IRS WISP Requirements Explained
The IRS requires every tax professional to maintain a Written Information Security Plan. Here is exactly what you need to include.
By the Numbers
What IRS WISP Requirements Covers
Risk Assessment
Document all potential threats to taxpayer data including digital, physical, and insider risks.
Access Control Policies
Define who can access taxpayer data, authentication requirements, and role-based permissions.
Employee Management
Background checks, security training, and acceptable use policies for all staff.
Incident Response
Written procedures for detecting, responding to, and reporting data breaches.
Data Management
Encryption, backup, retention, and secure disposal procedures for taxpayer information.
Monitoring & Updates
Ongoing system monitoring, vulnerability scanning, and annual WISP review protocols.
How to Get Started
Inventory Taxpayer Data
Catalog all systems, devices, and locations where taxpayer data is stored or processed.
Identify Threats
Assess risks from phishing, malware, physical theft, employee error, and third-party vendors.
Document Safeguards
Write policies addressing each IRS-required area: access, encryption, training, disposal.
Implement & Review
Deploy security controls and schedule annual reviews to keep your WISP current.
Ready-to-Use WISP Template
Our free template covers every IRS requirement. Just customize it for your practice and you are compliant.
Frequently Asked Questions
A WISP (Written Information Security Plan) is a formal document required by the IRS that outlines how your tax practice protects taxpayer data from unauthorized access, theft, or loss.
The FTC Safeguards Rule has required WISPs since 2003, and the IRS reinforced this requirement specifically for tax professionals through Publication 4557 and Revenue Procedure 2007-40.
You can write your own WISP using our free template as a starting point. The key is ensuring it covers all required areas and is customized to your specific practice.
Penalties can include IRS sanctions, EFIN revocation, FTC enforcement actions, state regulatory fines, and personal liability in the event of a data breach.
Protect your tax practice from cyber threats
Schedule a free consultation to assess your firm's security posture.