Accountio / Templates / WISP kit / Written information security plan

Written information security plan template for tax and accounting firms

Set out in one document how your firm protects client Social Security numbers, tax records and bank details, in the order the FTC Safeguards Rule lists its requirements. This written information security plan template is one Word plan, ready for your firm's name, people and systems.

US firms
$12
In the pack
WISP kit for tax and accounting firms
Files
5, Word and Excel
Buy the pack · $12
US library · 46 packs

Get this pack and 45 more for $69

WISP kit · this packBookkeeping and advisory lettersAudit and AUP lettersCompilation and review lettersIndependent contractors1040 checklistsIRS noticesSales tax nexusNonprofit audit+ 37 more
$69$61589% off

You save $546 on buying them one by one

Buy the US library · $69

Want every pack, for every region? Global library, 101 packs, $129

What the plan looks like

Written information security plan template
What the plan sets outSection in the plan
Who is in charge of security
✓
1. Qualified IndividualA named person, with wording for when the role is outsourced
What client information you hold
✓
2. The information we protectNames, taxpayer IDs, dates of birth, income and tax records, bank details and ID documents
A written risk assessment
✓
3. Risk assessmentEach risk rated for likelihood and impact, reduced or accepted with a reason, reviewed at least yearly
Access, MFA, passwords and encryption
✓
4. Our safeguardsNeed-to-know access, multi-factor authentication on every system with client data, encryption at rest and in transit
Devices, backups, remote work and paper files
✓
4. Our safeguardsPatching, tested backups, firm devices only, locked cabinets and a clean desk
Disposal within two years
✓
4. Our safeguardsClient information disposed of no later than two years after it was last used, unless the law or a business reason requires keeping it
Testing and monitoring
✓
4. Our safeguardsContinuous monitoring, or a yearly penetration test and vulnerability scans at least every six months
Staff training
✓
5. StaffTraining on joining and at least once a year, phishing awareness and a signed acknowledgment
Service providers
✓
6. Service providersContracts that require safeguards and a review of each provider at least once a year
Tax return information
✓
7. Client information under IRC section 7216Used and disclosed only to prepare returns, as the law allows or with written consent
Breaches and the FTC
✓
8. If something goes wrongThe incident response plan, the FTC within 30 days for 500 or more consumers, and the IRS Stakeholder Liaison
Yearly review and report
✓
9. Keeping the plan currentA review at least once a year and a written report to the partners or owners

Who needs one

The FTC Safeguards Rule treats an accountant or other tax preparation service that completes income tax returns as a financial institution, and requires a written information security program. The IRS describes the written information security plan (WISP) as a requirement for tax and accounting professionals of every size, and Form W-12 asks preparers to confirm they know about it when they apply for or renew a PTIN. Use this one when:

  • You prepare tax returns and have no written plan yet
  • Your current plan doesn't cover multi-factor authentication, encryption or FTC breach notices
  • You are renewing your PTIN and want the plan in place behind the Form W-12 answer
  • Your cyber insurer or a client asks to see your security plan

How to use the written information security plan template

  1. Name your Qualified Individual. One person oversees the plan. If an outside provider does it, name the person at the firm who supervises them.
  2. List your information and systems. Write down where client data is stored and which devices and systems can reach it. The kit's security workbook has an inventory for this.
  3. Fill in your safeguards. Replace the yellow fields with your real settings: review frequency, password length, password manager, backup schedule and how you send documents to clients.
  4. Choose your testing option. Keep the continuous monitoring wording or the yearly penetration test and six-monthly scan wording, and delete the other.
  5. Approve, train and review. Sign the plan, walk staff through it, have each person sign the acknowledgment and review it at least once a year.

Questions

Is a WISP required by the IRS?

The requirement comes from the FTC Safeguards Rule, which applies to tax and accounting firms as financial institutions. The IRS points preparers to it in Publication 5708 and Publication 4557, and Form W-12 asks preparers to confirm they know paid preparers must create and keep a written information security plan.

What should a written information security plan include?

A Qualified Individual, a written risk assessment, safeguards such as access controls, encryption and multi-factor authentication, secure disposal, change management, monitoring or testing, staff training, service provider oversight, an incident response plan and a written report to the owners at least once a year.

Does a small tax practice need a WISP?

Yes. Every firm that prepares tax returns needs a written information security program. A firm holding information on fewer than 5,000 consumers is exempt from four parts only: the written risk assessment, penetration testing and scans, the written incident response plan and the yearly report. Everything else still applies.

Is a WISP required for a PTIN?

Form W-12, used to apply for or renew a PTIN, asks preparers to tick a box confirming they know paid tax return preparers are required by law to create and maintain a written information security plan.

How often should a WISP be reviewed?

At least once a year, and after any security incident or significant change to the firm's systems. The Safeguards Rule also requires the Qualified Individual to report in writing to the owners at least once a year.

Also in the WISP kit for tax and accounting firms

Security workbookIncident response planStaff acknowledgmentAnnual report to owners

See the whole pack →

Who it's for

Small CPA, EA and tax preparer firms that need a written plan that matches how they really work.

Last checked

Checked against the FTC Safeguards Rule, IRS Publication 5708 and the Form W-12 instructions in November 2026.