Yes. If you hold an active Preparer Tax Identification Number (PTIN) and prepare federal tax returns for compensation, federal rules require you to maintain a written information security plan, and a PTIN WISP is the document that proves it. This is not optional guidance. IRS Publication 4557, the IRS guide for safeguarding taxpayer data, and the Federal Trade Commission (FTC) Safeguards Rule together make a written plan mandatory for every paid preparer, with no carve-out for solo practitioners or small firms.
A Written Information Security Plan (WISP) is a documented program describing how your practice protects client data and responds when something goes wrong. Below is the exact legal basis, the nine elements your plan must contain, the mistakes that most often expose preparers, and how to build a plan that holds up to scrutiny in 2026.
Quick Answer
Every active PTIN holder who prepares federal returns for pay must maintain a written WISP. IRS Publication 4557 and the FTC Safeguards Rule (16 CFR Part 314) both require it, and there is no exemption for small or solo firms. The plan must address nine specific safeguards, name a responsible individual, be signed and dated, and be reviewed at least once a year and whenever your systems or staff change.
Key Takeaway
- Your PTIN makes you a "financial institution" under the Gramm-Leach-Bliley Act, which is why the FTC Safeguards Rule applies to you.
- The written plan requirement applies to every covered preparer; the under-5,000-record exemption only removes certain reporting duties.
- A WISP that references systems you do not use, or has not been reviewed in years, fails the accuracy and annual-update standard.
- Keep evidence of implementation (training logs, risk assessment, vendor contracts, signed annual reviews) for at least five years.
Tax Preparer Data Security By The Numbers
How Your PTIN Creates a WISP Obligation
The PTIN is required under IRS regulations at 26 CFR 1.6109-2 for anyone who prepares or substantially assists in preparing federal returns for compensation. The WISP obligation itself comes from two overlapping frameworks.
IRS Publication 4557, Safeguarding Taxpayer Data. This publication instructs all tax professionals, regardless of firm size, to create and maintain a written information security plan. It draws its substance directly from the FTC Safeguards Rule and is the IRS's main channel for communicating security expectations to PTIN holders.
FTC Safeguards Rule (16 CFR Part 314). Under the Gramm-Leach-Bliley Act (GLBA), tax preparers count as financial institutions because they perform activities incidental to financial services. The FTC Safeguards Rule, updated effective June 9, 2023, requires covered institutions to put a written security program in place with specific administrative, technical, and physical controls. Our FTC Safeguards Rule checklist walks through each obligation in practical terms.
No small-firm exemption from the written plan
Preparers with fewer than 5,000 customer records are exempt from certain reporting provisions under 16 CFR Part 314, but the written plan requirement itself applies to every covered preparer. A solo practitioner needs a WISP just as a multi-partner firm does.
What Publication 4557 Expects You to Control
Publication 4557 organizes its guidance around three operational areas where a tax preparer must assess and manage risk.
Employee management and training. How you screen staff who handle client data, limit access by role, and deliver documented annual security awareness training covering phishing and data handling specific to tax practice.
Information systems. The hardware, software, and networks that process or store client information, including your tax software, client portals, email, local network equipment, and any cloud services that touch taxpayer data, and how each is protected from unauthorized access.
Detecting and managing system failures. Your monitoring, endpoint protection, logging, and incident response procedures, so your practice can detect anomalies and respond when something goes wrong. The IRS treats the WISP as a living document that must be reviewed at least annually and whenever a material change occurs, such as new tax software, a new cloud provider, added staff, an office move, or a change of IT vendor.
The Nine FTC Safeguards Rule Elements Your WISP Must Address
- Qualified Individual: name one person with the authority, resources, and knowledge to run the program; a solo preparer fills this role and documents it by name, title, and date.
- Risk Assessment: a written assessment of internal and external risks to client data across all three Publication 4557 areas.
- Safeguards Design: controls that address the risks you found, including MFA on any system that accesses client financial data.
- Monitoring and Testing: regular checks that safeguards work; periodic vulnerability assessments for smaller firms, continuous monitoring or annual penetration testing above 5,000 records.
- Staff Training: documented security training on threats relevant to tax practice, including phishing the IRS warns about each filing season.
- Service Provider Oversight: contracts requiring vendors who touch client data to protect it, with verification you document.
- Program Updates: keep the plan current with your business, technology, and threat environment; annual is the floor, not the ceiling.
- Incident Response Plan: a written plan for assessing, containing, notifying, recovering, and recording lessons learned.
- Reporting: a documented annual self-review with signed attestation for sole practitioners, or a written update to partners for firms.
How to Build a Compliant PTIN WISP in 7 Steps
Designate a security coordinator
Name the person responsible for the program with documented authority and resources. For solo practitioners that is you, so record your name, title, and designation date.
Write a risk assessment
Document internal and external threats to client data across all three Publication 4557 areas, rating each by likelihood and impact.
Inventory systems and data
List every system that stores or processes taxpayer data: tax software, portals, email, local network gear, and cloud services.
Deploy technical controls
Enable MFA on all systems that access financial data, configure encryption in transit (TLS 1.2 or higher) and at rest (AES-256), and apply least-privilege access.
Document vendor oversight
Collect signed contracts with security provisions and request a SOC 2 Type II report from every vendor who touches client data.
Write and test incident response
Detail containment, client and regulator notification, and recovery, then run a tabletop test. Our FTC Safeguards incident response guide shows the structure.
Schedule the annual review
Set a recurring date to review, update, sign, retain, and date the WISP and its supporting records.
Common PTIN WISP Mistakes That Create Exposure
The most frequent failure is not the absence of a WISP. It is a plan that exists only on paper and bears no relationship to how the practice actually operates. Examiners look for internal consistency: does the document describe the systems you really use, and do the access policies match who really has access?
A generic template that references an on-premises server when you run entirely in the cloud fails the accuracy test immediately. Skipping the written risk assessment, relying on password-only logins for tax software, having no vendor contracts with security provisions, and letting the annual review lapse are the gaps that turn up most often. The IRS has repeatedly stated that single-factor authentication on tax software does not satisfy Publication 4557.
MythSmall or solo tax practices are too small to need a WISP.
Small or solo tax practices are too small to need a WISP.
The written plan requirement under IRS Publication 4557 and the FTC Safeguards Rule applies to every paid preparer. The under-5,000-record exemption only removes certain reporting duties, not the plan.
MythDownloading a WISP template means I am compliant.
Downloading a WISP template means I am compliant.
A template is a starting point, but it must be customized to your actual software, network, staff roles, and location. A plan describing systems you do not use fails on accuracy.
MythMy tax software vendor handles security, so my WISP is covered.
My tax software vendor handles security, so my WISP is covered.
The FTC requires you to verify vendor safeguards contractually and document that verification. You remain responsible for your own MFA, encryption, access controls, and training.
MythA WISP I wrote a few years ago still counts.
A WISP I wrote a few years ago still counts.
The plan must be reviewed at least annually and after any material change. An unrevised plan does not satisfy the annual update requirement.
2026 Filing Season Compliance Notice
The IRS expects every PTIN holder to have a current, signed WISP before the 2026 filing season opens, and preparers attest to a data security plan at PTIN renewal. A plan not reviewed since a prior year does not meet the annual update requirement. Confirm your WISP reflects your 2026 systems, staff, and vendors now. See our PTIN renewal next steps.
What a Compliant WISP Costs
A free template is a legitimate starting point if you have the time and security knowledge to tailor it, run a real risk assessment, and keep it current. Many preparers find the honest version takes 20 to 40 billable hours to produce and maintain, which is the tradeoff a managed plan removes.
Bellator Cyber Guard builds custom Written Information Security Plans for tax practices starting at $749 for up to 5 users, with larger practices quoted separately. The plan is mapped to your actual systems and includes the written risk assessment and documentation that regulators look for. Legal questions about your specific obligations belong with your own counsel; this guide covers the operational requirements.
Get a WISP mapped to your practice
Compare a self-built WISP against a custom plan starting at $749 for up to 5 users, with larger firms quoted separately.
What Happens to Preparers Without a Compliant WISP
The IRS enforces preparer data security through several channels. The Office of Professional Responsibility can sanction enrolled agents, CPAs, and attorneys under Circular 230, from reprimand to suspension or disbarment, and the IRS can revoke a PTIN for conduct incompatible with preparing federal returns.
A breach involving client data also triggers state notification duties. As of 2026 all 50 states have breach notification statutes, some with notice windows as short as 30 days from discovery. Separately, the FTC can seek civil penalties under the Safeguards Rule; the agency's inflation-adjusted maximum was $51,744 per violation as of 2024, and the figure is adjusted annually, so confirm the current amount with the FTC. Courts have often treated the absence of a written security policy as evidence of negligence, which is one more reason the WISP functions as a defense document. Our breakdown of data breach notification requirements by state covers the notice side in detail.
What to Keep and for How Long
A WISP is a documentation system, not a single file. Evidence that your program is active matters as much to the IRS and FTC as the plan itself. Keep the current signed and dated WISP, prior versions, the written risk assessment, dated training records, vendor security agreements, incident logs, signed annual reviews, and access control records.
No single federal statute sets a retention period, but IRS guidance and FTC enforcement practice point to a minimum of five years for all security program records, and some states require longer for financial records. Store them in encrypted storage separate from the systems a breach might reach. Our FTC Safeguards recordkeeping guide explains how to organize these records.
Bottom Line
Every active PTIN holder must maintain a current, customized, and documented WISP. It is required by IRS Publication 4557 and the FTC Safeguards Rule, must address all nine FTC elements, must be reviewed at least annually, and must accurately describe your real systems. A generic template left untouched is a liability, not protection. Ready-made starting points live on our WISP template for tax preparers page.
Book a Free Tax Cybersecurity Assessment
Have a specialist review whether your current WISP would hold up to an IRS or FTC review and map any gaps to your actual systems.
Frequently Asked Questions
Yes. Any individual who prepares federal tax returns for compensation is covered by IRS Publication 4557 and the FTC Safeguards Rule, both of which require a written information security plan. There is no exemption for solo or small practices.
The IRS asks preparers to confirm a data security plan is in place as part of renewal and expects a current, signed WISP before the filing season opens. A plan not reviewed since a prior year does not meet the annual update requirement.
You can write it yourself from a template if you tailor it to your systems and complete a real risk assessment, or a cybersecurity firm that works with tax practices can build it for you. Bellator Cyber Guard offers a custom WISP starting at $749 for up to 5 users, with larger firms quoted separately.
A named security coordinator, a written risk assessment, MFA and encryption on systems handling client data, least-privilege access, documented staff training, vendor oversight, an incident response plan, program updates, and reporting. These are the nine FTC Safeguards Rule elements, and your plan must accurately describe the systems you actually use.
The preparer risks IRS Office of Professional Responsibility sanctions under Circular 230, possible PTIN revocation, FTC civil penalties, and state breach notification liability. Courts have also treated a missing written security policy as evidence of negligence in client lawsuits.
From requirement to defensible practice
Turn IRS and FTC expectations into a WISP your office can follow
A useful compliance path makes the obligation clear, identifies the evidence to retain, and connects written policy to the safeguards used every day.
People also look for
Keep exploring Tax security & WISP
Understand what tax professionals need to document, protect, and prepare before an IRS or FTC review.
- Common question: free WISP templateStart with a written information security planUse a practical WISP framework built around the safeguards tax practices need.
- Common question: IRS Publication 4557 requirementsRead the Publication 4557 guideSee how the IRS expects tax professionals to safeguard taxpayer data.
- Common question: IRS WISP requirementsReview the WISP requirementsWork through the required sections and the evidence your practice should retain.
- Common question: FTC Safeguards Rule checklistUse the FTC Safeguards checklistTranslate the rule into a clear list of security and documentation tasks.
- Common question: tax practice incident response planPrepare a tax-office incident planKnow who to contact, what to preserve, and how to respond to a client-data incident.
