WISP Documentation Retention Period for Tax Preparers

No federal law sets a specific number of years for how long a tax preparer must keep WISP documentation. The FTC Safeguards Rule (16 CFR Part 314) and IRS Publication 4557 both require tax preparers to maintain a Written Information Security Plan (WISP), the written data security policy covered financial institutions must create under the Gramm-Leach-Bliley Act (GLBA), but neither sets a retention clock for old versions. Instead, both frameworks focus on keeping the plan current and on being able to show its history of updates.

That gap creates real confusion when a firm is preparing for an IRS review or answering a client's data-security questionnaire. Below is what the rules actually require in 2026, what compliance advisors recommend in practice, and a version-control approach that keeps your WISP documentation defensible if a regulator or client ever asks to see it.

The FTC Safeguards Rule, enforced by the Federal Trade Commission under the Gramm-Leach-Bliley Act (GLBA), is a federal regulation requiring covered financial institutions, including tax preparation businesses, to maintain a written information security program and reassess it as the business or its risks change. See the FTC's Safeguards Rule page for the full regulatory text. The rule does not name a document retention period for the WISP itself; its focus is on keeping the plan accurate and acted upon, not on how long old copies sit in a file.

IRS Publication 4557, Safeguarding Taxpayer Data, tells tax professionals to review and update their Written Information Security Plan at least once a year and again after any significant event, such as a new software vendor, a staffing change, or a security incident. The full Publication 4557 guidance and the related IRS WISP requirements in Publication 5708 walk through the required sections but likewise do not state a retention duration for prior drafts.

For comparison, the IRS's general guidance on how long to keep business records typically runs 3 to 7 years depending on the situation. That is the same range most compliance advisors apply to superseded WISP versions by analogy, even though that specific guidance addresses tax records, not security plans. Because neither Safeguards Rule nor Publication 4557 sets a number, firms are left to apply general recordkeeping judgment. That is a documentation gap worth closing with a written retention practice of your own, not a violation waiting to happen.

An auditor or a client's due-diligence questionnaire is less likely to ask how many years back your files go and more likely to ask whether your WISP was actually in effect and followed on a specific date, such as the date of a phishing incident. A single current-version WISP with no history can't answer that question.

Keeping dated versions, along with the risk assessments and training records tied to each one, turns a WISP from a static document into evidence of an ongoing program. That is closer to what the FTC Safeguards Rule and IRS Publication 4557 are actually testing for: a plan that is maintained, not just filed.

Version discipline matters most when something forces a change before your annual review. If you adopt a new e-filing platform, bring on a new vendor, or respond to a security incident, document that change and the resulting WISP revision immediately rather than waiting for the next scheduled review.

The same logic applies to the documents that support your WISP. See this FTC Safeguards Rule incident response plan guide for what belongs in that companion document, and consider a password manager audit as part of the access-control review most WISP updates require.