The IRS WISP Requirement: Written, Implemented, Evidenced

Yes. The FTC Safeguards Rule (16 CFR Part 314) treats professional tax return preparers as financial institutions and requires a written information security program. IRS Publication 4557, Safeguarding Taxpayer Data, is the IRS’s guide to meeting that obligation, and every PTIN application and renewal on Form W-⁠12 asks you to confirm you’re aware of it. This isn’t best-⁠practice advice — it’s a legal requirement with your signature near it every year.

Since October 2019, Form W-⁠12 has carried a Data Security Responsibilities checkbox, and renewing a PTIN without the WISP behind it is a bad position to explain later — to the IRS, to the FTC, or to clients after a breach. On Form W-⁠12 (line 11), each preparer confirms: “I am aware that paid tax return preparers are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information.”

No one certifies a WISP; it is a written plan your firm owns. The IRS publishes Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice, as a starting point, and Publication 4557, Safeguarding Taxpayer Data, as the guide to the safeguards behind it. A template filled in once is not the requirement: the plan has to describe your actual practice, name who is responsible, and be kept current as the practice changes.

In plain English: a designated Qualified Individual accountable for the program; a written risk assessment; safeguards that address the identified risks — access controls, encryption, multi-⁠factor authentication; and regular testing and monitoring of those safeguards. It also requires security awareness training for staff, oversight of service providers, a written incident response plan, and a written report from the Qualified Individual to your firm’s leadership at least once a year, with the whole program reviewed and kept current. The strengthened requirements have been enforceable since June 9, 2023.

We provide WISP drafting support — building the written plan around your actual practice instead of a template with the blanks filled in — and then we implement and run the controls the document promises. The plan stays yours: your firm designates the Qualified Individual and owns the program, and your compliance advisors keep any sign-⁠off. We supply the controls and the evidence.

The ones a plan is judged by: multi-⁠factor authentication and encryption in transit and at rest on the systems we manage, where they support it, endpoint detection and response on managed devices, and 24/7 monitoring. Add encrypted backup with the most recent 30 days locked, plus tested recovery (billed at published rates; Microsoft 365 backup included on Secure IT), security awareness training (Secure IT) for staff, and a written, rehearsed incident-⁠response plan. A WISP that lists controls nobody operates is a liability, not a shield.

The WISP obligation doesn’t come with a size pass — a two-⁠person tax office holds the same Social Security numbers, bank details, and prior-⁠year returns an identity thief needs to file a convincing fraudulent return. The requirement scales with your footprint, and so does our delivery. Pricing is published per user and starts on Secure IT at $250 per user per month, including a 24/7 Security Operations Center. Core IT is not an option for a regulated environment, because the frameworks lean on the monitored layer Secure IT adds. The published +10% WISP uplift brings that to $275 per user.

Thirty minutes on the phone, NIST CSF-⁠based, no obligation. We look at where taxpayer data lives, which Safeguards Rule controls are actually in place — MFA, encryption, monitoring, backup — and where your written plan and your reality differ. You leave knowing where the obvious gaps are, whether or not you hire us.