WISP and FTC Safeguards Rule help for tax and accounting firms
A written information security plan that reflects how your firm really works, and the safeguards to back it up.
Why every tax practice needs a WISP
Under the Gramm-Leach-Bliley Act, the FTC’s Safeguards Rule (16 CFR Part 314) covers tax preparers and accounting firms as financial institutions. It requires a written information security program, appropriate to the size and complexity of your firm and the sensitivity of the information you handle.
The IRS reinforces this. The PTIN application and renewal, Form W-12, includes a line asking preparers to acknowledge they are aware that paid preparers are required by law to create and maintain a written information security plan. The IRS published Publication 5708 as a WISP template for tax and accounting practices.
What the Safeguards Rule asks for
- A Qualified Individual who oversees the program
- A written risk assessment
- Safeguards including access controls, a data inventory, encryption, MFA, secure disposal, and change management
- Monitoring and testing of those safeguards
- Security awareness training for staff
- Oversight of service providers
- A written incident response plan
- Regular updates, and a written report to leadership at least annually
- Notice to the FTC within 30 days of discovering a breach of unencrypted information involving 500 or more consumers
Some items do not apply to firms with information on fewer than 5,000 consumers. We help you sort out which apply to you.
How we help
Assess
Inventory your data, systems, vendors, and people, and identify the real risks.
Write
Draft your WISP from IRS Publication 5708, tailored to your firm, in plain language your staff can follow.
Implement
Put the safeguards in place: MFA, encryption, backups, access controls, and training.
Maintain
Review and update the plan at least yearly and whenever your firm, vendors, or systems change.
We are an IT and security provider, not a law firm. For legal questions about your obligations, we are happy to work alongside your attorney.
WISP questions
Does the Safeguards Rule apply to a small or solo practice?
Yes. The IRS and FTC treat tax and accounting professionals as financial institutions regardless of size. Firms that maintain information on fewer than 5,000 consumers are exempt from a few of the rule's requirements, such as a written risk assessment, a written incident response plan, and the annual written report, but still need a written security program.
Do we send our WISP to the IRS?
No. The Form W-12 checkbox asks you to acknowledge that you are aware of the requirement. You keep the plan, follow it, and update it.
Can we just use the IRS template?
Publication 5708 is an excellent starting point. The plan has to describe what your firm actually does, so it needs to be tailored, and the safeguards it lists need to be in place.
Sources: FTC Safeguards Rule, 16 CFR Part 314; FTC business guidance on the Safeguards Rule; IRS Publications 4557 and 5708; Instructions for Form W-12. General information, not legal advice.
Get your WISP in shape before the next filing season
We review how your firm handles client data today, then give you a short, plain-English list of what to fix first. No obligation.