Tax professionals are required to maintain a written information security plan, or WISP, under the FTC Safeguards Rule. The IRS has published a sample plan in Publication 5708 to help small practices get started. Many firms download a template, fill in the name, and file it. That satisfies nobody, including the firm, its clients, and anyone who asks after an incident.
A useful WISP describes your actual practice and the safeguards actually in place. Here is how to write one in a few focused sessions.
Step 1: Name the person responsible
The Safeguards Rule calls for a qualified individual to oversee the program. In a small practice, that is usually a partner or office manager, sometimes with an outside IT provider. Write down who it is and what they are responsible for.
Step 2: Inventory client data
You cannot protect what you have not listed. Walk through where client information lives:
- Tax preparation software, local or cloud.
- Client portal and e-signature tools.
- Email accounts, including staff phones.
- Laptops, desktops, and external drives.
- Cloud storage and shared folders.
- Backups, wherever they are.
- Paper files and the office itself.
For each, note who has access and how they sign in.
Step 3: Assess the risks
For each location, ask what could go wrong and how likely and harmful it would be. Common risks in small practices include phishing that leads to a compromised mailbox, stolen or lost laptops, former employees with lingering access, weak or reused passwords, unpatched computers, and backups that cannot be restored. Rank them. This becomes your written risk assessment.
Step 4: Describe the safeguards, and fill the gaps
Now write down how each risk is controlled. Be honest. If a safeguard does not exist yet, list it as a planned action with a date. Core safeguards for a practice include:
- Multi-factor authentication on email, tax software, portal, and remote access.
- Least-privilege access, so each person sees only what their role needs, with prompt removal when someone leaves.
- Encryption of laptops and backups.
- A secure portal for document exchange instead of email attachments.
- Patching of operating systems and applications on a schedule.
- Backups with an offline or immutable copy, tested by restoring.
- Training on phishing and payment fraud, at least annually.
- Vendor oversight for any provider that handles client data.
Step 5: Plan for incidents
Write a short incident response section. It should say who leads, who to call (IT provider, insurer, attorney), how to contain the problem, and the reporting steps that apply, including contacting the IRS and the states where you file about data theft, and notifying the FTC of qualifying events where the rule requires it. Keep a printed copy.
Step 6: Review on a schedule
Set a review date before each filing season and after any significant change, such as new software, new staff, a move, or a new service provider. Note what changed.
Keep it short and true
A ten-page plan that matches your practice is far more valuable than a fifty-page template nobody follows. Use our WISP checklist to check coverage. If you would like help implementing the technical safeguards, our cybersecurity work for tax professionals focuses on exactly these controls. Zacello supports several of them directly, with two-factor sign-in for every account, versioned and scanned uploads, firm-level data separation, and an audit trail the application cannot alter.
Written by the Syntonyl team. This article is general information, not legal, tax, or financial advice.