CPA WISP Requirements for 2026: What the IRS Actually Checks

WISP requirements apply to every tax preparer, CPA, enrolled agent, and accounting firm that handles client data, not just larger practices. A Written Information Security Plan (WISP) is the written document the FTC and IRS expect to see that describes how your practice protects client information from unauthorized access, disclosure, and misuse.

The obligation traces back to the Gramm-Leach-Bliley Act (GLBA), the 1999 federal law that classifies tax professionals as financial institutions subject to customer data protection rules. The FTC enforces it through the Safeguards Rule (16 CFR Part 314), and the IRS reinforces it through Publication 4557. Your WISP is what a reviewer asks for during a PTIN renewal, an IRS audit, or after a data breach.

Heading into the 2026 filing season, the August 2024 update to IRS Publication 5708 adds specific technical requirements, including universal multi-factor authentication (MFA) and longer minimum passwords, that were previously optional or ambiguous. This guide covers the nine mandatory WISP elements, the 2026 changes to act on now, and the documentation gaps that show up most often in compliance reviews.

Who Must Comply: The 5,000-Consumer Myth

The 5,000-consumer threshold in the FTC Safeguards Rule does not exempt small tax practices from WISP requirements. It only reduces documentation for specific subsections, such as written risk assessment records and incident response testing logs, for firms below that threshold.

Every tax professional who handles customer information, including a solo preparer with a single client, still has to implement all nine elements of an information security program. According to IBM's 2024 Cost of a Data Breach Report, the global average cost of a data breach reached $4.88 million, which is why regulators treat the plan as mandatory rather than optional.

The enforcement point with the most immediate consequence is PTIN renewal. Tax professionals certify compliance with security requirements each time they renew a Preparer Tax Identification Number, and a false certification is fraud under 18 U.S.C. § 1001. See our PTIN renewal next steps guide for what the attestation covers.

The Nine Mandatory WISP Elements

FTC Safeguards Rule §314.4 lists nine required components of an information security program. Reviewers evaluate all nine, and a gap in one element undermines the rest of the plan.

Two elements draw the most findings in reviews: service provider oversight and physical security. A generic vendor agreement without specific cybersecurity language no longer satisfies the requirement.

Physical safeguards are easy to document and easy to skip: locked file storage, screen privacy filters, and controlled visitor access. See our guide to the Qualified Individual requirement for how to structure and document that first element, whether you fill the role yourself or engage an outside specialist.

2026 Updates to IRS Publication 5708

The August 2024 update to IRS Publication 5708 is the most significant WISP change since the FTC's 2021 Safeguards Rule amendments. These changes affect every practice preparing for the 2026 filing season.

The password change is worth flagging because it runs opposite to older habits. NIST SP 800-63B found that frequent forced password changes tend to produce weaker passwords, because people fall back on predictable patterns.

Practices still enforcing 90-day rotations should update the written password policy before the 2026 season starts, not just the technical setting. For the MFA piece, our IRS Tax Pro Account MFA setup walkthrough covers the practical steps.

Common WISP Mistakes That Draw Scrutiny

Reviews increasingly focus on the gap between what a WISP says and what a practice actually does. Four gaps come up most often:

• Treating the WISP as a one-time document instead of reviewing it annually and after any technology or operational change.
• Using a generic template without naming actual systems, vendors, and physical locations.
• Skipping employee training or failing to keep signed attendance records, which counts as no training during a review.
• Leaving physical security out of the plan, including unattended client files, unlocked cabinets, and uncontrolled visitor access, even when technical controls are strong.

Undocumented security activity carries no compliance value during a review. The IRS's standard five-year records retention period is a reasonable minimum for WISP documentation, incident response plans, training logs, and vendor contract reviews.

If a breach does happen, our tax preparer data breach notification requirements guide walks through the state-by-state notification steps regulators expect. Legal questions about your specific exposure belong with your own counsel.

Build the Expertise or Bring In a Specialist

The FTC Safeguards Rule allows a practice to engage a qualified outside specialist to fill the Qualified Individual role and handle service provider oversight, as long as the relationship is documented in a written agreement. That is a legitimate path for a practice without in-house security staff.

The requirement is that this expertise exists and gets applied to the program, not that a practice builds it internally. Bellator Cyber Guard builds a custom WISP starting at $749 for practices with up to 5 users, with larger practices quoted separately. Most firms recoup the cost through the 20 to 40 billable hours saved versus assembling the documentation from scratch. You can also check how your plan lines up against the FTC Safeguards Rule checklist or read the IRS WISP explained overview first.