A written information security plan helps your accounting firm explain how it protects client information and who is responsible for that work. It should reflect the way your team handles tax returns, payroll records, financial statements, and identification documents every day.
For tax and accounting practices across Washington DC, Maryland, and Northern Virginia, that means looking beyond the office server. Client information may also sit in email, hosted accounting software, shared folders, employee laptops, and paper files.
In August 2026, the IRS reminded tax professionals to create, maintain, test, and update their security plans. A useful starting point is the official IRS Publication 5708 WISP template.
However, the template needs to match your firm. This guide explains what to review, how to connect the document to working safeguards, and which questions to ask your IT provider.
What Is a Written Information Security Plan?
A written information security plan, often shortened to WISP, documents the administrative, technical, and physical safeguards your firm uses to protect customer information. It also explains how your firm identifies risks, assigns responsibilities, and maintains its security program.
Under the FTC Safeguards Rule, the written program must fit the business’s size, complexity, activities, and the sensitivity of the information involved.
In practice, an employee should be able to use the plan to understand how to handle a client file or report a suspicious request. Similarly, a manager should know who reviews access, follows up on security problems, and approves changes.
The document and daily procedures need to agree. For example, a policy requiring approved devices should match the devices that can actually access client records.
Which Firms Need a Written Information Security Plan?
Tax preparation firms are among the financial institutions identified in the FTC’s Safeguards Rule guidance. Applicability depends on the activities a business performs and the regulator with jurisdiction.
Therefore, a practice should assess its actual services when determining its obligations. The requirement does not depend only on whether the business uses “accounting,” “bookkeeping,” or “tax preparation” in its name.
Some covered firms maintain customer information concerning fewer than 5,000 consumers. The rule provides exemptions from certain provisions for those firms. However, it does not give them a blanket exemption from maintaining an appropriate written security program. The details appear in 16 CFR Section 314.6.
For a small practice, the goal is a program that suits its operations and applicable requirements. A shorter document can still be useful when it accurately describes responsibilities, safeguards, and review procedures. A qualified legal or compliance adviser can help confirm which requirements apply to your firm’s services.
What Your Written Information Security Plan Should Cover
Start by documenting how work happens today. Then identify gaps, assign corrective actions, and update the plan as those improvements take effect.
Assign Responsibility for the Security Program
Covered firms must designate a Qualified Individual to oversee the program. That person can work within the firm or for a service provider, subject to the rule’s oversight requirements. The firm retains responsibility when it outsources this work.
Record the person’s responsibilities and the internal manager who reviews the program. Also identify who can approve access changes, authorize spending, and coordinate a response when something goes wrong.
For a small office, clear ownership helps prevent a familiar problem: everyone assumes someone else checked the account, backup, or security alert.
Identify Where Client Information Lives
Create an inventory that follows client information through the practice. Include digital records and physical documents.
For example, review:
- Tax preparation, bookkeeping, and payroll applications.
- Microsoft 365, email accounts, and shared cloud folders.
- Client portals, scanned documents, and local downloads.
- Office computers, laptops, servers, and backup systems.
- Paper files, archived records, and removable storage.
- Access provided to employees, seasonal staff, and outside vendors.
Next, identify who can access each location and why. You can then prioritize risks based on the information involved, the likelihood of exposure, and the effect on clients and operations.
The inventory should also support a retention and secure-disposal policy that accounts for applicable requirements and legitimate business needs.
Review Access and Technical Safeguards
Connect each identified risk to a specific control and a responsible person. The FTC’s program requirements address access controls, encryption, authentication, application security, and other safeguards.
Useful areas to review with your IT provider include:
- Individual user accounts and access appropriate to each role.
- Multifactor authentication for anyone accessing the firm’s information systems. Any permitted equivalent secure-access controls require the Qualified Individual’s written approval.
- Encryption for sensitive information and devices.
- Supported software, timely updates, and endpoint protection.
- Approved methods for remote access and client file exchange.
- Security monitoring and a clear process for responding to alerts.
For example, confirm that a seasonal preparer’s access ends when the assignment finishes. Also check whether shared links expose client folders more broadly than intended.
Your managed IT services should support these procedures with evidence of the settings and work performed.
Train Employees and Seasonal Staff
Employees need to understand the procedures that apply to their jobs. Include permanent staff, contractors, and temporary preparers who handle sensitive information.
Training should cover suspicious emails, unexpected login prompts, client-file handling, approved software, and reporting concerns. In addition, make the reporting process easy to find.
A new preparer should know which portal to use before receiving client documents. Likewise, a staff member who sends a file to the wrong person should know whom to contact immediately.
Keep a record of training and revisit the instructions when tools or workflows change. IRS Publication 4557 provides taxpayer-data security guidance to support these discussions.
Evaluate Service Providers
Your plan should account for providers that store, process, or can access client information. These may include your IT provider, tax-software host, payroll platform, and cloud-backup provider.
Review their responsibilities, contractual safeguards, and access arrangements. Also establish how your firm will assess their suitability over time.
For example, ask how a provider protects administrative access and informs you about relevant security events. Confirm how your data and accounts will transfer when a contract ends.
Prepare for Incidents and Recovery
Document a practical process for suspected incidents. Employees should know how to report a lost laptop, suspicious account activity, or a client file sent to the wrong recipient.
The response should identify who coordinates containment, preserves relevant information, and evaluates notification duties. Tax professionals should also know how to reach their IRS Stakeholder Liaison.
In addition, review backup and disaster recovery with your IT provider. Identify the systems and records included, who receives failure alerts, and how restoration is tested.
Record the date and outcome of restore tests. That gives management a clearer basis for recovery planning than a successful backup notification alone.
The plan should reflect applicable requirements, including any small-firm exceptions, while keeping practical response instructions available to staff.
An Example for a Local Accounting Practice
Consider this illustrative scenario: a six-person tax practice in Fairfax hires two remote seasonal preparers.
The firm uses a secure client portal. However, one preparer downloads documents to a personal laptop, and another still has access after the assignment ends. The backup report shows successful jobs, but the manager cannot find a recent restore-test record.
A review of the firm’s written information security plan could lead to four practical actions:
- Define which devices may access or store client information.
- Assign someone to approve, review, and remove seasonal access.
- Check whether important local files are included in the approved backup process.
- Schedule a restore test and record the result.
The firm should also update its onboarding instructions so the next preparer follows the same process.
This example shows why a useful plan needs operational detail. Writing “we protect client information” gives employees little direction about devices, downloads, or access changes.
How to Keep Your Written Information Security Plan Current
The IRS sample WISP recommends review at least annually and after material changes to business practices. Its template provides a place to record the most recent review.
For an accounting practice, we recommend scheduling that review before the next tax season. Also revisit the plan when your firm:
- Adds employees, contractors, or a new office.
- Changes accounting software, cloud services, or its IT provider.
- Introduces remote access or a new method of sharing files.
- Identifies a risk during testing or a security incident.
- Changes how long it keeps records or where it stores them.
When you make a change, record what changed, who approved it, and whether employees need new instructions.
In addition, maintain a short list of unresolved risks with an owner and target date for each item. This helps management track improvements without losing them in the main document.
Annual review is a useful planning checkpoint. Changes that affect client information deserve attention when they occur.
Questions to Ask Your IT Provider
Bring your current plan and a list of important applications to your next technology review. Then ask for evidence that helps you understand the actual environment.
- Which users and vendors can access client records?
- When did we last review permissions and remove unnecessary access?
- How do we approve and remove seasonal accounts?
- Which devices and remote-access methods are allowed?
- Where is multifactor authentication enabled, and what exceptions exist?
- When did we last complete a successful restore test?
- Who receives security alerts, and what happens after an alert?
- Which records can you provide to support our next WISP review?
Ask the provider to explain gaps in plain language and assign a next step. For example, an access list may reveal an account that needs removal.
If you regularly struggle to get clear answers about your systems, our guide to signs your IT provider is failing you offers additional questions to consider.
How GuardIT Supports Accounting Firms
GuardIT provides IT services for accounting firms throughout Washington DC, Maryland, and Northern Virginia.
We help firms review and improve the technology safeguards that support their security programs. That work can include managed IT, cybersecurity, Microsoft 365 administration, endpoint protection, secure remote access, and backup and recovery.
We also help connect technical findings to practical next steps. For example, a review can identify outdated devices, unnecessary access, gaps in backup coverage, or opportunities to improve how staff share files.
Your firm remains responsible for its program and applicable obligations. GuardIT can support the technology work and documentation that help your team make informed decisions.
Frequently Asked Questions
What does WISP stand for?
WISP stands for written information security plan. It describes how a business protects sensitive customer information, who oversees the work, and how the business reviews its safeguards.
Does a small tax practice need a written information security plan?
A tax preparation firm covered by the FTC Safeguards Rule needs an appropriate written security program. Certain firms with information concerning fewer than 5,000 consumers receive limited exemptions, but those exemptions do not eliminate the overall program requirement.
Can we use the IRS written information security plan template?
Yes. IRS Publication 5708 provides a sample template and supporting guidance. However, your firm needs to adapt it to its systems, employees, service providers, and data-handling practices.
How often should we update our written information security plan?
The IRS sample template recommends an annual review and updates after material changes. Also review the plan when you change software, staffing, providers, or the way you handle client information.
Can our IT provider help with the plan?
Yes. An IT provider can help document systems, evaluate technical risks, implement safeguards, and provide supporting records. Your firm should define the provider’s role and maintain the oversight required for its security program.
Does having a WISP mean our firm is fully compliant?
The document is one part of the program. Your firm also needs to implement and maintain applicable safeguards, assess its obligations, and address identified gaps. A completed template alone cannot establish that every requirement has been met.
Schedule Your Firm’s IT and Security Assessment
Does your security plan reflect the technology and procedures your accounting firm uses today?
GuardIT helps tax and accounting practices across Washington DC, Maryland, and Northern Virginia evaluate their IT environments and identify practical security improvements.
Schedule your firm’s IT and security assessment to review access, devices, Microsoft 365, backups, and other technology risks.
You can also contact GuardIT or call (202) 998-2378.
