Written information security plan for accounting firms: what the IRS expects before tax season

By Jason Small, Partner and Head of Technology, Fantastic IT · November 06, 2026

Every accounting firm that prepares tax returns needs a written information security plan (WISP): a document that says how the firm protects client data, who is responsible for it, and what happens if it’s stolen. Federal law requires it through the FTC Safeguards Rule, and the IRS publishes a free template, Publication 5708, to build it from. Before tax season, make sure your plan names a Qualified Individual, requires multi factor authentication on every system that holds client data, and includes the FTC’s 30-day breach notice. Then test it.

The timing is practical. Current PTINs expire December 31, 2026, and the renewal form asks every preparer whether they know a written plan is required by law. The IRS and its Security Summit partners repeated the requirement on August 18, 2026, and said on September 4 that the MFA requirement applies to firms of every size.

Does your firm need a written information security plan?

Yes, if you prepare tax returns. The FTC Safeguards Rule lists “an accountant or other tax preparation service” among the financial institutions it covers, and the IRS says plainly that “federal law requires tax and accounting professionals to create and maintain a Written Information Security Plan.” That includes a solo preparer. Firm size changes how much of the rule applies, which we cover below, but every paid preparer needs a written plan.

You may also see it called a data security plan for tax preparers. That was the wording on the PTIN form when the IRS added a data security question in 2019. Today, line 11 of Form W-12 reads: “I am aware that paid tax return preparers are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information.” The question asks whether you know about the requirement. It doesn’t ask you to certify that your plan exists, though answering “yes” without one means you know the requirement and haven’t met it.

The FTC enforces the Safeguards Rule. The IRS Office of Professional Responsibility also warns that a missing plan “may expose a practitioner to liability for violating the Safeguards Rule” and, “in circumstances of willfulness,” can lead to discipline under Circular 230, the rules for practicing before the IRS.

What does the FTC Safeguards Rule require?

It requires a named Qualified Individual, a risk assessment, specific safeguards such as MFA and encryption, testing, training, vendor oversight, an incident plan, and an FTC notice after large breaches. The details are in section 314.4 of 16 CFR Part 314. The current version’s main requirements took effect June 9, 2023, the FTC breach notice took effect May 13, 2024, and the rule hasn’t changed since. Firms that hold information on fewer than 5,000 consumers are exempt from four specific parts, shown in the right-hand column.

Requirement	What it means for an accounting firm	Required for firms under 5,000 consumers?
Qualified Individual	One named person oversees the security program. It can be an outside provider, but the firm stays responsible.	Yes
Risk assessment	A written assessment of the risks to client data, with the criteria you used.	The written assessment is not required
Safeguards	Access limited to people who need it; an inventory of data, devices, and systems; encryption of client data in transit and at rest; MFA for anyone who accesses any system; disposal of client data no later than two years after you last used it (with some exceptions); change management; and logging of user activity.	Yes
Testing	Regular testing or monitoring of those safeguards. Larger firms need continuous monitoring, or a yearly penetration test (a hired, controlled attack on your systems) plus vulnerability scans every six months.	Regular testing, yes. The penetration test and six-month scans, no
Training	Security awareness training for staff.	Yes
Service providers	Choose capable vendors, require safeguards in their contracts, and check on them periodically.	Yes
Keep it current	Update the program when your business, systems, or risks change.	Yes
Incident response plan	A written plan covering roles, communications, fixing the problem, documentation, and a review afterward.	The written plan is not required
Annual report	The Qualified Individual reports in writing at least once a year to the board or, if there’s no board, a senior officer such as the managing partner.	Not required
FTC notice	Notify the FTC as soon as possible, and no later than 30 days after discovering a breach of unencrypted data on 500 or more people.	Yes

Sources: 16 CFR 314.4 and 314.6, and the FTC’s Safeguards Rule guide, checked November 5, 2026.

Does the 5,000-consumer exemption get a small firm out of it?

No. A firm that keeps customer information on fewer than 5,000 consumers skips four items: the written risk assessment, continuous monitoring or penetration testing, the written incident response plan, and the annual report. Everything else still applies, including MFA, encryption, a Qualified Individual, training, vendor oversight, and the FTC notice.

We haven’t found official guidance on how to count to 5,000. Because the test is about the information you keep, count conservatively: every person whose data you still hold, including past clients. The two-year disposal rule helps keep that number down.

Skipping the written incident response plan doesn’t mean skipping the planning. The IRS template builds breach steps into its Reportable Event Policy and its Attachment C anyway, and those are the pages you’ll want on the day something goes wrong.

The IRS WISP template, section by section

Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice, was prepared by the IRS and its Security Summit partners, which include state tax agencies. The current version is dated August 2024. Download the PDF for the full template text, with blanks to fill in. Here is the template outline in the IRS’s order, with what each part should say.

Cover page and sections I to III: objective, purpose, and scope

Put the firm’s name and the date the plan was last reviewed on the cover. The objective, purpose, and scope sections say why the plan exists, which laws it answers to, and what it covers: the client data you hold, the people who handle it, and the offices and systems where it lives.

Section IV: identified responsible officials

The template asks for a Data Security Coordinator and a Public Information Officer. The Data Security Coordinator is the same role the Safeguards Rule calls the Qualified Individual, so write both titles next to the name. The Public Information Officer handles what the firm says publicly after an incident.

Section V: inside the firm risk mitigation

• PII collection and retention policy: what client data you collect, where it’s stored, how long you keep it, and how you destroy it. PII is personally identifiable information, such as names, Social Security numbers, and bank details.
• Personnel accountability policy: background screening, training, and how you remove access when someone leaves.
• PII disclosure policy: how staff confirm who they’re talking to before sharing client information by phone or email.
• Reportable event policy: what staff do when they suspect a breach, and who they tell.

Section VI: outside the firm risk mitigation

• Network protection policy: firewalls, software updates, malware protection, and activity logs.
• Firm user access control policy: a unique login for each person, MFA, and access only to what each role needs.
• Electronic exchange of PII policy: how files move between you and clients, such as an encrypted portal or encrypted email.
• Wi-Fi access policy: encrypted Wi-Fi for staff and a separate network for guests.

Section VII: implementation

This section gives the plan’s effective date and has signature lines for the firm’s owner or principal and the Data Security Coordinator.

Three more policies after section VII

The template follows the signature block with a remote access policy (an encrypted connection plus MFA for anyone working from outside the office), a connected devices policy (how new devices are approved and how old drives are securely wiped), and an information security training policy (training when people are hired and every year after).

Attachments A to F

• A: Record retention policies
• B: Rules of behavior and conduct for safeguarding client PII
• C: Security breach procedures and notifications
• D: Employee and contractor acknowledgment of understanding
• E: Firm hardware inventory containing PII
• F: Firm employees authorized to access PII

What to add that the IRS template doesn’t spell out

The template’s headings don’t cover every requirement in the rule. Add a short section, or a line in your annual review, for each of these:

• Testing. Write down how and when you check that your safeguards work. The IRS says firms should “review, test, and update it regularly.”
• Service providers. List every vendor that can reach client data (tax software, cloud storage, your IT provider, your shredding company), what their contract requires, and when you last checked on them.
• Change management. Say who approves changes to your systems, such as new software or a new remote access tool, and where the change is recorded.
• The FTC notice. The template’s Reportable Event Policy doesn’t mention the FTC. The 500-person, 30-day notice appears in the publication’s Requirements section and in Attachment C, so add it to the policy too.
• The annual report, if you hold data on 5,000 or more consumers.

Is MFA required, or only recommended?

MFA is required. Multi Factor authentication means signing in with a password plus a second proof, such as a code from an app on your phone. The Safeguards Rule requires it for anyone accessing any information system, unless your Qualified Individual approves an equally secure control in writing. In its September 4, 2026 reminder, the IRS said, “The MFA requirement applies to tax preparation firms regardless of size.”

The IRS’s own Security Six checklist, updated October 9, 2026, still says to “opt for two-factor authentication when it’s offered.” Treat that as out of date. Turn MFA on in your tax software, email, cloud storage, and file portals, and for remote access and administrator accounts. Our post on what multifactor authentication is explains the options.

What to do if client data is stolen

Two deadlines start once you find a breach. Authorized IRS e-file providers must report security incidents to the IRS as soon as possible and no later than the next business day after confirming the incident, according to Publication 1345. Firms that file returns as Electronic Return Originators (EROs) report to their local IRS Stakeholder Liaison. Separately, if unencrypted data on 500 or more people was taken, you must notify the FTC through its online form within 30 days of discovery, and the FTC says your report may be made public. Data encrypted to the rule’s standard, with the keys kept secure, falls outside that notice, which is one more reason to encrypt laptops and file storage.

The IRS’s data theft page for tax professionals lists who to contact, in four groups. Put this list in Attachment C, with names and phone numbers filled in before the season starts:

• The IRS and law enforcement: your local IRS Stakeholder Liaison, your local FBI office, the Secret Service (if directed), local police, and the FTC if 500 or more people are affected.
• States: the state tax agencies where you file returns, through the Federation of Tax Administrators, and your state attorney general. The IRS notes that most states require the attorney general to be notified.
• Experts: a security expert, to find the cause and stop the breach, and your insurance company, to report it and check your coverage.
• Clients and other services: a credit or identity theft protection agency, the three credit bureaus (Equifax, Experian, and TransUnion), and your clients, by individual letter, timed with law enforcement.

A pre-season checklist for your WISP

Work through this before you renew your PTIN. If you don’t have a plan yet, start with step 1 and the Pub 5708 template.

1. Open the plan and update the review date. If it hasn’t been reviewed in the past year, it’s due.
2. Confirm your Qualified Individual. Make sure the person named still works at the firm and knows they hold the role.
3. Check MFA on every account. Look for exceptions in tax software, email, cloud storage, and remote access, including seasonal staff accounts.
4. Check encryption. Laptops, file storage, and anything that moves client files should be encrypted.
5. Test a backup. Restore real files from it. That’s the only way to know it works.
6. Update Attachments E and F. Remove former and last season’s temporary staff, and add new devices.
7. Fill in Attachment C. Add your Stakeholder Liaison and the other contacts above.
8. Walk through a breach. Spend 30 minutes with your team on what each person would do, who calls whom, and when the IRS and FTC deadlines start.
9. Train staff before the busy season. Collect signed acknowledgments (Attachment D).
10. Renew your PTIN before December 31, 2026. The 2027 fee is $18.75.

How do you keep the plan current?

Publication 5708 says to review the plan at least once a year, and whenever there is a material change. For an accounting firm, material changes include new tax software, moving files to the cloud, opening or closing an office, a change in staff who handle client data, and any security incident. Pick a fixed review date, such as the weeks before PTIN renewal each fall, and keep a short log of what changed and when. If you hold data on 5,000 or more consumers, your Qualified Individual’s written annual report to the managing partner is a good place to record that review.

How Fantastic IT helps

We support several CPA and accounting firms with the technical controls a WISP describes: MFA, encryption, backups, monitoring, and secure remote access. Before tax season, we can check that those controls are turned on and working, and help you keep your device and access lists current. If you’d like us to check the controls your plan describes, see how we support CPA and accounting firms.

Related: How to handle CPA business data · What a real backup strategy looks like in 2026