Tax professionals are expected to maintain a written information security plan, or WISP, under the FTC Safeguards Rule. The IRS publishes a sample plan in Publication 5708. A plan on paper is only useful if the safeguards it describes exist in practice.
Use this checklist to review both, meaning what your plan says and whether your systems match it. Revisit it before every filing season and whenever staff, software, or vendors change.
Program basics
- A qualified individual is named as responsible for the security program.
- The plan describes the practice, its data, and its systems in plain language.
- A written risk assessment identifies where client data could be exposed.
- The plan is reviewed at least annually and after significant changes.
Data and access
- An inventory lists where client data lives, including tax software, portal, email, laptops, cloud storage, paper, and backups.
- Each person's access is limited to what their role requires.
- Former staff and unused accounts are disabled promptly.
- Multi-factor authentication protects email, tax software, portals, and remote access.
Technical safeguards
- Laptops and backups are encrypted.
- Client documents are exchanged through a secure portal, not ordinary email.
- Operating systems and applications are patched on a schedule.
- Backups follow the 3-2-1 rule, with one copy offline or immutable, and restores are tested.
- Networks separate staff computers from guests and other devices.
People and vendors
- Staff receive security and phishing training at least annually.
- Payment and bank-detail changes are verified by phone.
- Service providers that handle client data are reviewed and bound by contract.
Incidents
- An incident response plan lists who to call and what to do first.
- The plan includes reporting data theft to the IRS and state agencies as required.
- The plan covers notifying the FTC of qualifying security events where required.
- Contact details for your IT provider, insurer, and attorney are stored offline.
This template is general guidance, not legal, tax, or financial advice. Adapt it to your business and confirm requirements with a qualified adviser.