Written Information Security Plan for Tax & Accounting Firms: What It Is and Why It Matters

April 07, 2025

If you’re a tax preparer handling sensitive client data, having a Written Information Security Plan (WISP) isn’t just a wise precaution—it’s a legal requirement.

A WISP is a documented strategy outlining how your practice protects data. It covers everything from password protocols to breach response plans. Under the FTC Safeguards Rule, tax professionals are required to implement a WISP, and the IRS reinforces this in Publication 4557.

A WISP helps you stay compliant. It reduces risk and protects your business from avoidable cybersecurity issues.

This guide is for tax preparers, small accounting firms, and bookkeepers. It focuses on handling sensitive client data, especially during busy times.

Why WISP Compliance Matters for Tax Preparers

Tax preparers deal with sensitive financial data and personal information. This makes them prime targets for cybercriminals. A WISP ensures you have structured defenses in place, including:

Access management policies
Employee training protocols
Encryption standards
Backup and recovery processes
Incident response procedures

A small breach or downtime during tax season can harm your reputation, disrupt your business, and affect compliance.

What Goes Into a WISP—And How to Start Without Getting Overwhelmed

While every WISP should be customized, here are the most common components:

Risk Assessment – Where are your vulnerabilities?
Physical Safeguards – Locked doors, restricted access to devices.
Technical Safeguards – Firewalls, encryption, and multi-factor authentication.
Administrative Safeguards – Employee policies, vendor vetting, usage rules.
Monitoring & Response – How will you detect and respond to incidents?
Annual Review – Plans should be reviewed and updated regularly.

You don’t need to be an IT expert to create a compliant WISP. Many state CPA societies and professional associations offer free templates as a starting point.

How to Build Your Firm’s WISP (in 5 Steps)

Creating a WISP doesn’t have to be overwhelming. Start with these basic steps:

Download a reputable WISP template (from your state CPA society or IRS-aligned resource).
Map out your technology stack—including cloud providers, tax applications, and storage devices.
Document safeguards already in place and identify gaps (e.g., no encryption or backups).
Assign responsibility—even in a solo practice, define who manages updates and documentation.
Update your plan annually and train employees or contractors on what’s required.

Not sure if your current plan is up to par? Download the WISP Compliance Checklist to self-assess in just 2 minutes.

What Happens When Firms Get It Right

Affordable Client Write-Up LLC reduced downtime from two weeks to a few hours. They did this by using a structured and compliant IT environment that matches their Written Information Security Plan.

Golden Tax Relief dodged a ransomware threat. They did this by using daily encrypted backups and quick disaster recovery plans. These actions support their WISP needs.

Bookkeeping Solutions of Traverse City moved over 25 programs and 250GB of data. They also boosted security and uptime using a WISP-driven approach.

Common Questions About WISP Compliance

What is a Written Information Security Plan?
A WISP is a written guide that shows how a tax preparer or accounting firm keeps client data safe. It includes rules and steps for using administrative, technical, and physical protections.

Is a WISP required for tax professionals?
Yes. Under the FTC Safeguards Rule, any business that handles client financial data, including solo tax preparers, must have a WISP.

How do I create a WISP for my tax practice?
Begin with a downloadable template from CPA societies or IRS resources. Then, adjust it to fit your software, access controls, and daily operations.

Does the IRS require a WISP?
The IRS recommends it in Publication 4557 and aligns with FTC mandates for protecting taxpayer data.

Can I write my own WISP without technical experience?
Yes. Most tax preparers can complete a WISP using basic templates and minimal input from an IT partner.

How often should a WISP be updated?
At least annually, or after major changes to your tech, staffing, or file systems.

Does secure cloud hosting help with WISP compliance?
Yes. Hosting providers with SOC 2 certification, encryption, secure access, and 24/7 monitoring can meet many WISP needs.

Want to Learn More?

Discover how secure cloud environments aid WISP compliance for tax professionals. Explore Verito's IT consultations that focus on compliance.

Don’t leave your compliance to chance.
Download the WISP Compliance Checklist. It helps you find gaps and boost client data protection.