IRS WISP Example: Build Your Tax Firm's Security Plan

If you prepare federal tax returns for clients, the IRS requires you to maintain a Written Information Security Plan, or WISP: a formal document describing exactly how your firm protects client data. This requirement comes from IRS Publication 4557, Safeguarding Taxpayer Data, and applies to every paid tax preparer regardless of firm size or client volume.

The IRS WISP examples below cover the nine required sections, sample policy language you can adapt, and the 2026 compliance standards your plan needs to meet. The IRS, working with the FTC Safeguards Rule under the Gramm-Leach-Bliley Act, treats a missing or incomplete WISP as a compliance failure that can lead to civil penalties and referral to state licensing boards.

Two IRS Publications Define a Compliant WISP

Two IRS documents govern this requirement. IRS Publication 4557, Safeguarding Taxpayer Data, is the primary guidance on a tax professional's data security obligations. IRS Publication 5709, A Step-by-Step Guide to Creating a Written Information Security Plan, is a template-based guide the IRS revised in April 2024 specifically to help smaller practices build a compliant plan.

Together, these publications define the framework every compliant preparer should follow. See our breakdown of what a Written Information Security Plan must contain for a section-by-section walkthrough, and our FTC Safeguards Rule checklist for how the rule applies specifically to tax preparers.

A Closer Look at Three Core Sections

1. Designation of a Security Coordinator

Your WISP must name a specific individual, not a role or department, as your Information Security Program Coordinator. This person owns the plan, updates it annually, and is the point of contact during a breach. For a sole proprietor, that is you. For a multi-partner firm, name one partner or office manager with documented authority to enforce the plan firm-wide.

2. Risk Assessment

Your risk assessment must catalog every location, physical and digital, where client personally identifiable information is stored, processed, or transmitted: workstations, laptops, mobile devices, cloud storage, email, file cabinets, and every third-party platform your firm uses. For a small practice, a two-page inventory listing each location and its risks (unauthorized access, theft, hardware failure, ransomware) satisfies the IRS requirement. Update it whenever you adopt a new tool or change infrastructure.

3. Safeguards Implementation

This is the operational core of the plan. The FTC Safeguards Rule and IRS both recognize three categories of safeguards: technical (Multi-Factor Authentication, disk encryption, encrypted email, firewalls), administrative (written access policies, annual training, incident response procedures), and physical (locked filing cabinets, restricted server room access, cross-cut shredding, visitor logs).

Sample Policy Language for Your WISP

The language below is drawn from Publication 5709 requirements and the FTC Safeguards Rule. Replace the bracketed placeholders with your firm's actual tools and practices. A WISP that still reads like a generic template, with no named systems or specific controls, is a compliance failure, not a solution.

Employee training (sample): "All [Firm Name] employees with access to client data must complete information security awareness training within 30 days of hire and annually thereafter, covering phishing identification, password security, secure document handling, and breach reporting. Completion is documented with a signed acknowledgment retained for a minimum of three years."

Vendor management (sample): "[Firm Name] will only share client PII with third-party service providers who have executed a written data security agreement confirming safeguards equivalent to the FTC Safeguards Rule. All vendor agreements are reviewed annually by the Security Coordinator."

Data retention and disposal (sample): "Client records containing PII are retained for a minimum of seven years from the date of filing. Paper records are destroyed by cross-cut shredding or a certified service providing a Certificate of Destruction. Electronic records are deleted using methods conforming to NIST Special Publication 800-88, Guidelines for Media Sanitization."

For incident response language and a breach notification contact list, see our tax firm incident response plan guide.

What the 2024 Revision of Publication 5709 Changed

In April 2024, the IRS released Revision 4 of Publication 5709, reflecting FTC Safeguards Rule requirements that took full effect for tax preparers in 2023. It walks you through each required section as a fillable PDF, and it added explicit language in four areas smaller practices frequently overlook:

• Multi-Factor Authentication: required on any system containing or accessing customer financial data; your WISP must name each system and the authentication method used.
• Encryption in transit and at rest: both are required, and the plan must specify which tools or protocols cover each.
• Access control and least privilege: employees should only access records necessary for their role, including what happens when someone changes roles internally.
• Security event logging: the guidance recommends retaining access logs for a minimum of two years to support incident investigation.

IRS Publication 5708 addresses the procedural side: electronic acknowledgment by staff, version control of revisions, and documentation standards for audits. If your firm also serves business clients in California, Massachusetts, or New York, your WISP may need to incorporate additional state-specific notification requirements layered on top of this federal baseline.

Keeping Your WISP Current

Writing the plan is the easy part. The IRS does not accept a static document filed away and forgotten; a compliant WISP is a living document that evolves with your firm. Schedule a review every year, ideally before tax season, and confirm your Security Coordinator designation, data inventory, vendor agreements, and training records are still accurate.

Beyond the annual review, update the plan whenever a material change occurs: hiring or terminating staff with data access, adopting new software or a cloud platform, moving offices, experiencing a security incident, or a change in federal or state law. If your firm experiences a breach or incident, document it in writing regardless of scale, including the date, the data affected, corrective actions, and notification steps completed. That breach log becomes part of your WISP and shows examiners the program is operational, not theoretical.