A written information security plan, or WISP, is the document that shows a firm has thought about how it protects client data. The IRS publishes a sample template in Publication 5708, developed by and for tax and accounting professionals. The publication says plainly that a WISP is an often overlooked but critical component of running a tax practice, that it is good business practice and that the law requires one. This article walks through the template's structure, section by section, and says what a firm must decide at each step. It also notes where the template's own text says it is a starting point and not a substitute for a plan based on the firm's specific needs.
Legal basis in the publication
Publication 5708 explains the chain: the Gramm-Leach-Bliley Act requires financial institutions to protect customer data, the FTC implemented it through the Safeguards Rule and, under the Act and the rule, tax and accounting professionals are considered financial institutions regardless of size. The WISP must be written and accessible. The publication lists what the FTC requires of each firm:
- Designate a qualified individual to coordinate the information security program.
- Identify and assess risks to customer information in each relevant area of operation, and evaluate the effectiveness of current safeguards.
- Design and implement a safeguards program, and regularly monitor and test it.
- Select service providers that can maintain appropriate safeguards, with contracts that require them to do so and oversight of their handling of customer information.
- Evaluate and adjust the program when the business changes or testing shows gaps.
- Implement multi-factor authentication for anyone accessing any information system, unless the qualified individual has approved in writing reasonably equivalent or more secure access controls.
- Report a security event affecting 500 or more people to the FTC as soon as possible and no later than 30 days from discovery.
The outline
The publication outlines the plan in seven parts:
| Part | Title | What the firm decides |
|---|---|---|
| I | Define the WISP objectives, purpose and scope | What the plan protects and where it applies |
| II | Designate a qualified individual | Who coordinates the program, who is responsible, who is an authorized user |
| III | Assess risks | What information the firm handles, where it can be lost and how risks are monitored and tested |
| IV | Inventory hardware | What devices exist, where they are and what data each holds |
| V | Document safety measures in place | The policies and the employee code of conduct |
| VI | Draft an implementation clause | When the plan takes effect and how it is maintained |
| VII | Attachments | Supporting forms and lists |
Part I: Objective, purpose and scope
State why the plan exists, what personally identifiable information it protects and which people, locations and systems it covers. The template's own cover text states that the document is available to all employees and to clients by request and with consent of the firm's designated coordinator, and it carries a last modified or reviewed date with a note that the plan should be reviewed and updated at least annually. Decide the firm's rule on who sees the plan and record it.
Part II: Responsible officials
The template names a Data Security Coordinator as the responsible official who implements, supervises and maintains the plan. The template lists the coordinator's duties, including:
- Implementing the plan and its daily operating procedures.
- Identifying the firm's repositories of data and designating them as secured assets with restricted access.
- Verifying that all employees have completed recurring training.
- Monitoring and testing employee compliance.
- Evaluating third-party service providers' ability to maintain appropriate security for the information they can access, and requiring them to do so.
- Reviewing the scope of the security measures at least annually or when a material change affects the security of records.
- Conducting an annual training session for owners, managers, employees and independent contractors with access, with attendees certifying attendance and familiarity with the requirements.
The template also names a Public Information Officer, who approves outward-facing communications: client communications, statements to law enforcement and releases to the media. Assigning that role in advance keeps a breach from producing inconsistent statements.
Also list the authorized users, their data access levels and their responsibilities.
Part III: Risk assessment
Identify the types of information the office handles, the potential areas of data loss, internal and external, and the procedures to monitor and test risks. Build the assessment from the firm's own operation: where paper files sit, which systems hold client data, which vendors have access, how staff work remotely and how clients send documents. Document the date, the participants and the conclusions, and repeat it on a schedule. The FTC asks for a written risk assessment that is repeated over time.
Part IV: Hardware inventory
List each device with its description and physical location, and record the types of information stored or processed on it. The template includes a sample attachment for a hardware inventory containing PII. Include servers, workstations, laptops, phones, tablets, external drives and network equipment. Update the inventory when equipment is bought, reassigned or retired, and tie disposal to the wiping or destruction step in Publication 4557.
Part V: Safety measures
The template suggests policies on:
- Data collection and retention.
- Data disclosure.
- Network protection.
- User access.
- Electronic data exchange.
- Wi-Fi access.
- Remote access.
- Connected devices.
- Reportable incidents.
It also calls for an employee code of conduct and an acknowledgment of understanding that each employee or contractor signs. Write each policy in operating terms: who does what, how often and how it is evidenced. A policy that cannot be tested does not belong in the plan.
Part VI: Implementation
State the effective date, the review cycle and the responsibility for updates. The template says the plan should be reviewed at least annually and whenever a material change occurs. Keep a revision log.
Part VII: Attachments
The template lists six sample attachments: A, record retention policies. B, rules of behavior and conduct for safeguarding client PII. C, security breach procedures and notifications. D, the employee or contractor acknowledgment of understanding. E, the firm hardware inventory containing PII. F, firm employees authorized to access PII. Keep all six, and add the firm's own vendor list with contract dates, incident contact list and training log.
Customizing the template
The publication states that the template is not a substitute for developing the firm's own plan based on the specific needs and requirements of the business. Remove sections that do not apply, add sections for what the firm does, and delete bracketed placeholder text. A plan that still contains placeholders signals to an examiner or an insurer that nobody owns it.
Testing the plan
After the plan is written, test it. Review a sample of staff on whether they know who the coordinator is, ask a vendor for its security evidence, restore a backup and walk through the incident steps using a made-up scenario. See cybersecurity for CPA firms and data theft response plan.
FAQ
Is the template mandatory?
No. The WISP is required, and the IRS template is a sample.
How often should the plan be reviewed?
The template says at least annually, and whenever a material change in business practices affects security.
Who should own it?
A named individual, called the Data Security Coordinator in the template, with partner-level support.
CORAA prepares ready-to-review audit files for US CPA firms; see /us.
Sources
- IRS, Publication 5708, Creating a Written Information Security Plan: https://www.irs.gov/pub/irs-pdf/p5708.pdf
- FTC, Standards for Safeguarding Customer Information (Safeguards Rule), 16 CFR Part 314: https://www.ecfr.gov/current/title-16/part-314
- IRS, Publication 4557, Safeguarding Taxpayer Data: https://www.irs.gov/pub/irs-pdf/p4557.pdf
Part of CORAA University · Tax and compliance for CPA firms: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error