WISP Planning: A Step-by-Step Guide for Tax Preparers

WISP planning is the work you do before you write a Written Information Security Plan (WISP): mapping what taxpayer data you hold, where it lives, who can access it, and which vendors touch it. A WISP is a written document, required under the FTC Safeguards Rule, that describes how your tax practice protects client financial data. Skipping the planning step is the most common reason a WISP ends up as a generic form that does not match how the firm actually operates, which creates a documentation gap if a regulator, insurer, or client ever asks to see it.

If you run a tax preparation business, even a one-person shop, you likely qualify as a "financial institution" under the Gramm-Leach-Bliley Act (GLBA), the federal law that put the Safeguards Rule in place. That means the planning and documentation obligation applies regardless of your firm's size.

Who Has to Plan for a WISP

The FTC Safeguards Rule applies to non-banking financial institutions, and the FTC's own guidance names tax preparation services as an example. If you prepare returns for a fee, this rule reaches you whether you have one employee or fifty. The IRS reinforces this in Publication 4557, Safeguarding Taxpayer Data, which tax professionals have been expected to follow for years, and the IRS Security Summit repeats the WISP requirement at the start of every filing season.

You can read the full written information security plan requirements for background on what the document itself must contain. This article focuses on the planning work that comes before you draft it, including the gaps most firms miss around IRS WISP requirements for tax professionals handling W-9 forms and other client records.

What Your Planning Needs to Cover

Before you write a single section of the plan, gather the information the document will need to reference accurately:

• Data inventory: every place client Social Security numbers, bank account numbers, and tax documents are stored, including cloud drives, email, and tax software
• Access controls: who can reach that data, whether multi-factor authentication (MFA) is required, and how access is removed when someone leaves
• Vendor list: tax software, e-file providers, document portals, and IT support, since the Safeguards Rule requires oversight of service providers
• Incident response steps: who gets notified and in what order if a laptop is lost or an account is compromised
• Disposal procedures: how paper and electronic records are destroyed once retention periods end, covered in our guide to secure data destruction requirements for tax preparers

Most of the risk in a tax practice traces back to two things: weak or missing MFA, and phishing emails that trick staff into handing over credentials. Your planning should confirm MFA status across every system, starting with your IRS Tax Pro Account MFA setup, and account for staff exposure to phishing attacks on tax professionals, which remain the leading way tax data gets stolen each filing season.

How Long WISP Planning Takes

Building a WISP from a blank page, including the planning steps above, commonly takes a solo preparer or small firm somewhere in the range of 20 to 40 billable hours when done without a structured starting point: time spent researching the Safeguards Rule, drafting language, and revising sections that do not match how the firm actually works. Using the IRS WISP template as a starting structure cuts that time significantly, but the template still requires the planning inputs above to fill in correctly. A template without an accurate data and vendor inventory behind it is the boilerplate problem the FTC guidance warns against.

Bellator Cyber Guard builds a custom WISP for tax practices starting at $749 for up to 5 users, with larger practices quoted separately. That price covers a plan built from your actual systems and vendors, not a generic fill-in form, which is the gap that causes problems when a plan gets reviewed later.