Why Every Accounting Firm Needs a WISP — and the Right Template to Build One
Accountants hold some of the most sensitive personal financial data in existence: Social Security numbers, bank account details, W-2s, and years of tax history for thousands of clients. That data is a primary target for cybercriminals, and the IRS has made one thing clear — your firm must have a formal, written plan to protect it.
A Written Information Security Plan (WISP) is a documented security policy that describes how your firm collects, stores, and safeguards client data. Under IRS Publication 4557, Safeguarding Taxpayer Data, and the Federal Trade Commission (FTC) Safeguards Rule (16 CFR Part 314), virtually every tax preparer — sole proprietors included — is required to maintain one. The IRS began actively promoting enforcement after the Security Summit released its own model WISP template in 2022.
The challenge for most accounting firms is not intent — it is execution. The best WISP templates for accountants go far beyond generic fill-in-the-blank documents. They align with the IRS's specific requirements, incorporate current threat scenarios, and are built to be maintained year after year without becoming shelfware. This guide will help you evaluate your options, understand what separates a compliant template from an inadequate one, and implement a WISP that actually protects your practice.
Tax Firm Cybersecurity: By the Numbers
IBM Cost of a Data Breach Report 2024
Verizon Data Breach Investigations Report 2024
IBM Cost of a Data Breach Report 2024
The IRS WISP Requirement: What Accountants Are Actually Obligated to Do
The legal foundation for WISP requirements rests on two pillars. The first is IRS Publication 4557, which outlines baseline security expectations for all tax preparers. The second is the FTC Safeguards Rule, significantly expanded in 2023, which now applies to tax preparation firms as "financial institutions" under the Gramm-Leach-Bliley Act (GLBA).
Under these combined requirements, your WISP must address the following at minimum:
- An employee designated as your firm's Information Security Coordinator
- An inventory of all systems and storage locations holding taxpayer data
- Risk assessments identifying internal and external threats to that data
- Specific technical, physical, and administrative safeguards to address identified risks
- Vendor and contractor oversight policies covering anyone with access to client data
- An incident response and breach notification procedure with IRS-specific steps
- Annual review and update of the WISP to reflect operational changes
The FTC Safeguards Rule further requires firms with 5,000 or more customer records to implement specific technical controls, including Multi-Factor Authentication (MFA), encryption, and access control logging. Even firms below that threshold face civil penalties for failing to maintain basic safeguards. For a thorough breakdown of the full IRS framework, see our IRS Publication 4557 guide and the detailed overview of IRS WISP requirements.
A WISP is not a one-time document. Both the IRS and the FTC require you to review it at least annually and update it whenever your firm's technology, personnel, or operating environment changes. A WISP written in 2021 that has never been revised is not compliant — and provides little actual protection.
What Every Strong WISP Template Must Include
Risk Assessment Framework
A structured process for identifying threats to client data — from phishing and ransomware to physical theft and insider misuse — with documented risk ratings and mitigations assigned to each.
Roles and Responsibilities
Clear designation of an Information Security Coordinator, with defined responsibilities for all staff who access, process, or store taxpayer data, including contractors.
Access Control Policy
Rules governing who can access client data, on what devices, and under what conditions — including MFA requirements, least-privilege principles, and remote access policies.
Incident Response Procedures
Step-by-step guidance for detecting, containing, and reporting a data breach, including IRS e-services notification steps and applicable state breach reporting timelines.
Vendor Management Section
A process to vet and monitor third-party vendors — cloud storage, tax software, payroll providers — that have access to your client data, with written security assurance requirements.
Annual Review Checklist
A built-in annual review process to keep the WISP current, with structured prompts for technology changes, staffing updates, new software adoptions, and emerging threat intelligence.
Evaluating the Best WISP Templates for Accountants: Key Criteria
Not all WISP templates are created equal. A generic cybersecurity policy pulled from a random website may miss IRS-specific language, lack provisions for tax software vendors, or fail to address the FTC Safeguards Rule's technical control requirements. When selecting from the best WISP templates for accountants, apply these five criteria before committing to any document.
IRS Security Summit Alignment
The IRS Security Summit — a public-private coalition that includes tax software companies, state tax agencies, and the IRS — released a model WISP template specifically for tax professionals in 2022. Any template worth using should align with this model or exceed it. Look for explicit references to IRS cybersecurity requirements, Electronic Filing Identification Number (EFIN) protection, and IRS e-services portal obligations.
FTC Safeguards Rule Coverage
The amended Safeguards Rule added 16 specific operational requirements for covered financial institutions. A strong accountant WISP template will either incorporate these directly or provide a mapping showing which WISP sections satisfy each requirement. Missing Safeguards Rule coverage is one of the most common gaps in off-the-shelf templates, and it is precisely what regulators look for after a breach.
Practical Usability, Not Compliance Theater
The best WISP templates for accountants are built to be actually used — with tables to fill in, options for common scenarios, and instructions written for non-technical users. A 40-page document full of legal boilerplate that staff never reads offers worse protection than a focused 15-page plan they reference during an incident. Usability and compliance are not in conflict; the right template achieves both.
Scaled for Small and Mid-Size Practices
Enterprise security templates are often over-engineered for small CPA firms. The right template should scale appropriately — covering a solo practitioner through a 50-person firm — without requiring a dedicated IT department. Our free WISP template for 2026 is designed with this balance as a core requirement, not an afterthought.
Thorough Incident Response and Breach Notification
One area where many templates fall short is incident response. The IRS requires tax preparers to notify the IRS upon discovering a data breach, and most states impose their own notification timelines (commonly 30-72 hours). A compliant template must include specific breach response procedures — not a generic placeholder. Our standalone cybersecurity incident response plan template provides a detailed companion resource for this section.
WISP Template Options: A Side-by-Side Comparison
| Feature | Generic Online Template | IRS Model Template | RecommendedBellator Cyber Guard Template |
|---|---|---|---|
| IRS Publication 4557 Alignment | Partial | ✓ | ✓ |
| FTC Safeguards Rule Coverage | — | Partial | ✓ |
| Tax-Specific Vendor Clauses | — | — | ✓ |
| Incident Response + IRS Notification Steps | Generic | Basic | Detailed |
| EFIN and PTIN Protection Guidance | — | ✓ | ✓ |
| Annual Review Checklist | — | — | ✓ |
| Remote Work and Cloud Provisions | — | Partial | ✓ |
| Plain-Language Staff Instructions | Varies | Moderate | ✓ |
| Vendor Risk Assessment Process | — | — | ✓ |
The IRS Model WISP Template: Strengths and Real Limitations
In August 2022, the IRS Security Summit released a model WISP template specifically designed for tax professionals. This was a meaningful step forward — before its release, many firms were adapting generic IT security policies that lacked IRS-specific language entirely. The IRS model covers the core requirements of Publication 4557 and includes sections on physical security, network security, employee responsibilities, and incident response.
However, the IRS model has meaningful gaps that accountants should understand before adopting it unchanged:
- FTC Safeguards Rule gaps: The IRS template was not updated to fully reflect the 2023 Safeguards Rule amendments, which added specific requirements for penetration testing, continuous monitoring, and access control logging for firms above the 5,000-record threshold.
- Limited cloud guidance: Most modern accounting firms use cloud-based tax software, document portals, and remote desktop access. The IRS model provides minimal guidance on securing these environments. Our guide on cloud services for tax professionals addresses this gap directly.
- No vendor risk management framework: The template does not include a structured process for evaluating third-party vendors — a specific requirement under both the Safeguards Rule and NIST SP 800-171.
- Generic incident response section: The breach notification language lacks state-specific guidance and does not walk through the IRS e-services notification process step by step — leaving firms uncertain about what to do when minutes matter.
The IRS model is an excellent starting point, but treating it as a finished compliance product leaves your firm exposed. The strongest approach is to use the IRS template as a foundation and layer in the additional controls required by the Safeguards Rule, NIST guidance, and your state's data security laws.
How to Implement Your WISP: Step-by-Step
Conduct a Data Inventory and Risk Assessment
Before writing a single policy, document every location where client data lives: workstations, servers, cloud storage, email, portable drives, and paper files. Assess the threats to each location — this risk assessment is the factual foundation your entire WISP rests on and is required by both the IRS and FTC.
Select and Customize Your WISP Template
Choose a template aligned with IRS Publication 4557 and the FTC Safeguards Rule. Fill in your firm's specific details: personnel names, system descriptions, software vendors, physical office locations, and existing controls already in place. A template that isn't customized to your actual operations is not compliant.
Assign Roles and Get Leadership Sign-Off
Designate your Information Security Coordinator — typically a managing partner or senior office manager — and document their specific responsibilities. Have firm leadership formally approve and sign the WISP. This creates accountability, satisfies the IRS requirement for designated oversight, and establishes a clear governance chain.
Train All Staff on WISP Policies
A WISP that employees have never read does not function as a real security plan. Conduct an initial training session covering key policies: password requirements, phishing recognition, device usage rules, and the steps to take when a potential breach is suspected. Document attendance as evidence of training completion.
Implement the Technical Controls Described in the WISP
Align your actual technology with what the WISP states you do. If the document says MFA is required for all remote access, enforce it technically. Common controls to deploy include MFA on all tax software and email accounts, full-disk encryption on laptops, automatic screen locks, and Endpoint Detection and Response (EDR) software on all workstations.
Schedule Annual Reviews and Ongoing Maintenance
Set a recurring calendar reminder to review and update your WISP at least once a year — ideally before tax season begins. Update it immediately when you hire or terminate staff, adopt new software, change offices, onboard a new vendor, or experience a security incident. Use the tax season cybersecurity checklist to verify all controls are active before each filing season.
Common WISP Mistakes Accounting Firms Make — and How to Avoid Them
After working with hundreds of tax practices, the security team at Bellator Cyber Guard has identified a consistent set of WISP failures that leave firms exposed even when they believe they are compliant. Avoid these mistakes when building or updating your plan.
Treating the WISP as a One-Time Filing Exercise
The most common failure mode is creating a WISP during a compliance push, filing it away, and never updating it. The FTC Safeguards Rule requires annual review, and the IRS expects your WISP to reflect current operations. If you onboarded a cloud document portal last year and your WISP still references only a local server, you have a documented compliance gap — one that regulators will find after a breach.
Omitting Vendor Oversight Requirements
Tax firms routinely share client data with payroll providers, document management platforms, and cloud-based tax software. Each of those relationships is a potential attack vector. Your WISP must include a section requiring you to review vendor security practices, obtain written security assurances, and terminate vendor access when a relationship ends. This is a specific FTC Safeguards Rule requirement that generic templates almost universally miss.
Writing a WISP That Doesn't Match Reality
Documenting controls you do not actually have in place — for example, stating that MFA is enforced when it has not been deployed — creates a paper trail of non-compliance rather than protection. Regulators and plaintiff attorneys look for exactly this discrepancy following a breach. Your WISP should describe what your firm actually does, paired with a prioritized roadmap to close gaps. Our analysis of cyberattacks on tax firms shows how attackers routinely exploit the difference between documented and actual controls.
Neglecting Physical Security
Digital controls receive most of the attention in template discussions, but physical security remains a genuine gap area. IRS Publication 4557 specifically requires policies for locking workstations when unattended, securing paper files containing taxpayer data, and controlling physical access to areas where client data is processed. A WISP without a physical security section is incomplete under IRS standards — even if the digital controls are strong.
Skipping the Incident Response Section
Many small firms operate as though a data breach is unlikely. The 2024 Verizon Data Breach Investigations Report found that 46% of all breaches involved small businesses. When an incident does occur, the difference between a manageable situation and a catastrophic one often comes down to whether staff knew what to do in the first minutes. Your incident response section must include a specific call list, IRS notification steps, and your state's breach reporting obligations and timelines.
IRS and FTC Enforcement Is Real
The IRS and FTC do not treat WISPs as optional. Under the FTC Safeguards Rule, firms that fail to maintain a compliant written information security program can face civil penalties. After a breach, regulators will specifically request your WISP. A missing or outdated plan is treated as evidence of willful negligence, which materially increases both regulatory exposure and civil liability. Some cyber insurance policies also condition coverage on having a current, implemented WISP — meaning a missing plan could affect your ability to make a claim when you need it most.
WISP Templates by Firm Size: What Changes and What Stays the Same
The core components of a compliant WISP are the same regardless of how many people work at your firm. What scales is the depth and complexity of each section. Here is how to calibrate the best WISP templates for accountants at different practice sizes.
Solo Practitioners and Small Firms (1-5 Staff)
A solo CPA or small bookkeeping firm needs a focused, practical WISP — typically 10-15 pages — that covers the IRS requirements without over-engineering. The Information Security Coordinator is usually the owner. The risk assessment can be relatively concise if your technology environment is simple. Key controls to document: a password manager, MFA on all tax software and email, encrypted laptop storage, and a clear incident response call list. Our free 2026 WISP template is built to work for this practice profile without requiring a consultant. Pair it with the tax season cybersecurity checklist to verify controls annually.
Mid-Size CPA and Accounting Firms (6-50 Staff)
Firms with multiple staff members face additional complexity: shared drives, diverse workstations, varied software environments, and more vendor relationships. Your WISP should include formal onboarding and offboarding procedures for IT access, a structured vendor risk assessment process, and documented network segmentation policies. Determine whether your firm holds 5,000 or more customer records — if so, the FTC Safeguards Rule triggers additional specific technical requirements that your WISP must address. Protecting your EFIN is especially important at this scale; see our EFIN protection guide for specific steps.
Multi-Office and Regional Accounting Firms (50+ Staff)
Larger firms should treat the WISP as the top-level governance document in a suite of security policies, supported by separate policies for remote access, acceptable use, vendor management, and change control. This tier also benefits most from third-party security validation — either a formal penetration test or a NIST CSF-based gap assessment — to confirm that documented controls are operating as described. A WISP that says controls exist but hasn't been tested offers little actual assurance. Consult our cyber risk management guide for a framework to prioritize investments at this scale.
Related Tax Security Resources
Get a Free WISP Review from Our Tax Security Experts
Unsure whether your current WISP satisfies IRS Publication 4557 and FTC Safeguards Rule requirements? Our cybersecurity specialists will review your existing plan — or help you build one from scratch — at no cost.
Frequently Asked Questions About WISP Templates for Accountants
All tax preparers who handle federal tax returns are required to have a WISP, regardless of firm size. This includes sole proprietors, single-person CPA firms, and Enrolled Agents. The IRS's requirement under Publication 4557 does not set a minimum client threshold — it applies to anyone who prepares returns and handles taxpayer data. The FTC Safeguards Rule adds additional technical requirements for firms holding 5,000 or more customer records, but basic WISP obligations exist at every scale.
The IRS Security Summit released a model WISP template in 2022 specifically for tax professionals. It covers the core requirements of IRS Publication 4557 and is a solid starting point. However, it does not fully incorporate the 2023 FTC Safeguards Rule amendments, lacks detailed vendor risk management provisions, and provides minimal guidance on cloud and remote work environments — all areas where modern accounting firms have significant exposure. For most firms, the IRS model should be treated as a foundation to build on, not a finished compliance product. Our free 2026 WISP template addresses these gaps.
There is no required length. A WISP for a solo practitioner might be 10-15 pages, while a 30-person regional firm might maintain a 25-35 page document with supporting appendices. The IRS and FTC care about substance, not page count. Your WISP should be thorough enough to address all required elements — risk assessment, access controls, incident response, vendor management, annual review — but concise enough that staff can actually read and use it. Avoid padding with boilerplate that does not reflect your firm's actual operations.
At minimum, annually. Both the IRS and the FTC Safeguards Rule require annual review of your written information security program. Beyond that scheduled review, update your WISP any time you: hire or terminate staff with data access, adopt new software or cloud services, change office locations, onboard a new vendor, experience a security incident, or become aware of significant new threats to your data environment. Each update should be dated and version-controlled so you can demonstrate an active maintenance history if regulators ask.
Operating without a WISP exposes your firm to FTC civil penalties for Safeguards Rule violations, potential IRS enforcement action, civil liability in the event of a client data breach, and significant reputational damage. In breach litigation, the absence of a WISP — or having an outdated plan that was demonstrably not followed — is treated as evidence of negligence. Some cyber insurance policies require a current WISP as a condition of coverage, meaning a missing plan may affect your ability to make a claim after an incident.
A high-quality free WISP template — one specifically designed for tax professionals and aligned with IRS Publication 4557 and the FTC Safeguards Rule — is a valid and effective option for most small to mid-size accounting firms. The key is choosing the right template and customizing it thoroughly to reflect your actual operations, personnel, and technology. Where firms most often benefit from professional assistance is in the risk assessment step and in verifying that technical controls actually match what the WISP documents. Our free 2026 WISP template is built to be usable without a consultant for most practices, with clear instructions at each section.
Yes. If your firm uses cloud-based tax software, remote desktop access, document portals, or has any staff working from home, those environments must be addressed in your WISP. The FTC Safeguards Rule specifically requires policies for remote access security, and the IRS expects your WISP to reflect where client data actually lives — which in 2026 almost always includes cloud systems. Your policies should address MFA for all remote access, data encryption in transit and at rest, and acceptable use rules for personal devices used for work purposes.
Many cyber insurance underwriters now require applicants to confirm they maintain a written information security plan as part of the underwriting questionnaire. Some policies specifically require an IRS-compliant WISP for tax firms. Following a breach, insurers will examine whether your firm maintained and actively followed its security plan. If you had a WISP but demonstrably deviated from it — or had no WISP at all — coverage may be reduced or denied. A current, well-implemented WISP supports both compliance and insurability, making it an asset on multiple fronts.
A cybersecurity policy is a broad term for any documented security rules an organization maintains. A WISP is a specific type of written security program required by the IRS and FTC for firms handling taxpayer financial data. While general cybersecurity policies address IT security broadly, a WISP for accountants must specifically address taxpayer data protection, EFIN and PTIN security, tax software vendor oversight, IRS breach notification procedures, and the risk assessment requirements outlined in Publication 4557. A generic cybersecurity policy from your IT vendor does not substitute for a WISP unless it has been adapted to meet these tax-specific obligations.
Free Consultation
Need help with IRS compliance?
Our tax cybersecurity specialists can review your security posture and help you get compliant.
