The IRS says your firm needs a WISP. Here's what that actually means.

Somewhere in your PTIN renewal, you checked a box confirming your firm is aware of its data security responsibilities. Behind that checkbox sits a real obligation: every professional tax preparer is required to have a Written Information Security Plan, a WISP. Not encouraged. Required.

Where the requirement comes from

Two places. The FTC Safeguards Rule applies to tax preparers as "financial institutions" under Gramm-Leach-Bliley, and it requires a written security program with named responsibility, risk assessment, safeguards, and testing. IRS Publication 4557 translates that into tax-practice terms and points firms at the "Security Six" basics. Neither cares how small your firm is.

What a real WISP contains

• A named person responsible for the program.
• A risk assessment: where client data lives, how it moves, what threatens it.
• The safeguards themselves: MFA, encryption, endpoint protection, backups, access controls.
• An incident response plan: who does what when something goes wrong.
• Employee training and vendor oversight.
• Evidence that all of it actually happens, not just a binder on a shelf.

Why the downloaded template fails

A template with your firm name pasted in describes a fictional firm. The first question in any inquiry after a breach is simple: show us that you did what your plan says. If your WISP claims quarterly backup tests and phishing training that never happened, the document works against you. The plan and the practice have to match.

The realistic path

Assess what you actually have, implement the controls that are missing, write the WISP to describe reality, and keep the evidence as you go. For most small firms that's a focused project measured in weeks, not months, and it doubles as genuinely better security going into busy season.

We build WISPs and the controls behind them for CPA firms across the Bay Area and Central Valley. Start with the free CPA-firm IT and compliance checklist, or book a 15-minute consult and we'll tell you exactly where you stand.