WISP Checklist for Tax and Accounting Practices
Twelve sections to review your written information security plan against, drawn from IRS and FTC guidance.
A WISP is a written plan describing how a firm protects taxpayer and client data. US tax professionals are expected to maintain one under the FTC Safeguards Rule, and the IRS provides a sample plan in Publication 5708. Use this checklist to review what you already have against the primary sources.
Last updated: September 16, 2026 · Reviewed by Waqas Sagar, ACA FCCA, chartered accountant (UK) and founder of Remindoo.
Before you start
- Read IRS Publication 5708 and use its sample plan as your base
- Name the individual who owns the program
- List every tool and device holding client data
- Date and version the plan so reviews are provable
- Take legal advice on your own obligations
The twelve-section checklist
Each section lists what a plan usually covers. Keep to the primary sources; do not add requirements they do not contain.
1. Designate a qualified individual
One named person is accountable for the security program, even in a small firm.
- A named individual is responsible for the information security program
- Their responsibilities are written down, not assumed
- Partners know who to go to when something looks wrong
2. Risk assessment
Write down where client data lives and what could go wrong with it.
- Every place client data is stored is listed, including laptops, email and cloud tools
- Foreseeable risks to that data are identified in writing
- The assessment is dated and revisited
3. Access controls and least privilege
People should reach the client data their work requires and no more.
- Access is granted by role, not by person, wherever possible
- Seasonal and temporary staff have a narrower role than permanent staff
- Access is removed promptly when someone leaves or changes role
4. Multifactor authentication
Systems holding client information should require more than a password.
- MFA is required on every system holding taxpayer or client information
- MFA is enforced rather than left to individual choice
- There is a documented process for replacing a lost authenticator device
5. Encryption
Client data should be protected in transit and at rest. Confirm this with every vendor in writing.
- Each vendor's position on encryption in transit and at rest is confirmed in writing
- Portable devices holding client data are encrypted
- Client data is not sent unencrypted over email
6. Secure devices, updates and anti-malware
The device is often the weakest point, especially with remote staff.
- Operating systems and software are kept up to date
- Anti-malware protection runs on every device that touches client data
- Personal device use is either prohibited or governed by a written rule
7. Staff training and phishing awareness
Training is a required, repeating activity, not a one-off induction.
- Security training happens at least annually and is recorded
- Staff know how to recognize and report a phishing attempt
- New joiners are trained before they are given access
8. Vendor and service provider oversight
Your obligations follow your data into the tools you use.
- Every vendor holding client data is listed
- Security expectations are set in the contract or in writing
- Vendors are reviewed on a schedule, not only at purchase
9. Data retention and secure disposal
Hold client data for as long as you need it and dispose of it deliberately.
- A written retention period exists for client records
- Paper records are shredded and digital records are securely deleted
- Old hardware is wiped before disposal
10. Monitoring and testing
Check that the controls you wrote down are actually running.
- Access lists are reviewed periodically
- MFA enrollment is checked against the current staff list
- Findings are recorded and acted on
11. Incident response plan
Decide now what happens on the worst day, including who you notify.
- The plan names who leads the response and who is contacted first
- It includes reporting client data theft to the IRS, for example through the Stakeholder Liaison
- It covers notifying affected clients and your insurer
- It is tested or walked through at least once a year
12. Annual review
A plan that is never reviewed stops describing the firm within a year.
- The plan carries a date and a version
- It is reviewed at least annually and after any material change
- Changes to staff, software or services trigger an update
Where practice management software fits
A tool can only carry the parts of a plan that are technical controls. Remindoo provides multifactor authentication with an authenticator app and a single setting that requires MFA for every employee in the firm — two specific things you can name in the access and authentication sections of your plan.
Everything else stays with the firm: writing the document, running the risk assessment, training staff, securing devices, overseeing vendors and responding to an incident. Any vendor claiming to make you compliant is describing something software cannot do.
Frequently asked questions
What is a WISP?
A written information security plan is a document describing how your firm protects taxpayer and client data: who is responsible, where the data lives, what the risks are, which controls are in place and what happens if there is an incident.
Do tax preparers need a WISP?
US tax professionals are expected to maintain a written information security program under the FTC Safeguards Rule, and the IRS provides a sample plan in Publication 5708. Confirm your own position against those primary sources and with a qualified adviser.
Does the FTC Safeguards Rule require multifactor authentication?
The Safeguards Rule sets out required elements of an information security program, and multifactor authentication for individuals accessing customer information is among the safeguards it addresses. Read the rule text and the FTC's business guidance, both linked in the sources below.
How often should a WISP be reviewed?
At least annually, and whenever something material changes: new staff, new software, a new service line, a new office or an incident. Date and version every revision so you can show when it was last reviewed.
What should an incident response plan include?
Who leads the response, who is contacted and in what order, how the incident is contained and recorded, how affected clients are notified, and how client data theft is reported to the IRS. Write it before you need it.
Can software make my firm compliant?
No. Software can support specific controls, such as multifactor authentication and limits on who reaches what. The plan itself, the risk assessment, the training and the incident response remain the firm's responsibility.
Sources
- FTC: Safeguards Rule (16 CFR Part 314) — The rule text itself, including the information security program requirement
- FTC: Safeguards Rule — what your business needs to know — Plain-English business guidance from the FTC
- IRS Publication 4557: Safeguarding Taxpayer Data — IRS guidance for tax professionals on protecting client data
- IRS Publication 5708: Creating a Written Information Security Plan — A sample WISP for smaller tax practices
- IRS: Data theft information for tax professionals — Who to contact if client data is stolen, including the Stakeholder Liaison
General information only, not legal or compliance advice. Use IRS Publication 5708, IRS Publication 4557 and the FTC Safeguards Rule (16 CFR Part 314) as primary sources, and consult qualified advisers.
Review the controls with your own checklist
Bring your vendor questionnaire to a walkthrough. We will show the MFA settings and answer your questions in writing afterwards.