Guide
Who this is for: Tax preparers, enrolled agents, CPAs, and small accounting firms who need to write (or fix) a written information security plan under the FTC Safeguards Rule, using IRS Publication 5708 as the starting template.
A written information security plan (WISP) is a document that spells out how your practice protects client data: who's in charge of security, where client information lives, what the risks are, what safeguards you use, and what you'll do if something goes wrong. For tax and accounting professionals it isn't optional. The IRS says tax professionals are legally required to have a written, accessible plan, and should review, test, and update it regularly (IRS, IR-2025-79).
The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to protect customer data. The FTC's Safeguards Rule, which implements that part of the law, lists "an accountant or other tax preparation service that is in the business of completing income tax returns" as an example of a financial institution (16 CFR 314.2, (h)(2)(viii)). IRS Publication 5708 puts it plainly: under the GLBA and the Safeguards Rule, tax and accounting professionals are considered financial institutions, regardless of size, and a WISP is required (IRS Pub 5708, p. 2).
The rule says your information security program must be written and appropriate to the size and complexity of your business, the nature and scope of your activities, and the sensitivity of the information you handle (FTC). It covers customer information in any form, paper or electronic (FTC). IRS Publication 4557 adds that tax preparers who don't create and enact a security plan may face an FTC investigation (IRS Pub 4557).
The IRS also asks about it when you get or renew a PTIN. Line 11 of Form W-12, the PTIN application and renewal form, asks you to confirm you're aware that paid tax return preparers are required by law to create and maintain a written information security plan (Form W-12 (Rev. October 2025)). The instructions describe that box as an acknowledgment of awareness (Instructions for Form W-12). It doesn't replace having the plan.
Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice, is a free sample WISP template from the IRS and its Security Summit partners. The IRS describes it as a 28-page template built to help tax professionals, especially smaller practices, develop a WISP (IRS, IR-2025-79). The current version is Rev. 8-2024 (IRS Pub 5708). It includes:
Pub 5708 is clear that it's sample material. It isn't meant to replace your own research or serve as a substitute for a plan built around your own business (IRS Pub 5708, p. 2). The IRS also publishes a shorter companion, Publication 5709, How to Create a Written Information Security Plan for Data Safety (IRS Pub 5709).
| Element | In plain English | Where it goes in a Pub 5708-style WISP |
|---|---|---|
| Qualified Individual | One person oversees and enforces the program. They can be an employee or work for a service provider. | Responsible officials (the "Data Security Coordinator") |
| Risk assessment | Identify what could go wrong with client data, and check whether your safeguards are enough. Redo it periodically. | Assess risks |
| Safeguards | Access controls, a data and device inventory, encryption, MFA, secure disposal, change management, and activity logging. | Hardware inventory and safety-measure policies |
| Monitoring and testing | Regularly test or monitor your safeguards. Without continuous monitoring, that means yearly penetration tests and vulnerability scans at least every six months. | Assess risks (monitoring procedures) and network protection |
| Staff training | Security awareness training for everyone, and qualified people running the program. | Training policy and employee code of conduct |
| Service providers | Pick vendors that can protect the data, require it in the contract, and check on them periodically. | Data disclosure policy |
| Keep it current | Adjust the program after tests, business changes, or new risks. | Annual review and implementation clause |
| Incident response plan | A written plan for responding to and recovering from a security event. | Reportable incidents and the breach procedures attachment |
| Annual report | The Qualified Individual reports in writing at least once a year to the board, or to a senior officer if there's no board. | Add a short reporting section |
Sources: 16 CFR 314.4; FTC Safeguards Rule guide. The third column is our suggestion for organizing your plan, not IRS or FTC text.
Need a written policy to start from? PolicyForge emails you a draft information security policy tailored to your organization, with optional NIST control mappings. It can give you a head start on the "safety measures" part of your WISP. One free sample per person; a template to review, not legal advice.
How to write your WISP, step by step. Have Pub 5708 open next to you (IRS Pub 5708). Check off each step as you finish it.
Done when: One named person owns the WISP, and someone is named to handle outside communications during an incident.
The Safeguards Rule requires a Qualified Individual to oversee and enforce your program. That person can be an employee or work for an affiliate or service provider. If it's an outside provider, you're still responsible, and you need a senior person at your firm to oversee them (16 CFR 314.4, (a)). The FTC notes the person doesn't need a particular degree or title (FTC).
Pub 5708 calls this role the Data Security Coordinator. It also suggests naming a Public Information Officer as the one voice for client notices, law enforcement, and media during an incident. In firms with two or more practitioners, those should usually be different people (IRS Pub 5708, pp. 7 and 13). In a one-person practice, it's you.
Done when: There's a written inventory of every device, account, and paper location that holds client data, plus a list of who can access it.
You can't protect what you haven't listed. The rule requires you to identify and manage the data, people, devices, and systems your business relies on (16 CFR 314.4, (c)(2)). Pub 5708 asks you to list the types of information you handle, then catalog every device that touches taxpayer data, with its location and what it stores or processes (IRS Pub 5708, pp. 13–14). Don't forget:
Pub 5708's Attachment E (hardware inventory) and Attachment F (people authorized to access client data) give you ready-made tables for this (IRS Pub 5708, pp. 24–25).
Done when: There's a written list of what could go wrong with client data, how likely and how bad each risk is, and what you're doing about it.
Your program has to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to client information and checks whether your safeguards are enough. The written version must include criteria for evaluating risks and say how each risk will be reduced or accepted. You also need to repeat the assessment periodically (16 CFR 314.4, (b)).
Pub 5708's examples of risks to think about include theft of paper or electronic files, remote-access takeover of your network, and loss from fire, hurricane, or other natural causes (IRS Pub 5708, p. 13).
Done when: Each safeguard policy in the Pub 5708 outline is filled in with what your practice actually does, not the sample text.
This is the biggest section of the WISP. The rule requires safeguards that include access controls, encryption of customer information in transit over external networks and at rest, secure disposal procedures, change management, and monitoring and logging of user activity (16 CFR 314.4, (c)). Disposal is specific: customer information must be disposed of no later than two years after you last used it to serve that customer, unless you have a business or legal need to keep it (FTC).
Pub 5708 suggests written policies for data collection and retention, data disclosure, network protection, user access, electronic data exchange, Wi-Fi access, remote access, connected devices, and reportable incidents, plus an employee code of conduct (IRS Pub 5708, p. 4). Our Wi-Fi checklist, antivirus guide, and backup guide can help you fill in those sections.
Done when: Everyone who accesses client data signs in with multifactor authentication, and remote access is allowed only with MFA.
The Safeguards Rule requires multifactor authentication for any individual accessing any information system, unless your Qualified Individual approves an equivalent or more secure control in writing (16 CFR 314.4, (c)(5)). Pub 5708's sample remote access policy allows remote access only with MFA in addition to a username and password (IRS Pub 5708, p. 12).
The sample plan mentions text-message codes as one MFA option. Text codes count as MFA, but CISA calls them a last resort and recommends authenticator apps, or phishing-resistant options like passkeys and security keys, where you can (CISA fact sheet). See our MFA setup guide for how to do it.
Done when: There's a written plan that says who does what after a breach, who you notify, and how fast.
The rule requires a written incident response plan covering its goals, your internal response process, clear roles and decision-making authority, internal and external communications, fixing the weaknesses that caused the incident, documentation and reporting, and updating the plan afterward (16 CFR 314.4, (h)).
Include the FTC notice requirement. If a security event involves the unencrypted information of at least 500 consumers, you must notify the FTC as soon as possible and no later than 30 days after discovery (16 CFR 314.4, (j)), using the FTC's online Safeguards Rule reporting form. Pub 5708's breach attachment also lists who else to contact, including your IRS Stakeholder Liaison, state tax agencies, your state attorney general, and law enforcement (IRS Pub 5708, p. 22). The IRS says to report client data theft to your local IRS Stakeholder Liaison quickly, so it can take steps to block fraudulent returns (IRS data theft info for tax pros). Our free IR Plan Builder can help you draft this section.
Done when: Every outside provider that can see client data is listed, required by contract to protect it, and reviewed periodically.
You have to take reasonable steps to choose service providers that can protect customer information, require safeguards in their contracts, and periodically assess them based on the risk they present (16 CFR 314.4, (f)). Pub 5708 points out that an IT support company may see client data during contracted work, and that vendors like your IT provider, cleaning service, or copier technician should know you handle sensitive data (IRS Pub 5708, pp. 10 and 17). Our free Vendor Risk Scorecard is a quick way to rate each one.
Done when: Everyone with access to client data has been trained and has signed an acknowledgment of the WISP.
The rule requires security awareness training for your staff, updated as your risk assessment changes (16 CFR 314.4, (e)). Pub 5708 recommends a signed and dated Employee/Contractor Acknowledgment of Understanding, refreshed at annual training (Attachment D is a sample), and its sample plan has new employees trained before they get access to client data (IRS Pub 5708, pp. 3, 12, and 23).
Done when: The plan is signed and dated, there's a testing schedule, a yearly written report is on the calendar, and the next review date is set.
You must regularly test or monitor your safeguards. Without effective continuous monitoring, that means penetration testing every year and vulnerability assessments at least every six months, and after material changes to your business (16 CFR 314.4, (d)). Your Qualified Individual must report in writing at least once a year to your board, or to a senior officer if there's no board (16 CFR 314.4, (i)).
Finish with Pub 5708's implementation clause: the date, your firm name, a statement that the plan complies with the GLBA and the FTC Safeguards Rule (and any state rules that apply), and signatures from the owner and the Data Security Coordinator (IRS Pub 5708, p. 16). Then save it somewhere others can easily read it, like PDF or Word, and keep a copy off site or in the cloud (IRS Pub 5708, p. 3).
If your firm keeps customer information on fewer than 5,000 consumers, four parts of the rule don't apply: the written risk assessment requirement in 314.4(b)(1), the penetration testing and vulnerability scanning requirement in 314.4(d)(2), the written incident response plan, and the annual written report (16 CFR 314.6). Everything else still applies, including having a written program, basing it on a risk assessment, MFA, encryption, vendor oversight, and FTC breach notices. The IRS also recommends that tax professionals develop a data theft response plan (IRS, IR-2025-79), so we'd still write one.
Yes. Under the Gramm-Leach-Bliley Act and the FTC Safeguards Rule, tax and accounting professionals are treated as financial institutions and must have a written information security plan (IRS Pub 5708, p. 2). The IRS says tax pros are legally required to have a written, accessible plan (IRS, IR-2025-79).
Yes. IRS Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice, is a free sample template with an outline, a sample plan, and six sample attachments. It's a PDF you can download from irs.gov (IRS Pub 5708).
Yes. Pub 5708 says tax and accounting professionals are covered regardless of size, and that a sole practitioner can use a more abbreviated and simplified plan than a larger firm (IRS Pub 5708, pp. 2–3).
Line 11 of Form W-12, the PTIN application and renewal form, asks you to acknowledge that you're aware paid tax return preparers are required by law to create and maintain a written information security plan (Instructions for Form W-12). Checking the box doesn't replace having the plan.
If a security event involves the unencrypted information of at least 500 consumers, notify the FTC as soon as possible and no later than 30 days after you discover it, using the FTC's online form (16 CFR 314.4, (j)). The IRS also asks tax pros to report client data theft to their local IRS Stakeholder Liaison (IRS data theft info for tax pros).
Pub 5708's sample plan calls for a review at least once a year and whenever your business changes in a way that affects client data (IRS Pub 5708, p. 7). The Safeguards Rule also requires you to adjust your program after testing, business changes, or new risk assessments (16 CFR 314.4, (g)).
Not the whole thing. PolicyForge emails you one free draft information security policy tailored to your organization. You can use it as a starting point for the safety-measures section of your WISP. It's a template to review, not legal advice, and you still need the inventory, risk assessment, incident plan, and signatures described above.
Checked on October 16, 2026.
This guide is general information, not legal advice. Check the current rule and IRS publications, and talk to your own counsel about your obligations. Hawkcrest Cyber is an independent consultancy and isn't affiliated with the IRS, the FTC, or any agency cited here.
Hawkcrest 
Hawkcrest Cyber