A Written Information Security Plan, or WISP, is the firm’s written program for protecting client information: who owns it, which risks matter, which safeguards are relied on, and how service providers are overseen. For a tax or accounting practice, the IRS points firms to this document. A downloaded template that names nobody and ignores the MSP is not the plan a managing partner can stand behind.

This page summarizes public IRS and FTC sources. It is not a determination that a particular firm is covered, and it is not legal advice.

What the IRS tells tax professionals

IRS Publication 4557 states that professional tax preparers are financial institutions under the Gramm-Leach-Bliley Act, and that the FTC Safeguards Rule requires a written information security plan describing how customer information is protected. IRS Publication 5708, revised August 2024, is the Security Summit’s outline for creating that plan. It says tax and accounting professionals are considered financial institutions regardless of size, and that the plan must be written and accessible. The IRS newsroom page on data security plans tells firms to designate a coordinator, identify and assess risks, design safeguards and monitor them, and oversee service providers.

Publication 5708 is a starting outline. The IRS says there is no one-size-fits-all plan, and that a sole practitioner’s document can be simpler than a ten-partner firm’s. Filling in a sample without matching it to the firm’s tax software, portals, email, and IT provider does not create the program the outline describes.

What the FTC Safeguards Rule adds

The Safeguards Rule is the FTC’s implementation of the Gramm-Leach-Bliley Act. The FTC’s own business guidance says covered financial institutions need an information security program appropriate to their size and complexity, overseen by a qualified individual. Safeguards include access controls, and multifactor authentication for anyone accessing customer information, unless the qualified individual has approved a reasonably equivalent control in writing.

The same FTC guidance says financial institutions that maintain customer information on fewer than 5,000 consumers are exempt from some elements: a written risk assessment in the form the rule specifies, continuous monitoring or the rule’s penetration-test and vulnerability-assessment cadence, a written incident response plan, and an annual report to the board or governing body. A firm under that threshold can still need a written program, a named coordinator, operating safeguards, and service-provider oversight. Counting “consumers,” and deciding which elements apply, is a legal and factual question for the firm and its counsel. Mojave does not make that determination.

A security event that affects 500 or more people can trigger FTC notice duties. Publication 4557 and the FTC’s breach-response guidance are the references. Those duties, including the notice deadlines, are separate from having a WISP.

What a managing partner should be able to point to

A plan that is usable in a partner meeting, an insurer questionnaire, or a client due-diligence request usually makes these items explicit:

  • A named qualified individual or security coordinator, and who acts if that person is unavailable.
  • The information the firm actually holds: tax returns, payroll, owner documents, portal credentials, and the email that moves money.
  • The systems in view, including the tax or accounting platform, Microsoft 365 or Google Workspace, endpoints, and backups.
  • The safeguards the firm relies on, including multifactor authentication, and where an exception has been approved in writing.
  • How the firm selects and reviews service providers, especially the MSP and the cloud platforms that store client files.
  • How the firm will train people who can see client information.
  • How the plan is reviewed when the firm, the software, or the test results change.
  • Where incident roles live, even when the firm is below a threshold that requires a formal incident-response program. Preparation and a statutory incident-response plan are not the same document.

Why the MSP has to be in the plan

Most firms of 15 to 100 people do not run Microsoft 365 themselves. The IT provider resets mailboxes, holds admin rights, and often owns the backup. A WISP that never names that provider cannot explain service-provider oversight, which both Publication 5708 and the Safeguards Rule treat as part of the program. Oversight does not mean firing the MSP. It means the firm can say what the provider is responsible for and how that work is reviewed.

An IT provider’s statement that “the firm is secure” is not the written plan. It can be one input. The plan still has to be the firm’s.

How the written plan relates to a technical assessment

The plan describes safeguards. It does not create them. If nobody has looked at identity settings, mail controls, or restore evidence, the plan is recording a belief. An independent cybersecurity assessment is how that belief gets checked. When Mojave prepares a WISP & Incident Readiness engagement after a baseline, the plan is written against those findings. When the plan is standalone, the document says where technical safeguards were not verified.

Buying the document does not make the firm compliant, bind insurance, or guarantee a claim will be paid. For how Mojave scopes this work for Las Vegas CPA and tax firms, see cybersecurity for accounting and tax firms.

Sources

Schedule a 30-minute security scoping call See the WISP engagement