What is a WISP and Does My Tax Practice Need One?

What is a WISP?

A Written Information Security Plan — or WISP — is a formal document that describes how your business protects the sensitive financial information you collect from clients. Think of it as your business's official playbook for data security.

Your WISP outlines things like:

• Who is responsible for your security program
• What systems and devices store client data
• How you control access to that data
• What encryption and security tools you use
• How you train employees on security
• What you do if there's a data breach

Who Requires a WISP?

Two separate federal authorities require tax preparers to have a WISP:

1. The FTC Safeguards Rule

The Federal Trade Commission's Safeguards Rule (16 CFR Part 314) requires all financial institutions — including tax preparers — to develop, implement, and maintain a written information security program. The rule was significantly updated in 2023 and is actively enforced.

2. IRS Publication 4557

The IRS's own data security guidelines for tax professionals, Publication 4557, explicitly requires tax preparers to create and maintain a WISP. The IRS has made this a condition of PTIN renewal.

Does Your Tax Practice Need a WISP?

If you answer yes to any of these questions, you need a WISP:

• Do you prepare tax returns for clients?
• Do you hold a PTIN (Preparer Tax Identification Number)?
• Do you store client financial information on any computer, device, or cloud service?
• Do you have employees or contractors who access client data?

There is no minimum size exemption. Whether you're a solo enrolled agent or a firm with 50 staff, the requirement applies to you.

What About PTIN Renewal?

Here's what many tax preparers don't realize: Form W-12 Line 11 — the PTIN renewal form — asks you to certify under penalty of perjury that you have a Written Information Security Plan in place. If you don't have one, you cannot honestly check that box. Falsely certifying is a federal crime.

How Do You Get a WISP?

You have three options:

• Write one yourself — Time consuming and requires knowledge of the FTC Safeguards Rule requirements
• Use a generic template — Cheap but risky; generic templates may not reflect your actual business and won't hold up under scrutiny
• Get a custom WISP — Built specifically for your business based on your actual systems, staff, and data practices

A custom WISP is the safest option. It reflects your real business, is easier to implement, and provides much stronger protection if you're ever audited.

SafeguardsReady is not a law firm and does not provide legal advice. Documents are prepared based on publicly available FTC and IRS guidance. Consult a licensed attorney for advice specific to your compliance obligations.