What a WISP Actually Is for a Tax or Accounting Firm

What a WISP is

WISP stands for Written Information Security Plan. In plain language, it is the document (or document set) that describes how your firm protects client and customer information.

Under the FTC Safeguards Rule, covered financial institutions must develop, implement, and maintain a comprehensive written information security program with administrative, technical, and physical safeguards appropriate to size, complexity, and the sensitivity of customer information.^[5][6]

It is not a marketing PDF. It is not a binder that exists only for an insurance email. It is the written spine of an information security program: who is responsible, what you protect, what can go wrong, what controls you rely on, how you oversee vendors, what you do when something looks wrong, and how you keep the plan current.

If a stranger who understands accounting operations read only your WISP, they should recognize your firm, not a generic small business.

Why this matters for accounting firms

Accounting and tax practices move sensitive client information through email, portals, tax and accounting platforms, document systems, payroll tools, remote staff, and seasonal workers. Partners also face questionnaires from clients, carriers, and counterparties who ask whether a written plan exists and whether it is real.

Public educational materials from the IRS and Security Summit partners emphasize that tax and accounting professionals are expected to create and maintain a written information security plan under the federal framework that includes the Gramm-Leach-Bliley Act and the FTC Safeguards Rule.^[1][2][3] The FTC’s Part 314 definitions include an accountant or other tax preparation service that completes income tax returns as a financial institution example.^[7] Whether every accounting-only activity is covered can depend on facts: treat firm-specific coverage as a question for counsel, not a blog conclusion.

A WISP also forces clarity when technology is outsourced. Many firms have an MSP or IT provider. That does not automatically create program documentation, a risk assessment anyone can find, or partner-ready evidence. The WISP is where the firm states how those pieces fit together. Public Safeguards text also expects covered institutions to oversee service providers (select capable providers, require safeguards by contract, and periodically assess them).^[4]

What good looks like

A useful WISP for a tax or accounting firm typically:

1. Names accountability. Who coordinates the program? Who can approve material changes? What happens when that person is out during filing season? (Public Safeguards text discusses designating a Qualified Individual to oversee the program.^[5])
2. Describes the real environment. Systems that hold client data, how staff connect, which vendors matter, where paper and digital records live.
3. States risks in business language. Not only CVE lists. Lost laptop, phished partner, misdirected client file, vendor breach, seasonal access left open. (Risk assessment is a core Safeguards program element.^[5])
4. Maps safeguards to those risks. Access control, MFA, encryption expectations, backup/recoverability, email and portal practices, training, vendor oversight.^[5][6]
5. Covers service providers. How you select, contract, and review firms that touch client information.^[4]
6. Explains incident handling at the plan level. Who to call, who decides, what to document first. (A plan is not the same as buying someone to run every incident for you. Some detailed Rule elements have size-based exceptions: see companion Safeguards article.)
7. Shows it is alive. Review cadence, how updates happen after a system change, where evidence lives.^[1][5]

Scale the depth to firm size. A sole practitioner's plan can be shorter than a multi-office firm's. Short is fine. Fiction is not. IRS Pub 5708 itself stresses scaling to the firm and treating the publication as sample guidance.^[1]

What a WISP is not

• Not a template left unchanged. If the document mentions systems you do not run, or ignores portals you do run, it undermines trust the first time someone checks. Pub 5708 is explicitly not a one-size-fits-all substitute.^[1]
• Not the entire security program by itself. The program is the combination of people, processes, technology, and evidence. The WISP is the written record.
• Not a guarantee of "compliant" as a binary product. Requirements depend on facts and applicability. A WISP that matches reality is necessary craft; it is not a certificate you hang and forget.
• Not a substitute for working IT. Devices, tenants, and tickets may still sit with internal IT or an MSP. The plan should say how program ownership and technical work meet.

Common mistakes

1. Binder theater. Plan written once for a questionnaire, then never opened.
2. Copy-paste from another industry. Language that does not mention tax platforms, seasonal staff, or client portals.
3. No owner. Everyone assumes "IT handles security," so nobody maintains the document.
4. Controls on paper only. WISP claims MFA everywhere while exceptions pile up for partners and seasonal accounts.
5. Silent vendors. Critical processors never appear in the plan or in any review notes.
6. No link to evidence. Policies exist, but nobody can find access reviews, training records, or backup test notes when asked.

What partners should ask next

Use these in an internal meeting or with your IT provider:

• Where is our current WISP stored, and who is allowed to edit it?
• When was it last reviewed against our real system list?
• Which client-data systems are named, and which are missing?
• What evidence would we show a carrier or client next month if asked?
• Who owns joiner/mover/leaver access during peak season?
• If we suspect a problem tomorrow morning, does the plan say who acts first?

If answers are vague, the gap is usually ownership and freshness, not a need for a longer PDF.

Soft next step

More Learn articles will cover Safeguards themes, client data paths, and seasonal access in the same plain language. For a direct conversation about your firm, use the Contact page on doublerulesecurity.com.

Educational only. Not legal advice. Not a coverage opinion for any specific firm. Applicability depends on facts; firm-specific questions belong with counsel.