What Is the IRS WISP Template and Who Needs One?
If you prepare federal tax returns — whether you run a solo practice or a multi-partner firm — you are legally required to maintain a Written Information Security Plan (WISP). The IRS WISP template is a standardized document framework that helps tax professionals meet this obligation under IRS Publication 4557, Safeguarding Taxpayer Data.
The requirement stems from the Gramm-Leach-Bliley Act (GLBA), which mandates that financial institutions — a category that includes tax return preparers under the FTC's definition — implement a written information security program. The IRS and the Federal Trade Commission (FTC) jointly enforce these requirements. Failure to comply can result in civil penalties, loss of your Preparer Tax Identification Number (PTIN), and personal liability for data breaches affecting client information.
A WISP is not a one-size-fits-all document. The IRS WISP template for tax professionals provides a customizable starting point, but your final plan must reflect your actual business operations, the specific data you collect, and the risks your practice faces. A template sitting in a drawer without customization does not satisfy regulators — they expect documented evidence that you have genuinely evaluated your security posture and put real controls in place.
The IRS collaborated with state tax agencies and the tax professional community to release an updated WISP template in 2022. That framework remains the baseline expectation today. Understanding how to use and tailor this template is where sound cybersecurity for tax professionals begins.
Tax Data Security By The Numbers
IBM Cost of Data Breach Report 2024
IBM Cost of Data Breach Report 2024
Verizon 2024 Data Breach Investigations Report
IRS Publication 4557 and Your Legal Obligations
IRS Publication 4557 is the primary guidance document outlining data security requirements for tax professionals. It covers physical security of client files, proper data disposal, employee training, and the technical controls you must have in place. These are not optional best practices — they describe the minimum standard of care the IRS expects from anyone who handles taxpayer information.
Under Publication 4557, tax preparers must:
- Designate a WISP coordinator responsible for managing and updating the plan
- Conduct a formal risk assessment identifying threats to client data
- Document safeguards that address each identified risk
- Train employees on data security policies at least annually
- Oversee the data security practices of third-party service providers
- Monitor, test, and adjust safeguards on an ongoing basis
- Maintain a written incident response procedure
These IRS cybersecurity requirements apply to all paid tax return preparers, regardless of firm size. Even a sole proprietor preparing a handful of returns per year must maintain a documented WISP. There is no small-firm exemption.
Employee training deserves particular attention. According to the Verizon 2024 Data Breach Investigations Report, 68% of breaches involve a human element — meaning staff who click phishing links, mishandle credentials, or fall for social engineering are the single greatest risk vector in most tax firm environments. Your WISP must document a real training program, not just a policy statement.
Beyond the IRS, the FTC's updated Safeguards Rule — which took full effect in 2023 — adds specificity around technical controls. Understanding the FTC Safeguards Rule for a tax return preparer is essential to building a WISP that satisfies both agencies simultaneously.
How to Build Your IRS WISP: 8 Essential Steps
Designate a WISP Coordinator
Assign a specific individual — even if that is you as the solo practitioner — to own the WISP. Document their name, role, and responsibilities in writing within the plan itself.
Inventory All Data and Systems
List every type of client data you collect (SSNs, bank account numbers, W-2 data, financials), where it is stored, who can access it, and how it flows through your practice from intake to filing to retention.
Conduct a Formal Risk Assessment
Identify realistic threats — phishing attacks, ransomware, physical theft of laptops, insider misuse — and evaluate the likelihood and potential impact of each. This assessment drives every safeguard decision that follows.
Implement Technical Safeguards
Deploy multi-factor authentication (MFA), endpoint protection, data encryption at rest and in transit, and a properly configured firewall. Document each control, the product or method used, and who is responsible for maintaining it.
Establish Physical and Administrative Controls
Address locked file storage, visitor access policies, clean-desk requirements, and background check standards for staff with access to client data. If staff work remotely, document home office security expectations explicitly.
Train All Staff Annually
Conduct documented security awareness training covering phishing recognition, password hygiene, data handling, and incident reporting. Retain signed acknowledgments and training completion records for each employee.
Write Your Incident Response Procedures
Define how your firm detects, contains, reports, and recovers from a breach. Include IRS stakeholder liaison contact details, state breach notification timelines, and the specific staff roles activated during an incident.
Review and Update on a Set Schedule
Revisit your WISP every year at minimum — most firms schedule this in the fall before filing season. Also update any time you change systems, hire staff with data access, or onboard a new service provider. Version-control each revision with a date.
Core Components Every IRS WISP Template Must Include
Whether you use the IRS-provided template or build your own from scratch, every compliant WISP must address three categories of safeguards: administrative, technical, and physical. Each addresses a distinct dimension of risk, and auditors will look for documentation in all three areas.
Administrative Safeguards
Administrative safeguards govern how your firm manages data security as a matter of policy. This includes your risk assessment process, employee training program, vendor management practices, and the oversight role of your WISP coordinator. A key element regulators focus on is vendor oversight — your WISP must document exactly how you vet third-party software providers and cloud storage vendors before sharing client data with them, and how you confirm they maintain adequate security over time.
Technical Safeguards
Technical safeguards are the controls embedded in your systems and software. At minimum, your IRS WISP template should document:
- Access controls: Who can access systems holding client data, how credentials are managed, and how terminated employees are promptly removed
- Encryption: How data is protected on local drives, in cloud storage, and during transmission via email or file transfer portals
- Session management: Automatic logoff policies for unattended workstations
- Audit logging: How your systems record data access events and how those logs are reviewed
- Patch management: How and how frequently software updates are applied across all devices that touch client data
Physical Safeguards
Physical safeguards protect hardware and paper records. This covers locking file cabinets, restricting access to network equipment, and defining a secure document destruction process. If staff work from home, the WISP must address home office security — who else has access to the workspace and how client data is protected in that environment.
Use our wisp checklist alongside the IRS template to confirm every required element is addressed before you finalize your plan.
What Your IRS WISP Must Address
Data Inventory & Classification
Identify every type of taxpayer data you collect, where it lives, how it moves through your practice, and who can access it — the foundation of your entire security plan.
Formal Risk Assessment
Document identified threats, likelihood of occurrence, potential impact, and the specific safeguards selected to reduce each risk to an acceptable level.
Access Controls & MFA
Enforce least-privilege access, strong password policies, and multi-factor authentication across every system that stores or processes client tax information.
Incident Response Procedures
Define detection, containment, and notification steps. Include IRS reporting contacts, state breach notification timelines, and staff role assignments for incident scenarios.
Employee Training Program
Document annual security awareness training covering phishing, social engineering, and proper data handling — with signed acknowledgments retained for each employee.
Vendor Oversight
Verify that all service providers — tax software vendors, cloud storage platforms, payment processors — maintain adequate security and sign written data protection agreements.
The FTC Safeguards Rule: Additional Requirements Beyond the IRS Template
The IRS WISP template addresses IRS Publication 4557 compliance, but tax preparers also fall under the FTC's updated Safeguards Rule, which took full effect in 2023 with more specific technical mandates. If you prepare tax returns for clients, the FTC classifies you as a financial institution under the GLBA — with all the obligations that entails.
The updated Safeguards Rule introduces requirements that go beyond the IRS template's baseline:
- Multi-factor authentication for any system accessing customer financial data
- Encryption of all customer data at rest and in transit
- A written incident response plan as a standalone documented element
- Regular testing of safeguards, including penetration testing on a defined schedule for larger firms
- A designated qualified individual to oversee the security program — with documented oversight if a third-party provider fills this role
The practical result: a WISP built solely from the IRS template may satisfy Publication 4557 but fall short of the Safeguards Rule if it does not document these specific technical controls. Your plan needs to satisfy both simultaneously.
The IBM Cost of Data Breach Report 2024 found that organizations using security AI and automation cut breach costs by an average of $2.2 million compared to those without — a meaningful case for implementing documented technical controls, not just paper policies.
Review your PTIN renewal security requirements as well — PTIN holders are increasingly expected to demonstrate active compliance as part of the renewal process, and regulators are beginning to cross-reference PTIN status with reported incident histories.
IRS WISP Approaches: Which Option Fits Your Firm?
Maintaining Your WISP: Annual Reviews and Triggered Updates
Creating your IRS WISP template is the starting point, not the finish line. Both the IRS and FTC require that your written security plan be reviewed and updated regularly — and both agencies expect you to revise it whenever a material change occurs in your business environment.
Trigger a WISP update any time you:
- Add or remove a service provider that handles client data
- Adopt new tax software, cloud storage, or payment processing tools
- Hire or terminate employees with access to client information
- Experience a security incident or a near-miss that reveals a gap
- Move your office, change your network configuration, or expand remote work arrangements
- Receive new guidance from the IRS, FTC, or your state tax authority
Most tax firms should schedule their formal annual WISP review in the fall — before the busy season begins in January. This gives you time to close any gaps before you're handling high volumes of sensitive client data. Version-control each revision with a clear date so you can demonstrate to a regulator exactly what was in place during any given filing season.
If a breach does occur, your incident response procedures activate immediately. The IRS requires you to notify your IRS stakeholder liaison and you may face state notification obligations within specific time windows. These contacts and timelines must be in your WISP before an incident — not researched after the fact. Use our incident response plan template to build out this section in detail.
Firms that want to align their WISP with broader federal security frameworks will find value in understanding what is a written information security plan in the context of NIST SP 800-171 and ISO 27001:2022 — both of which provide a more rigorous structural foundation for practices managing large volumes of sensitive data.
Common WISP Mistake: Templates Left Uncustomized
The most frequent compliance gap auditors identify is a WISP that is clearly a downloaded template with placeholder text still in place — firm name fields blank, risk assessments not completed, safeguard sections marked "to be determined." An unmodified template does not satisfy IRS Publication 4557. Your plan must document your specific data types, systems, identified risks, and the actual controls you have implemented to address them.
Get Expert Help Building Your IRS WISP
Bellator Cyber Guard works exclusively with tax professionals to build compliant, practice-specific WISPs that satisfy both IRS Publication 4557 and the FTC Safeguards Rule. Schedule a free strategy call to assess your current security posture.
Frequently Asked Questions About the IRS WISP Template
All paid federal tax return preparers are required to have a Written Information Security Plan under IRS Publication 4557. This includes sole proprietors, CPA firms, enrolled agents, and bookkeepers who prepare returns for compensation. There is no minimum number of returns that triggers the requirement — even a one-person practice filing a small number of returns per year must maintain a documented WISP.
Yes. The IRS publishes a free WISP template specifically for tax professionals at irs.gov. It is a solid starting point, but you must customize it to reflect your actual practice — your data types, systems, identified risks, and the specific controls you have in place — before it qualifies as a compliant plan.
A WISP is the overarching written security program that covers all aspects of data protection — risk assessment, safeguards, employee training, vendor management, and more. An incident response plan is a component of the WISP that addresses specifically how your firm responds when a breach or security incident occurs. IRS Publication 4557 requires your WISP to include a documented incident response section.
Your WISP must be reviewed and updated at least annually. You are also required to update it whenever a material change affects your security environment — new software, new staff with data access, a new office location, or a security incident. Most tax professionals schedule their annual WISP review in the fall, before the filing season begins in January.
Operating without a WISP exposes your firm to serious consequences. The IRS can revoke or deny PTIN renewal. The FTC can impose civil penalties under the Gramm-Leach-Bliley Act of up to $100,000 per violation for firms that fail to maintain the required written security program. In the event of a client data breach, the absence of a WISP significantly increases your personal liability and may violate state breach notification laws that carry their own separate penalties.
Yes. The FTC's updated Safeguards Rule, fully effective since 2023, adds specific technical requirements that the IRS WISP template does not fully address on its own. These include mandatory multi-factor authentication, encryption of data at rest and in transit, and regular penetration testing for firms above certain size thresholds. Tax preparers need to ensure their WISP satisfies both IRS Publication 4557 and the FTC Safeguards Rule at the same time.
Generally, no. Each legal entity that handles client tax data should have its own WISP that reflects its specific systems, employees, data types, and risk environment. A single generic document that does not map to a specific entity's actual operations will not satisfy IRS customization requirements. If you operate multiple locations or affiliated entities, each needs its own tailored plan.
Start with a data inventory. Before you can assess risks or document safeguards, you need a clear picture of what client data you collect, where it is stored (local drives, cloud platforms, paper files), who can access it, and how it moves through your practice from intake to filing to retention and destruction. That inventory is the foundation every other element of your IRS WISP template is built on. Once documented, conduct your risk assessment, then record the controls you have in place to address each identified risk.
Schedule
Need help with IRS compliance?
Our tax cybersecurity specialists can review your security posture and help you get compliant.
