Guide
Written Information Security Plan (WISP) Guide for Accounting and Tax Firms
Every tax and accounting firm needs a written information security plan. Here is what the FTC Safeguards Rule and IRS guidance expect it to cover, and the IT safeguards that make it real.
Key takeaways
- Tax preparers and many accounting firms are financial institutions under the Gramm-Leach-Bliley Act, so the FTC Safeguards Rule applies to them.
- The rule requires a written information security program with a Qualified Individual, a risk assessment, specific safeguards, testing, training, vendor oversight and an incident response plan.
- Firms with information on fewer than 5,000 consumers are exempt from a few requirements, but not from having a written plan and core safeguards.
- Since May 13, 2024, a breach involving 500 or more consumers must be reported to the FTC within 30 days.
Why it matters
Why your firm needs a WISP
The FTC Safeguards Rule (16 CFR Part 314) requires non-bank financial institutions, including tax preparers and many accounting firms, to develop, implement and maintain a written information security program. The amended rule’s main requirements took effect on June 9, 2023, and a breach notification requirement followed on May 13, 2024.
The IRS reinforces the same expectation. IRS Publication 4557, Safeguarding Taxpayer Data, explains the obligation, and IRS Publication 5708 provides a template for creating a written information security plan for a tax and accounting practice.
A WISP is not a one-time document. It should describe how your firm actually protects client data, and it has to be reviewed and updated as your systems, staff and risks change.
Requirements
What the FTC Safeguards Rule requires
- Qualified Individual: one person responsible for overseeing the program. It can be someone at a service provider, but your firm keeps responsibility and must oversee them.
- Written risk assessment: identify reasonably foreseeable risks to client information and evaluate your safeguards against them.
- Access controls: give staff access only to the client information they need.
- Data and systems inventory: know what data you hold, where it lives and which systems and devices touch it.
- Encryption of client information in transit over external networks and at rest.
- Multi-factor authentication for anyone accessing your information systems.
- Secure disposal of client information no later than two years after it was last used to serve the client, unless there is a legitimate business or legal reason to keep it.
- Change management and activity monitoring: manage changes to your systems and monitor and log what authorized users do.
- Testing: continuous monitoring, or annual penetration testing plus vulnerability assessments at least every six months.
- Staff training: security awareness training for everyone, updated as risks change.
- Service provider oversight: choose providers that can protect client data, require it by contract and check on them periodically.
- Incident response plan: a written plan for responding to and recovering from security events.
- Annual report: the Qualified Individual reports in writing, at least once a year, to your partners or governing body.
- FTC notification: report a notification event involving the information of 500 or more consumers to the FTC no later than 30 days after discovery.
The small firm exemption
If your firm maintains customer information on fewer than 5,000 consumers, the rule exempts you from four requirements: the written risk assessment, continuous monitoring or annual penetration testing and vulnerability assessments, the written incident response plan and the annual written report. You still need a written information security program, a Qualified Individual and the other safeguards, including encryption and multi-factor authentication.
Outline
A practical WISP outline for your practice
- Purpose and scope: which data, systems, offices and people the plan covers.
- Qualified Individual and responsibilities.
- Risk assessment summary and how often it is repeated.
- Inventory of hardware, software, cloud services and where client data is stored.
- Safeguards: access control, multi-factor authentication, encryption, endpoint protection, backups and secure file exchange.
- Employee policies and training, including onboarding and departures.
- Service providers and how you oversee them.
- Incident response plan, including who contacts the IRS, the FTC, state authorities and clients.
- Data retention and disposal.
- Review schedule and change log.
IT safeguards
IT safeguards that make the plan real
A plan is only as good as the systems behind it. These are the controls we see make the biggest difference at tax and accounting firms:
- Multi-factor authentication on email, remote access, tax software and client portals
- Encrypted laptops and phones that can be wiped remotely
- Encrypted email or a secure portal for sending returns and documents
- Endpoint detection and response and email filtering
- Backups that ransomware cannot reach, with restores tested before filing season
- Regular patching for Windows, tax software and browsers
- Alerts for unusual sign-ins
- Prompt removal of access when seasonal staff leave
FinFortify’s IT support for accounting firms puts these safeguards in place, helps document them in your plan and keeps them running all year. See our IT compliance services for more.
This guide is general information about IT and cybersecurity practices, not legal advice. Your compliance officer or counsel should confirm how each rule applies to your firm.
FAQ
WISP questions
Do small tax practices need a WISP?
Yes. Every tax preparer covered by the FTC Safeguards Rule needs a written information security program. Firms with information on fewer than 5,000 consumers are exempt from a few specific requirements, but not from the written plan itself.
Can our IT provider be our Qualified Individual?
The rule allows the Qualified Individual to work for a service provider, but your firm remains responsible for compliance, must designate a senior member of your staff to direct and oversee that person, and must require the provider to maintain its own information security program.
How often should we update our WISP?
Review it at least once a year and whenever something important changes, such as new software, a new office, a security incident or a change in staff. The rule requires you to evaluate and adjust the program as your operations and risks change.
Get your WISP and safeguards in order
Request a quote for IT support built for accounting and tax firms.
