WISP for Small Tax Firms: Simplified Compliance Guide

A WISP for tax preparers is the Written Information Security Plan required by the FTC Safeguards Rule (16 CFR Part 314) and IRS Publication 4557 for any practice that handles taxpayer data. Every tax preparer who holds a Preparer Tax Identification Number (PTIN) must keep one on file, whether the firm files 11 returns a year or 11,000.

The Gramm-Leach-Bliley Act (GLBA), a 1999 federal law that classified tax preparation businesses as financial institutions, is why a security plan is a legal requirement rather than a best practice. Tax preparers handle Social Security numbers, bank account details, income records, and complete family financial histories, which makes small firms a steady target for ransomware operators and identity thieves.

This guide covers what a WISP for tax preparers must include for the 2026 filing season, including the mandatory multi-factor authentication requirement the IRS added in August 2024.

Why a WISP Is Legally Required

Three overlapping federal rules require a written security plan for a small tax firm: the Gramm-Leach-Bliley Act, the FTC Safeguards Rule, and IRS enforcement tied to PTIN and Electronic Filing Identification Number (EFIN) licensing.

GLBA, passed in 1999, defined "financial institution" broadly enough to include tax preparation businesses, which put solo preparers and small CPA firms under the same data protection standard as banks and credit unions. The FTC implements that law through the Safeguards Rule (16 CFR Part 314). Its December 2022 amendments turned general principles into documented requirements: a designated qualified individual, a periodic written risk assessment, administrative and technical safeguards, ongoing testing, and an incident response plan.

The IRS adds enforcement weight through its Security Summit initiative. IRS Publication 4557, Safeguarding Taxpayer Data, sets the IRS's expectations, and Form W-12 PTIN renewal applications now require practitioners to confirm a written plan is in place. The IRS can revoke PTIN and EFIN credentials for noncompliant practitioners, ending their ability to prepare returns professionally. See our PTIN renewal requirements for 2026 for what to expect at renewal time.

What the FTC Safeguards Rule Requires

The Safeguards Rule identifies six interconnected components: governance (who is responsible), a risk assessment (what threats exist), administrative safeguards (how people handle data), technical safeguards (how technology protects data), physical safeguards (how facilities and equipment are secured), and incident response (how you detect, contain, and report events).

IRS Publication 4557 offers a useful checklist for orientation, but the actual document has to go further: describe your specific systems, vendors, employees, and risk assessment findings. Generic language that could describe any firm will not hold up if a regulator reviews your plan after a breach.

Your risk assessment, required by both the Safeguards Rule and the NIST Cybersecurity Framework, a voluntary set of standards published by the National Institute of Standards and Technology, should inventory every system touching taxpayer data and document why you chose each safeguard.

Administrative Safeguards: Policies and People

Administrative safeguards are the policy rules your WISP documents and enforces, covering employee management, vendor oversight, and operational procedures. Regulators look at these first because they show whether security is actually managed or just claimed on paper.

The Safeguards Rule requires appointing a coordinator with the expertise to run the program. In a solo practice, that is usually the owner. In a multi-professional firm, it might be an office manager or outside IT consultant. Our guide to the qualified individual requirement covers what regulators expect from this role, including an annual review date and quarterly access reviews.

Access control should follow least privilege: employees reach only what their job requires. Termination procedures deserve equal attention: revoke system access on the employee's last day, collect devices and credentials, change any shared passwords they knew, and review recent access logs for unusual activity.

Technical Safeguards: MFA, Encryption, and EDR

Technical safeguards are the technology controls that prevent, detect, and respond to unauthorized access. Your plan should specify which controls are deployed, where, and who maintains them.

Every device that touches taxpayer data needs endpoint protection beyond traditional antivirus. Endpoint Detection and Response (EDR), a category of tool that adds behavioral monitoring and automated response that signature-based antivirus misses, is specifically recommended in IRS Publication 4557.

Outsourcing that monitoring to a managed provider can satisfy the Safeguards Rule's ongoing-monitoring requirement more affordably than building an internal security team; our managed protection plan comparison breaks down what different levels of coverage include. Document whichever approach you use, including the vendor's name and your contractual incident-notification terms.

Encrypt every device that stores or accesses taxpayer information. Windows BitLocker and macOS FileVault both provide AES-256 encryption at no added cost. For data in transit, confirm your tax software and client portal use TLS 1.2 or higher.

The August 2024 Publication 5708 update made MFA mandatory for all system access, not just remote logins. Turn it on for tax software, email, cloud storage, VPN, and any administrative interface touching client data. Our IRS Tax Pro Account MFA setup guide walks through configuration for the accounts tax preparers use most.

Physical Safeguards: Facilities and Paper Records

A strong digital security program can be undone by an unlocked server room, documents left out during a client visit, or paper thrown away unshredded. The Safeguards Rule calls out physical safeguards specifically, and treating them as secondary to technical controls is a common gap regulators notice.

Lock doors to server rooms, records storage, and back-office areas. Require visitors to sign in and stay escorted, which matters most during the high-traffic weeks of filing season. Set screen locks to activate after five to ten minutes of inactivity, and use a clean-desk policy so documents go into locked drawers whenever an employee steps away.

Document disposal is not optional. The IRS has documented identity theft cases that started with improperly discarded paperwork.

Put cross-cut shredders in every area where staff handle client documents, and use a certified destruction service for high-volume shredding. Our guide to secure data destruction requirements covers the destruction standards to name in your plan.

Vendor Management: Documenting Third-Party Risk

Tax practices rely on a range of vendors: tax software, cloud storage, email hosting, practice management systems, IT support, and document management. Every vendor with access to taxpayer data extends your attack surface and your regulatory exposure.

The Safeguards Rule requires selecting qualified providers and contractually obligating them to safeguard client data, which makes vendor management a documented requirement, not a courtesy. Start with an inventory: who the vendor is, what data they can reach, what security commitments they've made, and when you last reviewed their posture.

Incident Response: Detection Through Recovery

Preventive controls reduce risk, they don't eliminate it. Regulators treat a firm with a documented, imperfect response plan more favorably than one with no plan at all, because the plan shows good faith.

Define what counts as an incident in your WISP: confirmed or suspected unauthorized access, malware or ransomware, lost or stolen devices, compromised employee credentials, and vendor breaches affecting your clients' data.

Response follows a sequence: detect and report to your designated security officer, contain by isolating affected systems and disabling compromised accounts, investigate what was accessed and how, and recover by restoring from clean backups before returning to operations. Our incident response plan guide for tax preparers covers how to document each stage.

A WISP Is a Living Document

A WISP that sits untouched after year one will not hold up to a regulator's review. Update the risk assessment, revise controls that didn't work, and reflect changes in staff, vendors, and technology at least once a year, with a dated and signed version for your records.