WISP (written information security plan)

A WISP is your security program on paper: who is responsible, what data you hold, the risks to it, the safeguards you use, how you train staff, how you oversee vendors, and what you’ll do if something goes wrong. It isn’t meant to sit in a drawer — it should describe what you actually do and be reviewed regularly.

For tax preparers and many accounting firms, a WISP isn’t optional. The IRS points out that tax professionals are treated as financial institutions under the Gramm-Leach-Bliley Act, so the FTC Safeguards Rule requires them to have a written information security program. The IRS and its Security Summit partners publish Publication 5708, a template for creating a WISP for a tax and accounting practice, and the PTIN application and renewal form (Form W-12) asks preparers to acknowledge they know a written plan is required.

Medical and dental practices have a parallel obligation under HIPAA: written policies and procedures for the Security Rule’s safeguards, backed by a risk assessment. The name differs, but the idea is the same — write down how you protect sensitive data, then do what you wrote.

Example: a small CPA firm uses IRS Publication 5708 as its starting point, names its managing partner as the qualified individual, documents its MFA, encryption, backup and staff-training controls, and reviews the plan each year before tax season. Our IT security guide for CPA firms walks through each section, and our accounting firm case study shows documented controls in practice.