The WISP your accounting firm needs before tax season (IRS Publication 4557)

Every January, accounting firms across Tampa Bay get ready for the busiest stretch of the year. New software updates, new seasonal staff, and a mountain of Social Security numbers coming through the door.

Before the first return goes out, there is one document the IRS keeps reminding tax pros about: a written information security plan, or WISP. The IRS and its Security Summit partners repeated the reminder on August 18, 2026 (IR-2026-92). Here is what the plan is, what IRS Publication 4557 asks for, and how to write one without losing a week.

This post is educational, not legal advice. For how the rules apply to your firm, talk with your attorney or professional association.

What is a WISP, and does my firm need one?

A WISP is a written document that describes how your firm protects client information, and if you prepare tax returns, you almost certainly need one. The FTC lists tax preparation firms among the financial institutions covered by its Safeguards Rule, and the rule requires a written information security program.

The IRS puts it plainly in Publication 4557, Safeguarding Taxpayer Data:

The same page says that under the FTC Safeguards Rule, tax return preparers must create and enact security plans to protect client data, and adds: "Failure to do so may result in an FTC investigation." The IRS's August 2026 release gives the legal root: the Gramm-Leach-Bliley Act treats tax and accounting professionals as financial institutions that must protect customer data.

Size does not get you out of it. Publication 4557 says data security is a necessity for every tax professional, "whether a partner in a large firm or a sole practitioner."

What does IRS Publication 4557 ask tax professionals to do?

Publication 4557 walks tax pros through basic security steps, spotting and reporting data theft, and complying with the FTC Safeguards Rule. Its core steps include multi-factor authentication, encryption, offline backups, and limiting who can see taxpayer data.

Here are the basic security steps from the guide, plus a few habits it warns against:

The multi-factor line is not optional. Publication 4557's Safeguards Rule section says MFA "is required for all companies regardless of size."

What must a WISP include under the FTC Safeguards Rule?

The FTC lists nine elements: a Qualified Individual in charge, a risk assessment, safeguards for the risks you find, regular testing, staff training, oversight of service providers, keeping the program current, a written incident response plan, and regular reports to leadership.

	In plain English	What it looks like at a 20-person firm
Qualified Individual	One person owns the program	A partner or office manager, backed by your IT provider
Risk assessment	Find where client data lives and what could go wrong	A list of every system holding tax data: tax software, portal, email, file storage
Safeguards	Controls that address those risks	MFA, encryption, access limits, secure disposal
Monitor and test	Prove the controls work	Restore tests, access reviews, security scans
Train staff	Everyone knows the rules	Phishing training before the season starts
Oversee service providers	Vendors protect data too	Contract terms and reviews for software, cloud and IT vendors
Keep it current	Update as the firm changes	A review after new software, new hires or an office move
Incident response plan	A written plan for a breach	Who calls the IRS, the insurer and, if needed, the FTC
Report to leadership	The Qualified Individual reports in writing	At least once a year to the partners

• In plain English

  Qualified Individual

  One person owns the program

  Risk assessment

  Find where client data lives and what could go wrong

  Safeguards

  Controls that address those risks

  Monitor and test

  Prove the controls work

  Train staff

  Everyone knows the rules

  Oversee service providers

  Vendors protect data too

  Keep it current

  Update as the firm changes

  Incident response plan

  A written plan for a breach

  Report to leadership

  The Qualified Individual reports in writing

• What it looks like at a 20-person firm

  Qualified Individual

  A partner or office manager, backed by your IT provider

  Risk assessment

  A list of every system holding tax data: tax software, portal, email, file storage

  Safeguards

  MFA, encryption, access limits, secure disposal

  Monitor and test

  Restore tests, access reviews, security scans

  Train staff

  Phishing training before the season starts

  Oversee service providers

  Contract terms and reviews for software, cloud and IT vendors

  Keep it current

  A review after new software, new hires or an office move

  Incident response plan

  Who calls the IRS, the insurer and, if needed, the FTC

  Report to leadership

  At least once a year to the partners

Three numbers from the FTC's guide (December 2024) matter for small firms:

1. 01

   500 or more

   consumers' unencrypted information in a breach triggers a report to the FTC, a requirement in effect since May 2024

2. 02

   30 days

   after discovery is the outside limit for that report, per the FTC

3. 03

   Fewer than 5,000

   consumers: firms below this line are exempt from certain provisions of the rule, not the whole rule, per the FTC

The FTC's guide does not list those exempt provisions on the same page. It points to Section 314.6 of the Safeguards Rule (16 CFR Part 314), which is worth reading with your advisor before you decide what your plan can skip.

How do you write a WISP for a small accounting firm?

Start from the IRS template in Publication 5708, Creating a Written Information Security Plan for Your Tax & Accounting Practice, and fill it in for your firm: who is in charge, where client data lives, what controls you use, and what you do if something goes wrong.

The IRS describes Publication 5708 as a template to help tax professionals, "especially smaller practices," build a plan. Here is the order we would work in:

1. 01

   Name your Qualified Individual

   Pick one person with the authority to make changes, and write their name in the plan.

2. 02

   Map your data

   List every computer, server, cloud app and filing cabinet that holds client information. Publication 4557 calls for a careful inventory.

3. 03

   Assess the risks

   The IRS asks you to cover three areas: employee management and training, information systems, and detecting and managing system failures.

4. 04

   Write down your safeguards

   MFA, encryption, backups, access limits, and how old equipment gets wiped.

5. 05

   Vet your vendors

   The IRS says your contracts should require service providers to keep appropriate safeguards.

6. 06

   Plan for a data theft

   Write down who calls whom, starting with your IRS Stakeholder Liaison.

7. 07

   Store it and review it

   The IRS suggests a PDF or Word file, a stored digital copy in case of a natural disaster, and regular updates as the firm changes.

That disaster line matters here. A WISP saved only on the office server does you no good if a storm takes the office offline in hurricane season.

Need the technical half of your WISP filled in?

Our free network assessment inventories your devices, sign-ins and backups, which gives you the facts for steps two through four in plain language.

What happens if client tax data is stolen?

Report it to the IRS right away through your Stakeholder Liaison, then contact the states where you file returns, law enforcement, your insurer and a security expert. If 500 or more people's unencrypted data was taken, the FTC also expects a report within 30 days of discovery.

Publication 4557 splits the work into two jobs:

Writing this list into your WISP now is the whole point of the incident response element. On the worst day of the season, nobody should be searching for phone numbers.

How can an IT provider help with your WISP?

An IT provider cannot sign your WISP for you, but it can handle most of the technical work the plan describes: multi-factor sign-in, encryption, backups, monitoring, the device inventory, and the logs that show it all happened.

Publication 4557 even suggests it. Among its IRS suggestions: "consider having a technical support contract in place, so that hardware events can be fixed within a reasonable time." A support agreement does not have to lock you in, though. Ours runs month to month, with no contract, and we can supply the technical details your plan needs.

At Radiant Technology Solutions we support accounting and financial firms across Tarpon Springs, Clearwater, Tampa and the rest of Tampa Bay. Our 2026 brochure points those firms to Radiant Elite, which adds enhanced multi-factor authentication, secure password management, security awareness training, dark web monitoring and data loss prevention on top of our other plans, as listed on our managed IT pricing page. Our IT for accounting and CPA firms page covers the details, and our cybersecurity services and backup and disaster recovery pages explain the controls a WISP leans on. If your insurer is asking similar questions, see our guide to cyber insurance requirements in Florida.

If tax season is coming and your WISP is still a blank template, start with our free network assessment. We will document what you have and show you what is missing, so the plan you write matches the firm you actually run.