The IRS and its Security Summit partners have issued another reminder that all tax professionals must maintain a Written Information Security Plan (WISP). This is not optional and applies regardless of your firm’s size. If you prepare even a single tax return, you are required to have a documented plan for protecting client data. Here is a practical guide to getting it done.
Why This Matters Now
Identity theft and data breaches targeting tax professionals have increased. A single compromised preparer can expose hundreds of clients to fraudulent filings. The IRS takes this seriously: failure to maintain adequate data security practices can result in sanctions, loss of your PTIN, and potential liability under federal and state data protection laws.
What a WISP Must Include
The IRS Publication 5708 provides a 28-page template that covers the essential elements. Your WISP should address: who in your organization is responsible for security, what client data you collect and where it is stored, how you protect data in transit and at rest (encryption, secure email, locked storage), your procedures for employee training and access controls, your incident response plan if a breach occurs, and how you dispose of client data after the retention period expires.
Practical Steps for Solo and Small Firms
Start with the IRS template. Publication 5708 is designed for small practices. It walks you through each section with plain-language explanations and checkboxes. You do not need to hire a consultant to create an adequate WISP, though complex firms may benefit from one.
Inventory your data. List every place client data exists: your tax software, email, cloud storage, paper files, USB drives, and your phone. Each location needs a security control.
Implement basic controls. Use multi-factor authentication on all accounts that access client data. Encrypt email attachments containing sensitive information. Keep your tax software and operating systems updated. Use a dedicated computer for tax preparation rather than a family or shared device.
Train your staff. If you have employees, they need annual security awareness training. Document the training with dates, topics covered, and attendee sign-off.
Test your plan. At least annually, review your WISP against your actual practices. Have your procedures changed? Are there new data storage locations you have not addressed? Update the document accordingly.
Bottom Line
Creating a WISP takes a few hours for a small practice. The IRS template does most of the work. Do not let this requirement linger. Having a documented, implemented security plan protects your clients, protects your practice, and satisfies a federal mandate that the IRS is increasingly willing to enforce.