Accounting Firm WISP Template Examples & Guide 2026

A free WISP template gives you the required section headings, but on its own it will not satisfy IRS Publication 4557 or the FTC Safeguards Rule. The IRS publishes a genuine sample plan in Publication 5708, and it is a legitimate place to begin. A Written Information Security Plan (WISP) is the written, firm-specific document that identifies the risks to your clients' data and the controls you use to protect it.

The requirement applies to every tax preparer and accounting firm regardless of size or return volume. A document left full of placeholder firm names and generic risk language does not meet it, and reviewers recognize an unmodified template on sight. This guide walks through what the free template covers, what you still have to build, and the sections IRS Publication 4557 and the FTC Safeguards Rule actually require for 2026.

Accounting and tax firms are high-value targets because a single client file holds Social Security numbers, bank account numbers, and years of income history. According to the IRS Security Summit, tax professionals reported more than 1,200 data theft incidents during the 2025 filing season, roughly 20 percent above the prior year.

Where the Free IRS Template Starts, and Where It Stops

IRS Publication 5708, the Written Information Security Plan Template for Tax Professionals, gives you the section headings the IRS expects: an Information Security Coordinator designation, an employee training section, a risk assessment outline, and incident response steps. It is free, immediately downloadable, and reflects the structure a reviewer looks for.

What it does not include is your firm's actual systems, staff names, vendor list, or a completed risk assessment. IRS Publication 4557, Safeguarding Taxpayer Data, and the FTC Safeguards Rule both require the plan to reflect your specific environment, not a sample document.

Three Rules Make This Document Mandatory

IRS Publication 4557 states that every tax preparer must create and maintain a WISP identifying risks to client data and the controls used to address them. It points to the FTC Safeguards Rule, part of the Gramm-Leach-Bliley Act, as its legal basis.

Under the FTC Safeguards Rule, effective for most provisions since June 2023, financial institutions covered by the Gramm-Leach-Bliley Act, including tax return preparers, must designate a qualified individual to oversee the security program, complete a written risk assessment, implement access controls and encryption for customer financial data, and train staff with access to that data. Our guide to the FTC Safeguards Rule qualified individual requirement explains how to fill that role, and the IRS WISP requirements page breaks down what the plan must contain.

Preparers with a Preparer Tax Identification Number (PTIN) operate under IRS oversight that extends to data security, and the IRS treats a current WISP as part of keeping that PTIN registration in good standing. NIST Special Publication 800-171, written for federal contractors, is not a requirement for accounting firms, but many templates borrow its control families because they map cleanly onto FTC expectations.

Four Gaps a Downloaded Template Leaves Open

A free template only causes problems when firms stop at downloading it. Many practices file Publication 5708 with placeholder names and generic risk descriptions still in place, and that is the first thing a reviewer notices.

The second gap is staleness. The FTC Safeguards Rule requires periodic review and an update after any security incident, so a WISP written in 2022 that ignores a move to cloud storage or a new remote hire no longer describes reality. The third gap is remote and seasonal staff: if anyone touches taxpayer data outside the office, the plan needs explicit remote-access controls, not an assumption that office policy covers it.

The fourth is vendor management. If you use a cloud tax platform, a client portal, or an outside IT provider, your WISP has to document how you vetted that vendor and how you monitor it, referencing certifications like SOC 2 Type II or ISO 27001 where the vendor holds them. Firms exchanging documents with clients should fold their file-sharing and portal procedures into the same risk assessment.

Name a Product and an Owner for Every Control

Whichever template you start from, reference each item in the IRS Security Six directly and assign a named owner to each one: anti-virus or endpoint protection, a firewall, multi-factor authentication, drive encryption, data backup and recovery, and phishing awareness training. A WISP that says your firm "uses endpoint protection" is weaker than one that names the product, says who monitors alerts, and describes how deprovisioning works when someone leaves.

Once the plan is written, it has to be operational. The FTC Safeguards Rule evaluates whether the program is implemented, not whether the document exists. That means configuring systems to enforce MFA rather than writing that MFA is required, and documenting training completion rather than assuming staff read the policy.

If you run a solo practice, the free IRS template plus a genuine risk assessment can be enough when you do the customization honestly. If you have multiple staff, remote workers, or several cloud vendors, the documentation work grows quickly, and that is where a built-for-you plan saves the 20 to 40 billable hours most firms spend getting a template to reflect reality. For a plain-English walkthrough aimed at smaller practices, see our guide to a WISP for small and medium businesses.