Compliance
What an IRS Publication 4557-aligned Written Information Security Plan (WISP) actually has to contain for a small CPA firm in 2026 — and a 12-page outline you can adapt instead of buying a 60-page template.
Every paid tax preparer in the United States is required to maintain a Written Information Security Plan. That requirement has been in IRS Publication 4557 since 2008, reinforced in Publication 5708 in 2022, extended through the FTC Safeguards Rule amendments that took effect in 2023, and layered with a professional-standards obligation through AICPA SSTS Section 1.3 effective January 1, 2024.
Most firms do not have a current WISP. Of those that do, most bought a sixty-page template, filled in the cover page, and have not looked at it since. That document is not a WISP. It is a binder.
This guide is for the firm that wants the working version. Twelve pages, defensible against an IRS examiner, an FTC investigator, a state attorney general, or a cyber insurance carrier. We walk through who is in scope, what the regulators require, the twelve-page outline section by section, and where firms most commonly fail.
A note up front: we operate the technical safeguards side. We are not your Qualified Individual and we are not your tax counsel. The principal of the firm remains the accountable owner of the WISP.
The WISP requirement reaches further than most preparers realize.
Read together, IRS Publication 4557, Publication 5708, and FTC Safeguards Rule § 314.4 require a small CPA firm to do twelve specific things.
A defensible WISP is the document demonstrating each obligation is being met. Twelve obligations, twelve pages — how the outline below is organized.
Each page below corresponds to one section. Each is structured so an IRS examiner or FTC investigator can read it in five minutes and understand what the firm does, who is accountable, and where the evidence lives.
Not the full risk assessment — that is a separate working document. This page is the summary register: five to seven concrete risks with a likelihood × impact rating, an owner, the current control, and the residual risk. Typical risks for a small CPA firm:
The page most often missing or stale. FTC § 314.4(f) explicitly requires service provider oversight. Maintain a vendor inventory with, for each entry:
Vendors a small CPA firm typically addresses: Lacerte, Drake, ProSeries, UltraTax, or CCH Axcess; DocuSign or Adobe Sign; SmartVault, ShareFile, or TaxDome; QuickBooks Online, Xero, or Sage; OneDrive, Google Drive, Dropbox; payroll (Gusto, ADP, Paychex); IT and security providers.
That is the entire plan. Twelve pages of substance, plus whatever appendices (acceptable use, vendor list, training records) the firm wants to attach.
The plans we see fail in a small number of consistent ways.
Publication 5708 expects review periodically and on material change. FTC § 314.4(i) independently requires the Qualified Individual to produce a written report to the firm's governing body or principal at least annually — covering program status, compliance, risk assessment updates, testing results, security events and management's response, and recommendations for changes.
Most firms do not do this until an incident or insurance renewal forces it. Underwriters are increasingly asking to see the annual report itself, not just a checkbox.
After auditing dozens of small firm WISPs, the same failures repeat:
None of these are sophisticated failures. They are documentation drift. The fix is operational: a single calendar item, one hour, once a year, with the right people in the room.
We do not write the WISP for you. That sits with your Qualified Individual or your outside counsel — the plan must reflect the firm's actual operations, not a provider's assumptions.
What we operate is the technical safeguards layer the WISP describes. Managed detection and response on every endpoint. Managed identity threat detection and response for the Microsoft 365 or Google Workspace tenant where taxpayer email lives. Managed security awareness training with completion tracking that produces the evidence Page 11 claims. Managed SIEM so the incident response plan on Page 10 has detection telemetry behind it.
We package that evidence the way an IRS examiner, an FTC investigator, or a cyber insurance carrier wants to see it: MFA enforcement reports, MDR coverage records, training completion logs, encryption attestation, and vendor agreements with breach notification language. When you get to the cyber insurance readiness renewal, the same evidence is what the underwriter is asking for. Our accounting industry page covers the operational specifics of tax season threat patterns and IRS-specific scams.
Pull your current WISP — or admit you do not have one. Block a sixty-minute working session this week. Walk the document, or its absence, against the twelve-page outline above. Identify the three to five gaps that matter most. Fix those this month. Schedule the annual review.
The WISP is supposed to be a working document, not a deliverable. The IRS examiner, the FTC investigator, the state attorney general, and the cyber underwriter all care about the same question: is the plan real, and is it operating. Twelve pages of accurate, current, followed plan beats sixty pages of binder every time.
If you want a working session walked by a CISSP, start with the briefing. We will pull your current plan against this outline, identify the gaps that matter, and tell you which are operational fixes versus technical safeguard work we can run.
Last updated
May 16, 2026. We refresh this content as the threat landscape and tools evolve.
FAQ
Every paid preparer with a PTIN is required by IRS Publication 4557 and reinforced by Publication 5708 to maintain a Written Information Security Plan. That captures solo CPAs, EAs, registered tax return preparers, and multi-partner firms equally. The FTC Safeguards Rule, post-2023 amendments, adds a parallel obligation by classifying tax and accounting firms as financial institutions under GLBA. There is no employee-count exemption from the WISP requirement itself, although some Safeguards Rule provisions ease for firms with fewer than 5,000 consumers.
The IRS sample template in Publication 5708 is a useful starting structure, but it is not a finished plan. It deliberately leaves the firm-specific content blank — the Qualified Individual, the vendor inventory, the actual incident response contacts, the chosen MFA tooling, the encryption posture. A WISP that still has bracketed placeholders or generic language about 'the firm' is not defensible. The sample is a skeleton; you have to put the firm into it.
Yes. The FTC clarified in 2022 and through the 2023 amendments that tax preparers and accountants are 'financial institutions' under GLBA for purposes of the Safeguards Rule. The full set of new requirements — Qualified Individual, written risk assessment, MFA, encryption, incident response plan, annual board reporting — applies to firms that maintain information on 5,000 or more consumers. Smaller firms are still subject to the underlying Safeguards Rule duty, just with relief from a few of the most prescriptive sub-requirements.
The WISP should reference your state's breach notification statute and your incident response plan should encode its timing. Every U.S. state now has a breach notification law, and several (California, New York, Massachusetts, Illinois) have additional written-information-security-program requirements that overlap with the WISP. If you serve clients across state lines, your incident response section needs to address the strictest applicable state law, not just your home state.
Yes. The FTC Safeguards Rule at § 314.4(a) requires the firm to designate a Qualified Individual responsible for the information security program. At a solo firm, that is almost always the principal. The point is not headcount — it is accountability. The Qualified Individual is the person who reports annually on the program and is on the hook if it fails. Naming nobody is worse than naming yourself.
IRS Publication 5708 expects review on a periodic basis (annual is the de-facto standard) and whenever there is a material change in operations. The FTC Safeguards Rule independently requires the Qualified Individual to provide a written report to the board or governing body at least annually. In practice that means one full WISP review per year, plus event-driven updates when you change tax software, switch cloud providers, hire or lose key staff, move offices, acquire another practice, or experience a security incident.
You can buy one. It will not, by itself, make you compliant. A purchased template that is not customized to your actual firm — your Qualified Individual, your vendor list, your incident response contacts, your training records, your encryption attestation — is documentation of a plan you do not actually have. The IRS examiner or FTC investigator does not care that you paid for the document. They care whether the controls it describes are operating. Buying a template can be a useful starting point, but the work is the customization and the operation, not the purchase.
Changing tax preparation software, replacing your client portal or e-signature vendor, moving to a new cloud provider, an office move, a partner or key-staff change, an acquisition or merger, a material change in the services you offer, a new state of operation, an incident or near-miss, a change in cyber insurance carrier, and a regulatory change such as a new state privacy law applicable to your client base. Any one of those should trigger a focused WISP refresh — not the full annual review, but a documented update to the affected sections.
Related reading
What cyber insurance for CPA and tax firms actually covers in 2026, the underwriting questionnaire controls that move premiums, and how to pass the application without overspending.
Read articleA CISSP-led walkthrough of cyber insurance for first-time SMB buyers in 2026 — what the policy covers, what the questionnaire asks, the four controls that move premiums the most, and how to pass the application without overspending.
Read articleThe 22 cyber-insurance underwriting controls that move premiums in 2026 — what each one asks, why carriers care, and how to answer without overcommitting your stack.
Read article