Drake Software WISP: What Drake Gives You, and What Your Plan Still Needs
Does Drake Software have a WISP template?
No. There is no Drake Software WISP template; Drake does not publish its own. Drake’s knowledge base article on the IRS Written Information Security Plan (updated March 2026) points preparers to the IRS Security Summit’s sample plan and to IRS Publications 4557, 5708 and 1345. Separately, Protection Plus, sold through Drake, offers a free tool to build a personalized WISP template. Either way, the plan has to describe how your office actually runs Drake, and that part is yours to write.
The standard starting point is IRS Publication 5708, which we walk through section by section in the WISP template for tax professionals. This page covers the Drake-specific parts: what Drake already does for you, what it doesn’t, and what to write in the plan.
What does Drake Tax already do for your security?
Quite a lot, as long as the settings are left on. From Drake’s own documentation:
- Multi-factor authentication is on by default for all users since Drake Tax 2021, using an authenticator app (Drake KB 15895).
- Per-preparer security rights control who can open, edit and transmit returns.
- Password rules, lockout and session timeouts are built in.
- Scheduled backups (a weekly full backup with daily incrementals) to a local or network location, or to Drake Portals.
- Hosting through Rightworks, the only hosting provider Drake supports, and Drake Tax Online in the browser since September 2025.
What does Drake not do for you?
Everything outside the program, which is where most incidents start:
- It can’t stop an admin turning MFA off. The Primary Admin can disable MFA for any user, or for everyone at once. If someone did that in April because it was annoying, it is still off. Check: log in as ADMIN, Setup › Preparers and Users, select each user, Edit User, and make sure Disable Multi-Factor Authentication (MFA) under Login Information is not ticked.
- It doesn’t protect your email. The Safeguards Rule requires MFA for anyone accessing customer information, which includes email and remote access, not only the tax program. A stolen email password is the most common way a tax office gets hurt.
- It doesn’t encrypt the PCs. BitLocker on Windows has to be turned on separately on every machine that holds client data.
- It doesn’t make the backup safe. A backup to a drive plugged into the same server is reachable by ransomware. Keep a copy offsite, and restore a file to prove it works.
- It doesn’t keep Windows current. Drake stopped supporting Windows 10 after Drake Tax 2024, and Windows 11 version 24H2 stopped getting security updates on October 14, 2026.
What should a Drake office write in its WISP?
Using the Pub 5708 outline, these are the lines that should mention Drake by name:
- Section II, authorized users: list each Drake user and their security rights. Include seasonal preparers, and the date their access ends.
- Section III, risks: where Drake data lives. For a network install, that is the shared data folder on the server (Drake does not support NAS devices for this); for hosted users, Rightworks; for Drake Tax Online, the browser and whoever can sign in.
- Section IV, hardware inventory: the server or host PC and every workstation running Drake, with its Windows version.
- Section V, safety measures: “MFA is required for every Drake user and is not disabled for anyone”; how Drake backups are made, where the offsite copy is and when it was last restored; how remote staff reach Drake (hosting, or a VPN with MFA, which the IRS describes as the minimum for remote access in Publication 4557).
- Attachment F, employees authorized to access client data: the same Drake user list, signed off once a year.
Only write what is true today. If MFA is on for Drake but not yet for email, say so, and say when email gets it.
Is Drake a vendor you have to oversee?
Yes. The Safeguards Rule requires you to oversee service providers that handle customer information, by contract (16 CFR 314.4(f)). Drake, Rightworks if you host there, your bank-product provider and your client portal all belong on your vendor list, with a note of where their security terms are. You don’t need to audit Drake; you need to show you chose providers that protect the data and that you know what each one holds.
How do you check your Drake office quickly?
- Run the MFA check above for every user. It takes five minutes.
- On each PC: Windows key + R, type winver. Anything on Windows 10, or Windows 11 24H2 or older, needs attention.
- Take our free readiness check for the full picture: twelve controls, three minutes, with the rule behind each gap. The same twelve are in our FTC Safeguards Rule checklist.
- Compare Drake’s IT requirements with Lacerte, UltraTax CS and ProSeries in our tax software comparison.
Want Help Getting Your Drake Office Right?
iTech Plus works with tax offices across Polk and Osceola counties, in English and Spanish. We check the Drake settings, put the safeguards in place around it, and keep the plan and the evidence current in our WISP Manager. Book a free IT assessment, or call (321) 221-7117 or email info@itechplus.co.
General information based on Drake Software’s and the IRS’s published documentation as of October 2026. Not legal or tax advice, and not affiliated with Drake Software.
