IRS Publication 5708 Sample WISP: 2026 Guide for Tax Pros

IRS Publication 5708 is the IRS Security Summit’s sample Written Information Security Plan, or WISP, for tax and accounting practices. If you are asking what is IRS Publication 5708, the short answer is that it gives a tax practice a practical template for documenting how it protects taxpayer data, but it must be completed with the firm’s actual people, systems, vendors, and procedures.

Use Publication 5708 with IRS Publication 4557, Safeguarding Taxpayer Data, which explains the security expectations for tax professionals. A template alone does not show that controls are in place or working.

What Publication 5708 helps a tax practice document

The IRS Security Summit is a public-private partnership that provides tax-security resources for preparers. Publication 5708 organizes a WISP around the day-to-day decisions a practice needs to make when it handles Social Security numbers, tax returns, bank information, and identity documents.

A useful completed WISP identifies who owns the program, where client data lives, which risks the practice has considered, and what happens if data or accounts may be compromised. It should also identify the services and vendors that process or store taxpayer information.

The FTC Safeguards Rule guidance explains that covered financial institutions must develop, implement, and maintain a written information security program. Tax preparation businesses are included in the Rule’s definition of financial institution. Questions about whether a particular requirement applies to your firm should go to qualified legal counsel.

The sections that need practice-specific detail

The most important work happens after you download the template. General statements such as “we use encryption” or “employees receive training” are not useful operating instructions unless the WISP identifies the applicable systems, tools, frequency, and owner.

Security coordinator and risk assessment

Designate a person with enough authority to make security decisions and document how that person reports to firm leadership. The risk assessment should connect likely events, such as a phishing-led account takeover or a lost laptop, to the safeguards the practice uses to reduce that risk.

A tax preparer security plan should reflect the size of the practice and the information it handles. A solo preparer and a larger firm may use different processes, but both need a plan that matches their real environment.

Systems, access, and technical safeguards

Inventory workstations, laptops, mobile devices, tax software, cloud storage, email, client portals, remote-access tools, and paper records. For each system, document who has access and how access is protected, including multi-factor authentication where available.

IRS Publication 4557 recommends measures such as antivirus or anti-malware protection, firewall protection, security software updates, strong passwords, backups, and employee awareness. The IRS also provides Protect Your Clients, Protect Yourself resources for tax professionals.

Vendors, training, and incident response

List vendors that can access or process taxpayer data, such as tax software, client portals, cloud storage, payment providers, and managed technology providers. Record the data involved, the firm contact responsible for the relationship, and how the practice reviews the vendor’s security information.

Training records should match the WISP. Staff need clear instructions for reporting suspicious email, unexpected password prompts, missing devices, and client-data concerns. Your response section should identify who contains an incident, who preserves records, and when the firm needs to consult its insurer, counsel, affected vendors, or government reporting channels.

How often should you review a WISP?

Review the WISP at least annually and whenever the practice makes a meaningful change, such as adopting new tax software, adding a client portal, bringing on staff, allowing remote access, or using a new vendor. Update the asset inventory and risk assessment at the same time.

Run a short tabletop exercise before filing season. For example, have the team walk through what they would do if a preparer entered credentials on a phishing page or a laptop containing client information went missing. Record the scenario, participants, decisions, and follow-up actions.

If your firm suspects a taxpayer-data incident, move quickly to contain it and preserve relevant information. See tax professional data breach response guidance for preparation steps and the decisions that may follow an incident.

When a custom WISP is worth considering

A self-completed template can be a reasonable starting point for a small practice that understands its systems and can document its procedures accurately. A custom WISP may be a better fit when the firm has several staff members, remote workers, multiple vendors, a recent security incident, or uncertainty about how its safeguards map to its risks.

Bellator Cyber Guard offers a custom WISP starting at $749 for up to 5 users; larger practices receive a custom quote. The goal is a plan that reflects the controls and responsibilities your practice can operate, not a generic document that sits unused.

For controls that help carry out the plan, compare Bellator protection plans, including managed endpoint security and monitoring options. No security control guarantees that an incident will not occur, but documented safeguards, regular review, and practiced response procedures can reduce avoidable risk.