Is a WISP required for tax preparers?

Yes. The IRS says federal law requires tax and accounting professionals to create and maintain a written information security plan. The requirement comes from the FTC Safeguards Rule, which treats tax preparation services as financial institutions.

Does the IRS have a WISP template?

Yes. IRS Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice (Rev. 8-2024), includes a sample template with seven sections, from Objective to Implementation.

What must a WISP include?

It documents a program meeting 16 CFR 314.4: a Qualified Individual, a risk assessment, safeguards including encryption and multi-factor authentication, testing or monitoring, staff training, service-provider oversight, ongoing adjustment, an incident response plan, annual reporting, and FTC breach notification. Firms with customer information on fewer than 5,000 consumers are exempt from four specific requirements: the written risk assessment, penetration testing and vulnerability assessments, the written incident response plan, and the annual report.

Do small firms need a WISP?

Yes. IRS Publication 5708 says tax and accounting professionals are financial institutions regardless of size. Firms with customer information on fewer than 5,000 consumers are exempt only from the written risk assessment, penetration testing and vulnerability assessments, the written incident response plan and annual board reporting.

When do you have to report a data breach to the FTC?

When a notification event, meaning unauthorized acquisition of unencrypted customer information, involves at least 500 consumers. Notify the FTC as soon as possible and no later than 30 days after discovery, using the FTC's online form. The requirement took effect May 13, 2024.

Do AI tools need to be in the WISP?

A vendor that receives, maintains or processes customer information is a service provider the Safeguards Rule requires you to select carefully, bind by contract and periodically assess. Listing AI tools in the plan, with the accounts and data staff may use with them, is one way to document that oversight.

Written information security plan (WISP) for tax preparers and accounting firms

The IRS says federal law requires tax and accounting professionals to create and maintain a written information security plan, or WISP. The requirement comes from the FTC Safeguards Rule, which names "an accountant or other tax preparation service that is in the business of completing income tax returns" as a financial institution. Here is what the rule requires, what the IRS's sample template in Publication 5708 covers, and how software and AI vendors fit into the plan. This is a summary, not legal advice.

Guide. Updated October 15, 2026. By AI Accounting Vendors. 7-minute read.

Key points

Who needs one: Under the Gramm-Leach-Bliley Act and the FTC Safeguards Rule, IRS Publication 5708 says tax and accounting professionals are financial institutions "regardless of size."
Why: Publication 5708: "A requirement of the Safeguards Rule is implementing and maintaining a WISP."
The template: IRS Publication 5708 (Rev. 8-2024) is a sample WISP for tax and accounting practices, built with the Security Summit.
Breach reporting: Since May 13, 2024, a notification event involving 500 or more consumers must be reported to the FTC within 30 days of discovery.

Who needs a WISP

The FTC Safeguards Rule (16 CFR Part 314) applies to non-bank financial institutions. The rule's own examples include "an accountant or other tax preparation service that is in the business of completing income tax returns" (16 CFR 314.2 (opens in a new tab)), and the FTC lists tax preparation firms among the covered entities (FTC guidance (opens in a new tab)).

The IRS states the conclusion plainly. Its August 18, 2026 news release with the Security Summit says: "Federal law requires tax and accounting professionals to create and maintain a Written Information Security Plan to help protect client information from identity thieves and data breaches" (IR-2026-92 (opens in a new tab)). Publication 5708 (opens in a new tab) adds that tax and accounting professionals are financial institutions "regardless of size."

What the FTC Safeguards Rule requires

The WISP documents an information security program that meets 16 CFR 314.4 (opens in a new tab). The required elements:

Elements of an information security program under 16 CFR 314.4
Section	Requirement	Small-firm exemption
314.4(a)	Designate a Qualified Individual to oversee, implement and enforce the program	No
314.4(b)	Base the program on a risk assessment of reasonably foreseeable internal and external risks; the risk assessment must be written (b)(1)	Written risk assessment, (b)(1)
314.4(c)	Design and implement safeguards, including encryption of customer information in transit over external networks and at rest, and multi-factor authentication for anyone accessing any information system	No
314.4(d)	Regularly test or monitor safeguards; without continuous monitoring, annual penetration testing and vulnerability assessments at least every six months (d)(2)	Penetration testing and vulnerability assessments, (d)(2)
314.4(e)	Policies, procedures and training so staff can carry out the program	No
314.4(f)	Oversee service providers: select capable providers, require safeguards by contract, and periodically assess them	No
314.4(g)	Evaluate and adjust the program based on testing and monitoring	No
314.4(h)	A written incident response plan	Yes
314.4(i)	The Qualified Individual reports in writing, at least annually, to the board or equivalent governing body	Yes
314.4(j)	Notify the FTC of a notification event involving 500 or more consumers within 30 days of discovery	No

Under 16 CFR 314.6, firms that maintain customer information on fewer than 5,000 consumers are exempt from the written risk assessment in (b)(1), the testing requirements in (d)(2), the written incident response plan in (h) and the annual report in (i). They still need the rest of the program, including multi-factor authentication, encryption and service-provider oversight.

On multi-factor authentication, the rule allows an exception only where the Qualified Individual has approved in writing reasonably equivalent or more secure access controls. IRS Publication 4557 says the MFA requirement applies to all companies "regardless of size" (Pub. 4557 (opens in a new tab)).

What the IRS sample WISP (Publication 5708) covers

Publication 5708 (opens in a new tab), "Creating a Written Information Security Plan for your Tax & Accounting Practice," includes a sample template with seven sections:

I. Objective
II. Purpose
III. Scope
IV. Identified Responsible Officials
V. Inside the Firm Risk Mitigation
VI. Outside the Firm Risk Mitigation
VII. Implementation

It walks through building the plan in these steps:

Define objectives, purpose and scope
Why the firm is writing the plan, including its legal duties, how taxpayer information is protected, and the limits of the plan's reach.
Identify responsible individuals
Usually a Data Security Coordinator and a Public Information Officer. Publication 5708: "In most firms of two or more practitioners, these should be different individuals."
Assess risks
How unauthorized access could happen, what information the firm handles, internal and external loss scenarios, and how new risks will be monitored.
Inventory hardware
Publication 5708: "It is imperative to catalog all devices used in your practice that come in contact with taxpayer data," with each device's location and the data it holds.
Document safety measures
Policies on data collection and retention, disclosure, network protection, user and remote access, connected devices and reportable incidents, plus an employee code of conduct.
Draft an implementation clause
The implementation date, firm name and compliance with the GLBA, the Safeguards Rule and state requirements, signed and dated by the principal operating officer or owner and the Data Security Coordinator.
Add ancillary attachments
Separate procedures, such as a records retention policy, rules of behavior for safeguarding client data and a security breach notification procedure, so one can change without rewriting the plan.

The IRS says Publication 5708 "is not an exhaustive discussion of everything related to WISPs and it is not intended to replace your own research." The 2026 news release adds that a good WISP focuses on three areas: employee management and training, information systems, and detecting and managing system failures.

Reporting a breach to the FTC

An amendment to the Safeguards Rule, effective May 13, 2024, requires covered firms to notify the FTC "as soon as possible, and no later than 30 days after discovery" of a notification event involving the information of at least 500 consumers (16 CFR 314.4(j) (opens in a new tab)). A notification event is the unauthorized acquisition of unencrypted customer information. Notice is filed through an online form on the FTC's website (FTC (opens in a new tab)).

Publication 4557 also tells tax professionals to report data theft or loss to their IRS Stakeholder Liaison. State breach-notification laws may impose separate obligations.

Where software and AI vendors fit in the plan

Under the Safeguards Rule, a service provider is any person or entity that "receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a financial institution." That includes cloud applications and AI tools that handle client data. Section 314.4(f) requires three things for each: take reasonable steps to select providers capable of appropriate safeguards, require those safeguards by contract, and periodically assess them.

Inventory them. List each tool, what client data it holds and who has access, alongside the hardware inventory.
Vet them. Ask for a SOC 2 Type 2 report and check its scope; see SOC 1 vs SOC 2. Send the AI vendor questionnaire for data-use and training terms.
Contract. Make sure the agreement requires the vendor to maintain safeguards.
Reassess. Review each vendor periodically, and when its terms or features change.
Cover general AI assistants. Say in the plan which assistants staff may use with client data and under which accounts; see AI chatbots for accounting.
Check Section 7216. Disclosing tax return information to a vendor has its own rules; see Section 7216 consent.

WISP checklist

Before you call the WISP done

A Qualified Individual is named in writing.
Risk assessment completed (in writing if you hold data on 5,000 or more consumers).
The device inventory lists each computer, phone and storage device that touches taxpayer data.
Software and AI vendors are inventoried, contracted and on a review schedule.
Multi-factor authentication is required for anyone accessing any information system, or the Qualified Individual has approved an equivalent control in writing.
Client data is encrypted in transit over external networks and at rest.
Staff have security awareness training, and the plan says which AI tools they may use.
An incident response plan exists (written if you hold data on 5,000 or more consumers), including the FTC 30-day notice for events involving 500 or more consumers.
Testing or monitoring is scheduled, and the plan is reviewed and adjusted on the results.

WISP template: questions

Is a WISP required for tax preparers?: Yes. The IRS says federal law requires tax and accounting professionals to create and maintain a written information security plan. The requirement comes from the FTC Safeguards Rule, which treats tax preparation services as financial institutions.
Does the IRS have a WISP template?: Yes. IRS Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice (Rev. 8-2024), includes a sample template with seven sections, from Objective to Implementation.
What must a WISP include?: It documents a program meeting 16 CFR 314.4: a Qualified Individual, a risk assessment, safeguards including encryption and multi-factor authentication, testing or monitoring, staff training, service-provider oversight, ongoing adjustment, an incident response plan, annual reporting, and FTC breach notification. Firms with customer information on fewer than 5,000 consumers are exempt from four specific requirements: the written risk assessment, penetration testing and vulnerability assessments, the written incident response plan, and the annual report.
Do small firms need a WISP?: Yes. IRS Publication 5708 says tax and accounting professionals are financial institutions regardless of size. Firms with customer information on fewer than 5,000 consumers are exempt only from the written risk assessment, penetration testing and vulnerability assessments, the written incident response plan and annual board reporting.
When do you have to report a data breach to the FTC?: When a notification event, meaning unauthorized acquisition of unencrypted customer information, involves at least 500 consumers. Notify the FTC as soon as possible and no later than 30 days after discovery, using the FTC's online form. The requirement took effect May 13, 2024.
Do AI tools need to be in the WISP?: A vendor that receives, maintains or processes customer information is a service provider the Safeguards Rule requires you to select carefully, bind by contract and periodically assess. Listing AI tools in the plan, with the accounts and data staff may use with them, is one way to document that oversight.

Sources

Official documents read on October 15, 2026. Vendor facts are sourced on each listing.

Key points

Who needs a WISP

What the FTC Safeguards Rule requires

What the IRS sample WISP (Publication 5708) covers

Define objectives, purpose and scope

Identify responsible individuals

Assess risks

Inventory hardware

Document safety measures

Draft an implementation clause

Add ancillary attachments