Start your tax-practice security program with a free WISP template.
The FTC Safeguards Rule requires covered firms to maintain a written information security program. Use this editable template as a practical structure, then tailor it to your firm’s safeguards, people, and systems.
Turn your safeguards into a firm-specific program
A complete example plan arrives instantly as an editable Word document and PDF, structured section by section.
A useful WISP reflects your real practice. Every section arrives pre-written, so your work is naming your people, your systems, and the safeguards you actually use.
Keep it with your records, review it regularly, and update it when your people, systems, or safeguards change.
Inside the editable WISP template
The template provides a practical starting structure for a firm-specific information security program, with clear places to add the safeguards and procedures your practice actually uses.
What the FTC Safeguards Rule actually requires
The Safeguards Rule is an FTC rule under the Gramm-Leach-Bliley Act. Covered firms must maintain a written information security program that includes risk assessment, safeguards, staff training, service-provider oversight, incident response, and periodic evaluation.
Publication 4557 is IRS guidance for safeguarding taxpayer data. This template helps organize a firm-specific plan around those concepts; it is a starting point, not a certification or a substitute for legal or security advice.
Built for tax-preparer workflows
Start with a usable structure instead of a blank page. The template organizes the planning areas so you can focus on the details of your own practice.
Make the document firm-specific. Identify your responsible people, technology, data-handling practices, and review schedule before you approve it.
Common questions about the FTC Safeguards Rule
Tax-preparation firms can be covered financial institutions under the rule. Applicability and the measures appropriate for your firm depend on its activities and how it handles customer information, so obtain firm-specific advice when needed.
Key elements include a responsible person, risk assessment, safeguards for customer information, staff training, service-provider oversight, incident response, and periodic evaluation. This template offers a structure for documenting how those concepts apply to your firm.
Smaller firms may have different obligations or exceptions under the rule. Confirm your firm’s responsibilities rather than relying on a generic page or template as legal advice.
A firm-specific WISP can be part of a written information security program. It must reflect your real safeguards and be reviewed against the requirements that apply to your firm.
A written security program helps a firm organize and document its protection of customer information. If you need advice on your firm’s legal duties or risk posture, consult an appropriate professional.
Start with a plan built for your practice.
Download the editable WISP template and tailor it to how your firm protects customer information.
Get My Free WISP Template →Free template · No credit card · Instant download