covering safeguards, responsibilities and incident response, you have the plan all three describe.
Who has to have one?
Any firm that prepares tax returns, whether a solo practitioner or a multi-office practice: CPA firms, enrolled agents and other paid preparers. The Safeguards Rule names an accountant or other tax preparation service that completes income tax returns as a financial institution, and size does not exempt you from the written plan. Firms that only keep books or give advice should confirm with their adviser whether their work brings them under the rule.
What must a WISP include?
The Safeguards Rule's elements, written for your firm: a Qualified Individual who runs the program; a risk assessment; access controls and an inventory of the data, devices and systems that hold client information; encryption of client information in transit and at rest; multifactor authentication; secure disposal; change management; logging of user activity; regular testing or monitoring; staff training; oversight of service providers; regular review of the plan; and an incident response plan. The plan should reflect what your firm actually does, not a generic checklist.
Do small firms get any exemptions?
A few. A firm that holds information on fewer than 5,000 consumers is excused from four provisions: the written risk assessment requirements, continuous monitoring or annual penetration testing with vulnerability scans every six months, the written incident response plan and the Qualified Individual's annual written report (16 CFR 314.6). Everything else still applies, including the written plan, MFA, encryption and vendor oversight, and the IRS sample plan includes a breach procedure anyway.
What happens if we do not have one?
The exposure is real. Publication 4557 warns that failing to create the plan may result in an FTC investigation, and the PTIN form asks every preparer to acknowledge the requirement. Without a plan you also meet a breach with no agreed steps, contacts or records, which is when a small firm can least afford to improvise. And that is before the cost of the breach itself, which for a small firm can be existential.
Is a downloadable template enough?
A template is a starting point, not the finish line. Publication 5708 says its sample is not a substitute for developing your own plan based on your firm's needs, and an unedited document that does not match your systems, staff and vendors will not hold up after an incident. You have to tailor it, implement the controls it describes and keep it current; the IRS calls a WISP an evergreen document, reviewed and updated as the firm changes.
Do we specifically need MFA and encryption?
Yes. The amendments the FTC adopted in 2021 made both explicit: multifactor authentication for any individual accessing any information system, and encryption of customer information both in transit over external networks and at rest (16 CFR 314.4(c)). Your Qualified Individual can approve an equivalent alternative in writing, but for most firms this means MFA on email, tax software, remote access and cloud storage, and encryption on every laptop and on client files whenever they move.
Do we have to notify the FTC after a breach?
Yes, when unencrypted information about at least 500 consumers is acquired without authorization. Since May 2024 the Safeguards Rule has required notice to the FTC as soon as possible and no later than 30 days after discovery, through a form on the FTC's website. Information counts as unencrypted if the key was also exposed, which is one more reason encryption matters. The IRS sample breach procedure also lists the IRS Stakeholder Liaison, your state attorney general and state tax agencies, the FBI's Internet Crime Complaint Center, local law enforcement, your tax software provider, your insurance carrier and legal counsel.
Can our Qualified Individual be someone outside the firm?
Yes. The rule allows the Qualified Individual to work for a service provider, as long as your firm keeps responsibility for compliance, names a senior person to direct and oversee them, and requires the provider to maintain its own security program. A NetSys vCISO can fill the role on that basis; the program remains yours.
How does a managed IT provider help?
A provider can implement and document most of the plan for you: MFA, encryption, access controls, monitoring, backups, an incident response plan, staff training and the vendor records the rule asks for. Just as important, it keeps the plan current as rules and threats change. Our FTC Safeguards Rule compliance service is built for exactly this, and our overview of the controls that actually stop attacks shows where to start. If the worst happens, an incident response plan is what limits the damage.
What is included when NetSys builds and runs a WISP?
The program documents and the controls behind them: a Qualified Individual designated, with a vCISO in the role if you need one; the written plan and risk assessment tailored to your firm; MFA for every user who reaches client information, tax software included; encryption on devices and for client files sent by email; access controls and a data inventory; logging and monitoring; testing on the rule's schedule; service provider reviews; secure disposal; security awareness training with phishing simulations built on tax-season lures; a written incident response plan; tested backups; and evidence organized by rule element for the FTC, insurers and the IRS.
How does onboarding work?
An engagement can begin with our free remote external penetration test, limited to available information and an agreed external scope. Under a separate assessment and implementation scope, we inventory where client information lives and flows, write the risk assessment with your Qualified Individual and implement the controls: MFA and conditional access in Entra ID, device encryption through Intune, email encryption and data loss prevention, endpoint detection with monitoring, logging, backups and secure disposal. Service providers are inventoried and their contracts reviewed, and testing and reporting go on a calendar.
What affects the cost?
How many systems hold client information and how much of the required control set already exists. For a NetSys managed client the technical controls are part of the per-user monthly agreement, so the added cost is the program documents, vendor reviews and Qualified Individual support. We do not publish prices; the scope is agreed before we quote.
Who handles support and escalations?
NetSys engineers. Our help desk is staffed seven days a week from 4 a.m. to 11 p.m. Eastern, and monitoring and emergency service run around the clock, which matters in tax season. The written incident response plan names who decides, who notifies the IRS, the FTC and clients, and where counsel comes in, so an escalation follows a plan instead of a scramble. Legal applicability and notification decisions stay with your adviser.
Building your WISP with NetSys
Book a call with your current plan, or the blank IRS template, and a list of the systems that hold client data, and we will map your firm's controls against the Safeguards Rule and show which gaps to close first.
For the ongoing IT and security work behind a WISP, see our IT support for accounting firms.
By Joel Baum for The NetSys Group, which has delivered managed IT, cybersecurity, and cloud services since 1998. Our engineers hold degrees in electrical and computer engineering and are certified Microsoft and Cisco instructors, working on site across New York City, Long Island, Westchester, the Hudson Valley, North Jersey and Fairfield County, Connecticut, and remote-first everywhere else.
Sources and further reading
- IRS Publication 5708 (Rev. 8-2024), Creating a Written Information Security Plan for your Tax & Accounting Practice, with the sample template and attachments.
- IRS Publication 5709, How to Create a Written Information Security Plan for Data Safety.
- IRS Publication 4557 (Rev. 6-2024), Safeguarding Taxpayer Data.
- IRS Form W-12 (Rev. October 2025), line 11, Data Security Responsibilities.
- FTC: Safeguards Rule, what your business needs to know.
- eCFR: 16 CFR Part 314, the Safeguards Rule, including the elements in 314.4 and the small-firm exceptions in 314.6.
- Verizon 2025 Data Breach Investigations Report.
Discuss cyber security for your business.
Tell us about your current systems, the result you need and your timeline. We will discuss the work, responsibilities and pricing before you decide on an engagement.