Tax cybersecurity questions answered

A Written Information Security Plan (WISP) is a formal document that describes how your tax practice protects sensitive taxpayer information. The IRS requires all tax professionals with a PTIN to maintain a WISP under IRS Publication 4557 and the FTC Safeguards Rule. It serves as both your compliance documentation and your operational playbook for data security. Without one, you are in violation of federal regulations and at significant risk if audited or breached.

Your WISP must include nine key components: a designated security officer, a documented risk assessment, administrative and technical and physical safeguards, employee management and training procedures, information systems management policies, detection and monitoring procedures, data retention and disposal policies, an incident response plan, and a schedule for annual review and updates. Each section must be specific to your practice rather than generic boilerplate.

The IRS and FTC require you to review and update your WISP at least annually. You should also update it whenever there is a material change in your business operations, such as adding new staff, changing technology systems, moving offices, or identifying new threats. Each update should be dated and documented to show regulators that your WISP is a living document.

Templates are an excellent starting point and are perfectly acceptable to the IRS, provided you customize them to reflect your specific practice. A generic template that has not been tailored to your actual systems, workflows, and risks will not hold up under audit. Our free WISP template is designed to be customized in under two hours and covers all required sections.

A WISP is more comprehensive than a typical data security policy. While a security policy might address password rules or acceptable use, a WISP encompasses your entire information security program including risk assessment, safeguards implementation, employee training, incident response, and ongoing management. Your data security policies are components within your broader WISP.

The five most critical controls are: multi-factor authentication on all accounts that access taxpayer data, endpoint detection and response software on every workstation, encrypted backups tested regularly for successful restoration, email security including phishing filtering and encryption, and employee security awareness training with simulated phishing. These controls address the most common attack vectors targeting tax practices.

Never send taxpayer documents via unencrypted email. Use a secure client portal with encryption in transit and at rest, multi-factor authentication for client access, and audit logging. Avoid consumer file-sharing services like personal Dropbox or Google Drive accounts. Purpose-built tax portals or encrypted file-sharing platforms designed for financial services are the appropriate choice.

Act immediately. Isolate affected systems by disconnecting them from the network. Do not turn them off, as forensic evidence may be lost. Contact your incident response team or a cybersecurity professional. Notify your local IRS Stakeholder Liaison. Begin your documented incident response plan. Preserve all logs and evidence. Notify affected clients as required by your state breach notification law. Document every step you take and when you take it.