Understand the environment
Map systems, information flows, service providers, staffing, and responsibilities.
WISP development and review
Written Information Security Plan Support for Tax Preparers
Build or update a Written Information Security Plan around your firm’s systems, staff, vendors, and responsibilities. We help adapt the IRS template to your operations and give you a practical list of improvements.
Start with the requirement
Your plan should describe how the firm protects taxpayer data.
The FTC Safeguards Rule includes tax preparation firms among covered financial institutions. Their written security programs should fit the size of the business and the sensitivity of the information they handle.
The IRS provides free WISP guidance, including Publication 5708 and Publication 4557. Start with the official guidance below.
Document the safeguards you operate today and track planned improvements separately.
For a practical walkthrough of adapting Publication 5708 to a small tax firm's actual workflows and safeguards, read the WISP template guide for tax preparers.
More than filling in a template
The IRS resource is useful. Paid assistance can make the plan specific to the way your firm works and make the gap between written safeguards and implemented safeguards visible.
Make the plan usable
Tailor procedures, incident responsibilities, vendor oversight, and review triggers to actual operations.
Prioritize implementation
Record gaps honestly and give leadership and the IT provider ordered next steps.
A scoped engagement
What the engagement can include
We agree the work with you before starting and record outstanding improvements clearly.
- Initial scoping and review of existing documentation
- Inventory of relevant systems, data locations, and service providers
- Review of responsibilities and applicable security-program elements
- Risk identification and prioritized treatment actions
- Tailored WISP development or revision
- Review of agreed evidence for key safeguards
- Incident-response procedures and escalation responsibilities
- Vendor oversight, staff training, and plan-maintenance procedures
Who this helps
- Firms building their first WISP.
- Firms with an outdated or generic plan.
- Firms changing systems, vendors, staffing, or remote-work practices.
- Firms unsure whether written controls match reality.
A document-only engagement does not include technical verification. We can scope evidence review separately.
The process
From current state to an owned plan.
1. Understand
Review the firm, existing plan, current practices, and goals.
2. Agree
Confirm scope, evidence, fixed price, deliverables, and schedule before work begins.
3. Review and draft
Assess documentation and agreed technical evidence, then develop or revise the plan.
4. Prioritize
Identify implementation gaps, responsibilities, and treatment actions.
5. Hand over
Walk leadership through the agreed deliverables and maintenance triggers.
We confirm a delivery schedule after reviewing your existing plan and the work required.
What you receive
Subject to the agreed scope, deliverables can include:
- A tailored WISP in an editable format
- Documented roles and responsibilities
- An agreed system, data, and vendor inventory
- Prioritized gaps and implementation actions
- A record of evidence reviewed and limitations
- A leadership walkthrough and maintenance guidance
Turn the plan into assigned actions.
Your team or IT provider can implement needed changes, or we can discuss a separate, defined remediation engagement. See the Business Security Baseline for essential-control verification.
Defined scope. Confirmed price before work begins.
Pricing depends on firm complexity, existing documentation, requested verification, and deliverables. The WISP service is quoted after scoping; the Business Security Baseline remains a separate fixed-scope offer.
Discuss My WISPQuestions from tax and accounting firms
Can I use the free IRS WISP template?
Yes. Publication 5708 is a free starting resource. Tailored assistance can help adapt it to your actual systems, responsibilities, vendors, and evidence; professional assistance is not mandatory.
Can you review a WISP we already have?
Yes. We can compare an existing plan with your current operations and agreed evidence, identify stale or unsupported safeguards, and recommend focused updates.
Does a WISP alone make my firm compliant?
No. The firm must put its safeguards into practice, maintain them, and update the plan as operations change.
Are very small tax firms exempt?
The FTC’s exception for institutions holding information about fewer than 5,000 consumers applies to certain provisions. It is not a blanket exemption from the Safeguards Rule.
How often should we review our plan?
Review it when systems, vendors, staffing, remote-work practices, risks, or responsibilities materially change, and on a periodic schedule appropriate to your operations.
Is technical testing included?
Only when included in the agreed scope. A document-only engagement is not technical verification; the Business Security Baseline or a separately scoped review can address agreed evidence.
Can you work with our IT provider?
Yes. We can clarify responsibilities, request agreed evidence, and provide prioritized implementation actions for your team or IT provider. We do not replace ongoing managed IT.
What should I provide for an initial discussion?
Share your firm size, whether a plan already exists, your general technology environment, goals or deadline, and any known changes. Do not send taxpayer records, credentials, or other sensitive data for initial scoping.
See also cybersecurity for accounting and tax firms, the IRS-template adaptation guide for tax preparers, and the Business Security Baseline.