CPA WISP Requirements for 2026: What the IRS Actually Checks

WISP requirements apply to every tax preparer, CPA, enrolled agent, and accounting firm that handles client data, not just larger firms. The requirement traces back to the Gramm-Leach-Bliley Act (GLBA), a 1999 federal law that classifies tax professionals as financial institutions subject to customer data protection rules. The FTC enforces that obligation through the Safeguards Rule (16 CFR Part 314), and the IRS reinforces it through Publication 4557. A Written Information Security Plan (WISP) is the documentation regulators expect to see during a Preparer Tax Identification Number (PTIN) renewal, an IRS audit, or after a data breach.

Heading into the 2026 filing season, the August 2024 update to IRS Publication 5708 adds specific technical requirements, including universal multi-factor authentication (MFA) and longer minimum password lengths, that were previously optional or ambiguous. This guide covers the nine mandatory WISP elements, the 2026 changes to act on now, and the documentation gaps that show up most often in compliance reviews.

Who Must Comply: The 5,000-Consumer Myth

The 5,000-consumer threshold in the FTC Safeguards Rule does not exempt small tax practices from WISP requirements. It only reduces documentation for specific subsections, such as written risk assessment records and incident response testing logs, for firms below that threshold. Every tax professional who handles customer information, including a solo preparer with a single client, still has to implement all nine elements of an information security program.

The enforcement point with the most immediate consequence is PTIN renewal. Tax professionals certify compliance with security requirements each time they renew a Preparer Tax Identification Number, and a false certification is fraud under 18 U.S.C. § 1001. See our PTIN renewal next steps guide for what the attestation covers, and our WISP penalties breakdown for the range of civil and state-level exposure beyond PTIN risk.

The Nine Mandatory WISP Elements

FTC Safeguards Rule §314.4 lists nine required components of an information security program. Regulators evaluate all nine during a review, and a gap in one element undermines the rest of the plan.

Two elements draw the most findings in compliance reviews: service provider oversight and physical security. A generic vendor agreement without specific cybersecurity language no longer satisfies the requirement. Physical safeguards, locked file storage, screen privacy filters, and controlled visitor access, are easy to document and easy to skip. See our Qualified Individual requirement guide for how to structure and document that first element, whether you fill the role yourself or engage an outside specialist.

2026 Updates to IRS Publication 5708

The August 2024 update to IRS Publication 5708 is the most significant WISP change since the FTC's 2021 Safeguards Rule amendments. Four changes affect every practice preparing for the 2026 filing season.

The password change is worth flagging because it runs opposite to older habits. NIST SP 800-63B found that frequent forced password changes tend to produce weaker passwords, since people fall back on predictable patterns. Practices still enforcing 90-day rotations should update the written password policy before the 2026 season starts, not just the technical setting. For the MFA piece, see our two-factor authentication guide for tax pros.

Common WISP Mistakes That Draw Scrutiny

Compliance reviews increasingly focus on the gap between what a WISP says and what a practice actually does. Four gaps come up most often:

• Treating the WISP as a one-time document instead of reviewing it annually and after any technology or operational change.
• Using a generic template without naming actual systems, vendors, and physical locations.
• Skipping employee training or failing to keep signed attendance records, which counts as no training during a review.
• Leaving physical security out of the plan, unattended client files, unlocked cabinets, uncontrolled visitor access, even when technical controls are strong.

Undocumented security activity carries no compliance value during a review. The IRS's standard five-year records retention period is a reasonable minimum for WISP documentation, incident response plans, training logs, and vendor contract reviews included. If a breach does happen, our tax professional data breach response guide walks through the notification steps regulators expect.

Build the Expertise or Bring In a Specialist

The FTC Safeguards Rule allows a practice to engage a qualified outside specialist to fill the Qualified Individual role and handle service provider oversight, as long as the relationship is documented in a written agreement. That is a legitimate path for a practice without in-house security staff. The requirement is that this expertise exists and gets applied to the program, not that a practice builds it internally.