WISP Template for Tax Professionals: The Free IRS Template, and How to Fill It In
¿Prefiere leer en español? Esta guía está disponible en español.
Is there a free WISP template for tax professionals?
Yes. The free WISP template for tax professionals is IRS Publication 5708, “Creating a Written Information Security Plan for your Tax & Accounting Practice,” written by the IRS Security Summit. It includes a fill-in sample plan and six sample attachments. You should not pay anyone for the document. What takes work is making what it says true in your office, and this guide covers both.
Publication 5708 (Rev. 8-2024) is 29 pages. The Security Summit is the IRS, state tax agencies and the tax industry working together, and the template is written for smaller practices. It says plainly that there is “no one-size-fits-all WISP”: a sole practitioner can use a shorter, simpler plan than a 10-partner firm.
Do tax preparers have to have a WISP?
Yes. Under the Gramm-Leach-Bliley Act, tax and accounting professionals are “financial institutions,” regardless of size, and the FTC Safeguards Rule requires every financial institution to implement and maintain a written information security plan. Pub 5708 says your WISP “must be written and accessible.” Line 11 of the PTIN renewal form, Form W-12, asks you to confirm you know about this requirement, which is why the question comes up every fall.
The requirement is not just the document. The FTC rule also asks you to name a Qualified Individual, assess risks, put safeguards in place and test them, oversee your vendors, and use multi-factor authentication for anyone accessing your systems. The plan is where you write those down.
What does the IRS WISP template include?
Pub 5708’s outline has seven parts. In plain terms:
- Objectives, purpose and scope. What the plan covers and why. The template’s sample text is usable almost as written.
- A Qualified Individual. The one person who coordinates security (Pub 5708 also calls this the Data Security Coordinator), plus who else has access to client data and at what level.
- Risk assessment. The types of client information you handle, where it could be lost (inside and outside the office), and how you monitor and test for that.
- Hardware inventory. Every computer, server, phone and drive that touches client data, where it is, and what it holds.
- Safety measures. Your policies for data collection and retention, disclosure, network protection, user access, electronic data exchange, Wi-Fi, remote access, connected devices and reportable incidents, plus an employee code of conduct.
- Implementation clause. The date, the firm name, a statement that the plan complies with the GLBA and the FTC Safeguards Rule, and the owner’s and coordinator’s signatures.
- Attachments. Pub 5708 provides samples for each: A record retention policy, B rules of behavior for safeguarding client data, C security breach procedures and notifications, D employee and contractor acknowledgement, E hardware inventory, and F employees authorized to access client data.
How do you fill in the WISP template so it holds up?
Most templates get filled in once, in an afternoon, and never match the office again. These are the parts we see go wrong most often:
- Section II names a person, not “the office.” One named Qualified Individual, with a backup. If that is an outside IT provider, say so and name the contact.
- Section III lists where client data actually lives, not just the tax software: email, the scanner’s inbox, the client portal, a shared folder, a laptop that goes home, backups, and any AI tool someone has connected to company email.
- Section IV and Attachment E come from a real walk-around, including the old PC in the back and the personal phones that get work email.
- Section V only states what is true today. If multi-factor sign-in is on for the tax software but not for email, the plan should say that, and say when email gets it. A plan that claims safeguards you don’t have is worse than no plan.
- Attachment C has real phone numbers: your IT contact, your insurer, the IRS Stakeholder Liaison for your state. In a breach nobody goes looking for them.
- Attachment D gets signed every year by everyone, including seasonal staff, so you have a record that training happened.
Is a smaller office exempt from any of it?
Partly. Under the FTC Safeguards Rule (16 CFR 314.6), a firm that maintains customer information on fewer than 5,000 consumers is exempt from four specific requirements: the written risk assessment, continuous monitoring or annual penetration testing, the written incident response plan, and the annual report to the board. Everything else still applies, including the WISP itself, the Qualified Individual, multi-factor authentication, encryption, staff training and vendor oversight. Pub 5708 recommends documenting your risks and breach procedures anyway, because that is what you will reach for when something goes wrong.
Is there a deadline for the IRS WISP?
There is no separate IRS filing deadline, and you do not send your WISP to the IRS. The FTC’s amended Safeguards Rule has been in full effect since June 2023, so the plan should already exist. The practical dates are the PTIN renewal season (October to December 31), when Line 11 asks about it, and before filing season starts in January, when there is no time to change anything. Pub 5708 says to review and update the plan at least annually.
What does the WISP not do for you?
It does not turn on multi-factor authentication, encrypt a laptop, test a backup or remove a former seasonal preparer’s access. The template is the list; the work is making each line true and being able to show it. A quick way to see how far you are from that: our free readiness check takes three minutes and scores your office against the twelve controls examiners ask about first, with the rule behind each gap. The same twelve are laid out in our FTC Safeguards Rule checklist for tax preparers, with a printable PDF. If you want the full FTC picture for tax offices, see our FTC Safeguards self-assessment, and for what Line 11 does and doesn’t mean, our Line 11 explainer.
Running Drake? See what to write in the WISP for a Drake office. Two more checks worth doing while you are filling in Section V: whether someone could send email pretending to be your firm (7 of the 10 Polk County tax offices we checked could be), and whether your tax software is still supported on your PCs (none of Drake, Lacerte, UltraTax or ProSeries supports Windows 10).
Want Help Making the Plan True?
iTech Plus works with tax and accounting offices across Polk County. We help you fill in Pub 5708 so it matches your office, then put the safeguards in place and keep them there through filing season, with the plan and the evidence kept current in our WISP Manager. Start with what a tax firm should ask an IT provider, or book a free IT assessment. Call (321) 221-7117 or email info@itechplus.co.
General information about IRS and FTC guidance, not legal or tax advice.
