Compliance
What an IRS Publication 4557-aligned Written Information Security Plan (WISP) actually has to contain for a small CPA firm in 2026.
Every paid tax preparer in the United States is required to maintain a Written Information Security Plan.
That requirement has been in IRS Publication 4557 since 2008, reinforced in Publication 5708 in 2022, extended through the FTC Safeguards Rule amendments that took effect in 2023, and layered with a professional-standards obligation through AICPA SSTS Section 1.3 effective January 1, 2024.
Most firms do not have a current WISP. Of those that do, most bought a sixty-page template, filled in the cover page, and have not looked at it since. That document is not a WISP. It is a binder.
This guide is for the firm that wants the working version. Twelve pages, defensible against an IRS examiner, an FTC investigator, a state attorney general, or a cyber insurance carrier.
We walk through who is in scope, what the regulators require, the twelve-page outline section by section, and where firms most commonly fail.
A note up front: we operate the technical safeguards side. We are not your Qualified Individual and we are not your tax counsel. The principal of the firm remains the accountable owner of the WISP.
Every paid preparer with a PTIN is expected to maintain a Written Information Security Plan — IRS Publications 4557 and 5708 document the expectation, and the 2023-amended FTC Safeguards Rule makes the underlying information security program a legal obligation.
A defensible WISP documents twelve things:
Twelve obligations, twelve pages. A downloaded sample template with the firm never filled in is not a WISP; it is documentation of a plan the firm does not have.
The WISP is one half of the obligation.
What the 2023-amended FTC Safeguards Rule adds on top of Publication 4557 — and where the two overlap rather than duplicate — is covered in IRS Publication 4557 and the FTC Safeguards Rule.
The WISP requirement reaches further than most preparers realize.
Any preparer with a PTIN. IRS Publication 4557 imposed the requirement in 2008; Publication 5708 reinforced it in 2022. No firm-size threshold, no revenue threshold. A solo EA preparing 80 returns a year is in scope.
All CPA firms providing tax services. The FTC Safeguards Rule classifies tax preparers and accountants as financial institutions under the Gramm-Leach-Bliley Act (GLBA).
The Safeguards Rule's Information Security Program — functionally a WISP plus operational evidence — is a federal requirement, separate from and additive to Pub 4557.
Multi-partner firms, single-shingle CPAs, EAs, and registered tax return preparers. Same requirement, same scope.
AICPA members. SSTS Section 1.3, effective January 1, 2024, adds an explicit professional-standards obligation to protect client confidential information.
Read together, IRS Publication 4557, Publication 5708, and FTC Safeguards Rule § 314.4 require a small CPA firm to do twelve specific things.
One size exception on the FTC side: a firm that maintains customer information on fewer than 5,000 consumers is exempt from items 2 (the written part of the risk assessment), 5 and 10, and from the annual report to the board, under 16 CFR 314.6. The Qualified Individual, MFA, encryption, vendor oversight and training apply at any size.
A defensible WISP is the document demonstrating each obligation is being met. Twelve obligations, twelve pages — how the outline below is organized.
Each page below corresponds to one section. Each is structured so an IRS examiner or FTC investigator can read it in five minutes and understand what the firm does, who is accountable, and where the evidence lives.
Not the full risk assessment — that is a separate working document. This page is the summary register: five to seven concrete risks with a likelihood × impact rating, an owner, the current control, and the residual risk. Typical risks for a small CPA firm:
The page most often missing or stale. FTC § 314.4(f) explicitly requires service provider oversight. Maintain a vendor inventory with, for each entry:
Vendors a small CPA firm typically addresses:
That is the entire plan. Twelve pages of substance, plus whatever appendices (acceptable use, vendor list, training records) the firm wants to attach.
Plans fail in a small number of consistent ways.
Publication 5708 expects review periodically and on material change.
For firms that maintain information on 5,000 or more consumers, FTC § 314.4(i) also requires the Qualified Individual to produce a written report to the firm's governing body or principal at least annually — covering:
Most firms do not do this until an incident or insurance renewal forces it. Underwriters are increasingly asking to see the annual report itself, not just a checkbox.
After auditing dozens of small firm WISPs, the same failures repeat:
None of these are sophisticated failures. They are documentation drift. The fix is operational: a single calendar item, one hour, once a year, with the right people in the room.
We do not write the WISP for you. That sits with your Qualified Individual or your outside counsel — the plan must reflect the firm's actual operations, not a provider's assumptions.
What we operate is the technical safeguards layer the WISP describes. Managed detection and response on every endpoint.
Managed identity threat detection and response for the Microsoft 365 or Google Workspace tenant where taxpayer email lives. Managed security awareness training with completion tracking that produces the evidence Page 11 claims.
Managed SIEM so the incident response plan on Page 10 has detection telemetry behind it.
We package that evidence the way an IRS examiner, an FTC investigator, or a cyber insurance carrier wants to see it:
When you get to the cyber insurance readiness renewal, the same evidence is what the underwriter is asking for. Our accounting industry page covers the operational specifics of tax season threat patterns and IRS-specific scams.
Pull your current WISP — or admit you do not have one. Block a sixty-minute working session this week. Walk the document, or its absence, against the twelve-page outline above. Identify the three to five gaps that matter most. Fix those this month. Schedule the annual review.
The WISP is supposed to be a working document, not a deliverable. The IRS examiner, the FTC investigator, the state attorney general, and the cyber underwriter all care about the same question: is the plan real, and is it operating.
Twelve pages of accurate, current, followed plan beats sixty pages of binder every time.
If you want a working session on this, Talk with us. We will pull your current plan against this outline, identify the gaps that matter, and tell you which are operational fixes versus technical safeguard work we can run.
Last updated
August 16, 2026. We refresh this content as the threat landscape and tools evolve.
FAQ
Every paid preparer with a PTIN is required by IRS Publication 4557 and reinforced by Publication 5708 to maintain a Written Information Security Plan.
That captures solo CPAs, EAs, registered tax return preparers, and multi-partner firms equally.
The FTC Safeguards Rule, post-2023 amendments, adds a parallel obligation by classifying tax and accounting firms as financial institutions under GLBA.
There is no employee-count exemption from the WISP requirement itself, although some Safeguards Rule provisions ease for firms with fewer than 5,000 consumers.
The IRS sample template in Publication 5708 is a useful starting structure, but it is not a finished plan.
It deliberately leaves the firm-specific content blank — the Qualified Individual, the vendor inventory, the actual incident response contacts, the chosen MFA tooling, the encryption posture.
A WISP that still has bracketed placeholders or generic language about 'the firm' is not defensible. The sample is a skeleton; you have to put the firm into it.
Yes. The FTC clarified in 2022 and through the 2023 amendments that tax preparers and accountants are 'financial institutions' under GLBA for purposes of the Safeguards Rule.
Most of the rule applies at any size, including the Qualified Individual, MFA and encryption.
Firms that maintain information on fewer than 5,000 consumers are exempt from four provisions only: putting the risk assessment in writing, continuous monitoring or periodic penetration testing and vulnerability assessments, a written incident response plan, and the annual written report to the board (16 CFR 314.6).
The WISP should reference your state's breach notification statute and your incident response plan should encode its timing.
Every U.S. state now has a breach notification law, and several (California, New York, Massachusetts, Illinois) have additional written-information-security-program requirements that overlap with the WISP.
If you serve clients across state lines, your incident response section needs to address the strictest applicable state law, not just your home state.
Yes. The FTC Safeguards Rule at § 314.4(a) requires the firm to designate a Qualified Individual responsible for the information security program. At a solo firm, that is almost always the principal.
The point is not headcount — it is accountability. The Qualified Individual is the person who reports annually on the program and is on the hook if it fails. Naming nobody is worse than naming yourself.
IRS Publication 5708 expects review on a periodic basis (annual is the de-facto standard) and whenever there is a material change in operations.
For firms that maintain information on 5,000 or more consumers, the FTC Safeguards Rule also requires the Qualified Individual to provide a written report to the board or governing body at least annually.
In practice that means one full WISP review per year, plus event-driven updates when you change tax software, switch cloud providers, hire or lose key staff, move offices, acquire another practice, or experience a security incident.
You can buy one. It will not, by itself, make you compliant.
A purchased template that is not customized to your actual firm — your Qualified Individual, your vendor list, your incident response contacts, your training records, your encryption attestation — is documentation of a plan you do not actually have.
The IRS examiner or FTC investigator does not care that you paid for the document. They care whether the controls it describes are operating.
Buying a template can be a useful starting point, but the work is the customization and the operation, not the purchase.
Changing tax preparation software, replacing your client portal or e-signature vendor, moving to a new cloud provider, an office move, a partner or key-staff change, an acquisition or merger, a material change in the services you offer, a new state of operation, an incident or near-miss, a change in cyber insurance carrier, and a regulatory change such as a new state privacy law applicable to your client base.
Any one of those should trigger a focused WISP refresh — not the full annual review, but a documented update to the affected sections.
Related reading
What IRS Publication 4557 and the FTC Safeguards Rule actually require of CPA firms in 2026 — the safeguards, the written program, and where firms slip.
Read articleFiling season concentrates the exposure. What IT covers, what a security operation covers, and the reporting path the IRS walks after a preparer breach.
Read articleWhat cyber insurance for CPA and tax firms actually covers in 2026, the underwriting questionnaire controls carriers review.
Read article