A Written Information Security Plan, or WISP, documents how a business identifies risks to customer information and the safeguards it uses to manage them. For tax and accounting professionals it is a legal expectation. The FTC Safeguards Rule treats tax preparers as financial institutions, and the IRS reminds every preparer that a WISP is required. IRS Publication 5708 provides a template aimed at small practices, and Publication 4557 covers safeguarding taxpayer data more broadly.
A useful WISP names a qualified person responsible for the program, inventories where client data lives, and describes the controls actually in place, such as access limits, multi-factor authentication, encryption, secure disposal, vendor oversight, employee training, and an incident response plan. The most common failure is a template filed away and never implemented. The plan should match reality and be reviewed regularly.
Example
A three-person practice lists its tax software, portal, email, laptops, and backups, records who can access each, enforces MFA everywhere, and schedules a review before every filing season.