Free download · Tax & accounting
Free WISP Template for Tax Professionals
The FTC Safeguards Rule — and your PTIN renewal — expect a written, signed information security plan. Here's what it must contain, and a template to build yours from.
If you prepare tax returns professionally, you're a "financial institution" under Gramm-Leach-Bliley — firm size doesn't exempt you — which means the FTC Safeguards Rule applies to you, and a Written Information Security Plan (WISP) is required, not recommended. The IRS reinforces it: PTIN renewal asks you to confirm your data-security responsibilities, and IRS Publications 4557 and 5708 spell out what a tax-practice WISP looks like.
The good news: for a small firm, a real WISP is a few pages, not a binder. This download gives you both halves — a plain-English checklist of what the Safeguards Rule requires, and a fill-in skeleton you can adopt, sign, and keep with your firm records.
We ask for your first name and email, then the PDF downloads right here.
What's inside
What your WISP must cover — the Qualified Individual, risk assessment, MFA, encryption, disposal, monitoring, training, vendor oversight, incident response, and the annual review
The fill-in skeleton — six sections: plan owner & scope, data inventory, safeguards in force, service providers, incident contacts (including your IRS Stakeholder Liaison), training & annual review
Deadlines and teeth — what's enforceable since June 2023, and the FTC's 30-day breach reporting rule for 500+ consumers
What the Safeguards Rule requires
The ten requirements, in plain English
A named Qualified Individual. One person owns the security program by name. You can hire help; you can't outsource the accountability.
A written risk assessment. Where client data lives — tax software, email, portals, drives, paper — and what threatens each spot.
Access controls with MFA. Least-privilege access to client data, and multi-factor authentication — MFA is explicitly required, not suggested.
Encryption at rest and in transit. Laptops, drives, and email carrying client data — encrypted, with secure portals instead of attachments.
Retention and secure disposal. A defined retention period, then certified shredding and drive destruction when it ends.
Monitoring and testing. Logging that would show unauthorized access, and a periodic check that your safeguards actually work.
Employee training, documented. At hire and ongoing — with dates and signatures, because training that isn't recorded didn't happen.
Service provider oversight. Your IT provider, tax software, and cloud vendors under contracts that require them to safeguard client data.
A written incident response plan. Including the tax-specific part: data theft gets reported to your IRS Stakeholder Liaison and state tax agency immediately.
Annual review, signature, date. Revisited every year and after any incident or major change — the signature block is what makes it a plan.
Deadlines and teeth: the Safeguards Rule has been fully enforceable since June 2023, and since May 2024 a breach affecting 500+ consumers must be reported to the FTC within 30 days. And none of that hurts like a filing season spent on the phone about a stolen EFIN.
The fill-in skeleton (page 2 of the PDF)
Six sections, each a few blanks: plan owner & scope (firm, Qualified Individual, adoption date, systems covered) → client data inventory (what you hold, where it lives, retention) → safeguards in force (MFA, encryption, managed protection, backups with last test-restore date, physical) → service providers (each under a safeguards contract) → incident response contacts (IT/forensics, insurer, IRS Stakeholder Liaison, state tax agency, attorney, FTC report checkbox) → training & annual review (dates and the signature that makes it official).
WISP FAQ
What is a WISP?
A Written Information Security Plan: a dated, signed document describing how your firm protects client data — who's responsible, what data you hold, what safeguards are in place, and what happens when something goes wrong. For tax professionals it's the document that satisfies the FTC Safeguards Rule and the data-security responsibilities the IRS asks about at PTIN renewal.
Who is required to have a WISP?
Professional tax preparers, CPAs, enrolled agents, and other firms handling nonpublic financial information — the Safeguards Rule treats them as financial institutions under Gramm-Leach-Bliley regardless of size. A sole practitioner with one laptop needs one just as surely as a 40-person firm; the plan is just shorter.
Is there an official IRS WISP template?
The IRS publishes a sample WISP in Publication 5708 ("Creating a Written Information Security Plan for your Tax & Accounting Practice") and security guidance in Publication 4557. Our template condenses the same required elements into a two-page working document — use either, but use something: the requirement is having a plan that's true, signed, and current.
What happens if I don't have a WISP?
Three separate problems: FTC enforcement exposure under the Safeguards Rule, an untrue attestation at PTIN renewal, and — the one that actually ruins a February — no rehearsed plan when client data is stolen, while notification clocks (FTC 30 days for 500+ consumers, plus IRS and state reporting) are already running.
Can my IT provider write my WISP?
They can build most of what goes in it — the MFA, encryption, backups, monitoring, and the documentation — and hand you the technical sections filled in. The Qualified Individual designation and the signature stay with the firm: accountability can't be outsourced, which is exactly how the rule is designed.
Don't want to be your own security department during filing season?
Datastrive implements WISPs end to end for tax and accounting firms — the actual controls, the documentation, and the annual review, backed by our cybersecurity services. Free Safeguards gap review for Chicago-area firms: we'll walk the ten requirements against your practice and hand you the findings.
Prefer to talk? Call 1-773-863-3868.
More free resources: Small Business Cyber Security Checklist · Incident Response Plan Template · see all free resources
Educational template from Datastrive — adopting a WISP requires tailoring it to your firm. The FTC Safeguards Rule (16 CFR Part 314) and IRS Publications 4557/5708 govern; this is not legal advice.