A WISP is an operating plan, not a shelf document
Tax and accounting practices hold Social Security numbers, income records, bank details, business financials, identity documents, and authorization records. The IRS warns that criminals target tax professionals because access to this information can support fraudulent returns and identity theft.
The IRS states that federal law requires tax professionals to create, implement, and maintain an information security plan, regardless of firm size. IRS Publication 5708 explains that tax and accounting professionals are treated as financial institutions under the Gramm-Leach-Bliley Act and the Federal Trade Commission's Safeguards Rule. The FTC says a covered business's information security program must be written and appropriate to its size, complexity, activities, and the sensitivity of the information involved.
This article explains a practical starting structure, but it does not determine whether a particular entity is covered or whether a plan satisfies every applicable requirement. Firms should confirm current obligations with qualified legal, compliance, insurance, and security professionals.
1. Name the qualified individual and decision owners
The FTC Safeguards Rule calls for a Qualified Individual to implement and supervise the information security program. The FTC explains that this person may be an employee, affiliate, or service provider and does not need a particular title or degree; the necessary expertise should fit the organization's circumstances.
The written plan should identify the Qualified Individual and the people responsible for technology, office operations, vendor management, training, incident response, and executive decisions. If an outside IT provider performs technical work, the firm still needs an internal owner who can approve priorities, review evidence, and connect technology decisions to client-data obligations.
Document alternates. A Central Florida practice should not depend on one person being available during filing deadlines, a hurricane, illness, or vendor outage.
2. Describe the practice and the information it handles
Start with a plain-language profile of the firm: locations, remote staff, seasonal workers, services, client types, major software, cloud providers, physical files, and third parties. Then map where customer information is collected, transmitted, processed, stored, archived, and destroyed.
Include:
- Tax preparation and document-management systems.
- Email, messaging, portals, e-signature, and file-transfer services.
- Laptops, desktops, phones, removable media, printers, and scanners.
- Local servers, network storage, Wi-Fi, firewalls, and remote access.
- Paper files, mail handling, off-site storage, and shredding.
- Payroll, bookkeeping, payment, banking, and practice-management systems.
- Vendors that can access systems or client information.
- PTIN, EFIN, CAF, e-Services, and other tax-administration accounts.
Do not assume cloud data is entirely the provider's responsibility. Record which safeguards belong to the provider and which remain the firm's responsibility, including identities, permissions, devices, retention, sharing, and recovery.
3. Perform and document a risk assessment
Identify reasonably foreseeable internal and external risks to customer information. Consider phishing, stolen credentials, excessive access, lost devices, malicious insiders, unsupported software, unsafe remote work, insecure portals, vendor compromise, ransomware, physical theft, fire, water, and prolonged utility or internet outages.
For each risk, record the information and systems affected, existing safeguards, likelihood, potential impact, owner, treatment decision, deadline, and evidence of completion. A short prioritized register that the firm actually reviews is more useful than a long generic list copied from a template.
Revisit the assessment when the firm adds a location, changes tax software, hires seasonal staff, adopts AI or automation, changes vendors, experiences an incident, or learns of a significant threat.
4. Define safeguards that can be verified
A WISP should connect each safeguard to an owner and proof. Examples include:
Identity and access
Require multifactor authentication where available, especially for email, tax software, portals, remote access, cloud storage, financial accounts, and administrator roles. Use unique accounts, remove departed users promptly, limit administrator rights, and review access before and after filing season.
Devices and networks
Maintain supported operating systems and applications, automatic security updates, centrally managed endpoint protection, encryption for portable devices, secured Wi-Fi, and separated guest access. Define who can install remote-access software and how unauthorized tools are detected.
Data handling
Use approved client portals or secure transfer methods instead of ordinary email attachments for sensitive records. Limit local downloads, define retention, protect exports, and use secure destruction for electronic and paper information.
Backups and recovery
Back up critical information, separate recovery administration from everyday accounts, and test representative restores. Record what was restored, when, by whom, how long it took, and what failed. A successful backup notification alone is not evidence of recoverability.
Physical safeguards
Control office, file-room, server, printer, and mail access. Address visitor handling, keys, alarms, clean-desk expectations, secure disposal, and protection of records during office closure or severe weather.
5. Manage service providers
List providers that receive or can access customer information and record the service, data, access path, contract owner, security contact, renewal date, and termination process. Conduct due diligence appropriate to the risk.
Contracts and reviews should address safeguards, incident notification, access control, subcontractors, data location where relevant, retention, return or deletion, recovery, and support during an incident. A vendor's marketing statement or compliance badge does not replace the firm's own review of responsibilities.
When a relationship ends, remove accounts, tokens, integrations, remote access, shared links, and stored credentials. Confirm return or destruction of data when required.
6. Train employees and seasonal staff
Training should match the work people actually perform. Cover phishing, unexpected client files, payment or direct-deposit changes, account-recovery requests, secure portals, multifactor prompts, remote work, paper records, lost devices, and incident reporting.
New and seasonal staff should receive training before they access customer information. Repeat training periodically and when threats or procedures change. Record attendance, topics, dates, and follow-up actions. Employees should know that reporting a mistake quickly is more valuable than hiding it.
7. Write the incident-response section before it is needed
The FTC says covered businesses need a written incident-response plan addressing the goals, internal processes, roles, communications, remediation, documentation, and review associated with a security event.
For a tax practice, the plan should include the Qualified Individual, firm leadership, IT or security provider, legal counsel, cyber insurer, software vendors, local law enforcement, and the IRS reporting path. The IRS directs tax professionals experiencing data theft to contact their local IRS Stakeholder Liaison promptly, because timely reporting may help the IRS block fraudulent returns.
Keep an offline contact list and decision-log template. Define who preserves evidence, isolates systems, contacts vendors, evaluates notification duties, communicates with clients, and authorizes restoration. Do not improvise public statements or assume every suspicious event is a reportable breach; establish facts and obtain qualified advice.
8. Monitor, test, and improve the program
Schedule reviews rather than waiting for an incident. Evidence might include access-review records, patch reports, endpoint coverage, phishing-test results, restore tests, vendor reviews, training logs, incident exercises, and corrective-action tickets.
A useful annual cycle for a small Central Florida practice can include:
- Before filing season: access review, seasonal-staff onboarding, restore test, portal validation, and contact-list update.
- During filing season: alert review, phishing reminders, rapid offboarding, and monitoring for abnormal e-file activity.
- After filing season: remove temporary access, archive records, review incidents, reassess vendors, and prioritize improvements.
- Before hurricane season: validate remote operations, alternate communications, safe equipment shutdown, and off-site recovery access.
The FTC emphasizes keeping the program current as operations, threats, personnel, and other material circumstances change. Version the WISP, record approvals, and preserve evidence of reviews and completed improvements.
A concise WISP readiness checklist
Before approving the plan, confirm that it identifies:
1. The Qualified Individual and alternates.
2. Systems, locations, customer information, and service providers.
3. A current documented risk assessment.
4. Safeguards, owners, deadlines, and proof of operation.
5. Employee and seasonal-worker training.
6. Vendor selection, oversight, and termination procedures.
7. A written incident-response and communications process.
8. IRS, legal, insurer, provider, and law-enforcement contacts.
9. Testing, monitoring, review dates, and corrective actions.
10. Approval, version history, and the next scheduled review.
IRS Publication 5708 provides sample material for smaller practices, but it expressly says it is not exhaustive or a substitute for a plan tailored to the firm. The strongest WISP is not the longest one. It is the plan that accurately describes the practice, assigns responsibility, produces evidence, and changes when the business changes.
This article is educational and is not legal, regulatory, tax, accounting, insurance, or incident-response advice.