Accounting Firm WISP Template Examples & Guide 2026

A free WISP template gets you the required section headings, but it will not satisfy IRS Publication 4557 or the FTC Safeguards Rule on its own. The IRS publishes a free sample Written Information Security Plan (WISP) in IRS Publication 5708, and it is a legitimate place to start. The problem is that a document with placeholder firm names and generic risk language does not meet the requirement that every tax preparer and accounting firm maintain a written, firm-specific security plan, regardless of size or return volume.

Accounting firms are a high-value target. A single client tax file contains Social Security numbers, bank account numbers, income history, and often years of business financials. According to the Verizon 2026 Data Breach Investigations Report, ransomware incidents against professional services firms rose 45% between 2024 and 2025. IRS-reported data shows tax professionals filed more than 1,200 data theft reports during the 2025 filing season, a 20% increase over the prior year.

This guide covers what a free WISP template can and cannot do, walks through the sections IRS Publication 4557 and the FTC Safeguards Rule actually require, and explains what to do if you want a firm-specific WISP documented without doing the customization work yourself.

IRS Publication 5708, Written Information Security Plan Template for Tax Professionals, gives you the required section headings: an Information Security Coordinator designation, an employee training section, a risk assessment outline, and incident response steps. It is free and reflects the structure the IRS expects to see. What it does not include is your firm's actual systems, staff names, vendor list, or a completed risk assessment. IRS Publication 4557, Safeguarding Taxpayer Data, and the FTC Safeguards Rule both require the plan to reflect your firm's specific environment, not a sample document.

Three overlapping rules require this document. IRS Publication 4557 states that every tax preparer must create and maintain a WISP identifying risks to client data and the controls used to address them. The Publication points to the FTC Safeguards Rule, part of the Gramm-Leach-Bliley Act, as its legal basis. Under the FTC Safeguards Rule, effective June 2023 for most provisions, financial institutions covered by GLBA, including tax return preparers, must designate a qualified individual to oversee the security program, complete a written risk assessment, implement access controls and encryption for customer financial data, and train staff with access to that data. Our guide to the FTC Safeguards Rule qualified individual requirement covers how to fill that role correctly.

Preparers with a Preparer Tax Identification Number (PTIN) operate under IRS oversight that extends to data security, and the IRS treats a current WISP as part of maintaining that registration in good standing. NIST Special Publication 800-171 Revision 3, written for federal contractors, is not a requirement for accounting firms, but many WISP templates borrow its control families, such as access control and incident response, because they map cleanly onto FTC expectations.

A free template only causes problems when firms stop at downloading it. Many practices file IRS Publication 5708 with placeholder firm names and generic risk descriptions left in place, and reviewers recognize an unmodified template on sight. Others complete the document once and never revisit it. The FTC Safeguards Rule requires periodic review and specifically requires an update after any security incident, so a WISP written in 2022 that ignores a move to cloud storage or a new remote hire no longer describes reality. Remote and seasonal staff create another common gap: if anyone accesses taxpayer data outside the office, the WISP needs explicit remote-access controls, not an assumption that office policies already cover it. Vendor management is the fourth recurring gap. If your firm uses a cloud-based tax platform, client portal, or outside IT provider, your WISP has to document how you vetted that vendor's security and how you monitor it, referencing certifications like SOC 2 Type II or ISO 27001:2022 where the vendor holds them.

Whichever template you start from, reference each item in the IRS Security Six directly and assign a named owner to each one: anti-virus or endpoint protection, a firewall, multi-factor authentication, drive encryption, data backup and recovery, and phishing awareness training. A WISP that says your firm uses endpoint protection is weaker than one that names the product, who monitors alerts, and how deprovisioning works when someone leaves. Our full IRS Security Six checklist for tax professionals breaks down each control with implementation detail you can copy directly into your policy sections.

Most firms need four to six weeks to assess their current security posture, document required procedures, and close gaps in technical controls like MFA and encryption. Start the process early in the year rather than during tax season, when staff attention is on client deadlines rather than policy review. Once the WISP is written, it has to be operational: the FTC Safeguards Rule evaluates whether the security program is implemented, not whether the document exists. That means configuring systems to enforce MFA rather than writing that MFA is required, and documenting training completion rather than assuming staff read the policy. Firms exchanging documents with clients should also review their secure file-sharing procedures as part of this process, since client portals are one of the systems your risk assessment has to cover.