FTC Safeguards Rule and WISP: What Tax and Accounting Firms Must Do

By TechTrone Team — Published 2026-11-13

Quick answer: If you prepare tax returns for pay, the FTC Safeguards Rule requires you to have a Written Information Security Plan (WISP) that explains how you protect client data. The IRS reinforces this every year: the PTIN renewal asks you to acknowledge your data security responsibilities, and 2027 PTIN renewals are open now, with current PTINs expiring December 31, 2026.

This guide explains what a WISP is, who needs one, what it must contain, and how a small tax or accounting firm on Long Island or in New York City can put a real plan in place before tax season starts.

What This Guide Covers

  • 1. What the FTC Safeguards Rule is and why it applies to tax firms
  • 2. What a WISP is
  • 3. The WISP and your PTIN renewal
  • 4. What your WISP must include
  • 5. Small-firm exemptions
  • 6. A WISP checklist you can start today
  • 7. Common mistakes
  • 8. Frequently asked questions

1. What Is the FTC Safeguards Rule?

The FTC Safeguards Rule (16 CFR Part 314) comes from the Gramm-Leach-Bliley Act. It requires "financial institutions" to protect customer information with a written security program. That term is broader than most people expect. It covers tax preparers, CPA and bookkeeping firms, and many other businesses that handle consumers' financial information.

The FTC strengthened the rule significantly in recent years. The updated requirements took effect in June 2023, and a breach-notification requirement followed in May 2024: if unencrypted information about 500 or more consumers is exposed, you must notify the FTC within 30 days of discovering it.

New York firms have a second reason to act. The state's SHIELD Act also requires businesses that hold New York residents' private information to maintain reasonable administrative, technical, and physical safeguards.

Accounting firm team defining the scope of a written information security plan

2. What Is a WISP?

A Written Information Security Plan is a document that describes, in plain terms, how your firm protects client data. It covers who is responsible for security, what risks you have identified, which safeguards you use, how you train staff, and what you will do if something goes wrong.

A WISP is not a one-time form. Think of it as your firm's security playbook. It should match how your office actually works, and you should review and update it at least once a year or whenever something important changes, like new software, a new office, or a new employee.

The IRS publishes a free starting template, Publication 5708, Creating a Written Information Security Plan for your Tax and Accounting Practice, along with Publication 4557, Safeguarding Taxpayer Data. They are useful guides, but they still have to be customized to your firm. A template with blanks filled in is not the same as a plan you actually follow.

3. The WISP and Your PTIN Renewal

The PTIN application and renewal (Form W-12) includes a data security responsibilities statement. By renewing, you confirm that you understand paid preparers must protect taxpayer data and maintain a written information security plan as required by the FTC Safeguards Rule.

Renewals for 2027 are being processed now, and current PTINs remain valid only through December 31, 2026. If you are checking that box, make sure there is a real, current WISP behind it. In the event of a breach or an IRS or FTC inquiry, a missing or outdated plan becomes a serious problem.

Bottom line: If you sign your PTIN renewal without a WISP, you are confirming something you have not actually done. Fix that before you renew, not after.

4. What Your WISP Must Include

Under the Safeguards Rule, an information security program generally needs these elements:

  1. A Qualified Individual. Name one person responsible for overseeing your security program. This can be an owner, an employee, or an outside IT provider, but the firm stays responsible.
  2. A written risk assessment. Identify where client data lives, who can access it, and what could threaten it.
  3. Safeguards based on that risk assessment, including:
    • Access controls so staff only see the data they need
    • An inventory of the data, devices, and systems you use
    • Encryption of client data in transit and at rest
    • Multi-factor authentication (MFA) for anyone accessing client information
    • Secure disposal of client data you no longer need
    • Logging and monitoring of user activity
    • Change management for new software and systems
  4. Regular testing. Continuous monitoring, or periodic penetration testing and vulnerability scanning.
  5. Staff security awareness training, especially on phishing, which remains the top way tax firms get compromised. See our guide to stopping phishing before it reaches the inbox.
  6. Oversight of service providers, such as your tax software, cloud storage, and IT vendor.
  7. A written incident response plan describing what you will do if data is exposed.
  8. An annual written report from the Qualified Individual to the firm's owners or leadership.

IT specialist configuring encryption and MFA for a tax preparation office

5. Are There Exemptions for Small Firms?

Partly. Firms that maintain information on fewer than 5,000 consumers are exempt from a few requirements, including the written risk assessment, the written incident response plan, the annual report to leadership, and certain testing requirements.

That does not mean small firms can skip the WISP. You still need a written security program, a Qualified Individual, MFA, encryption, access controls, training, and vendor oversight. And even where something is technically exempt, doing a basic risk assessment and an incident response plan is still smart. They are what you will need on the worst day of tax season.

6. WISP Checklist for Tax and Accounting Firms

Use this checklist to see where your firm stands today.

  • ☐ A named Qualified Individual is responsible for security
  • ☐ We know where all client data is stored (computers, servers, cloud, email, paper)
  • ☐ MFA is turned on for email, tax software, cloud storage, and remote access
  • ☐ Laptops and desktops are encrypted (for example, with BitLocker)
  • ☐ Client files are sent through an encrypted portal, not plain email attachments
  • ☐ Every computer has managed antivirus or endpoint protection and receives updates
  • ☐ Staff complete security awareness training at least once a year
  • ☐ Each employee has their own login. No shared accounts
  • ☐ Former employees lose access the day they leave
  • ☐ Client data is backed up, and we have tested a restore
  • ☐ Our email domain is protected with SPF, DKIM, and DMARC
  • ☐ We have a written plan for what to do if we suspect a breach
  • ☐ Our WISP is written down, dated, and reviewed every year

If you checked fewer than 10 boxes, your firm likely has gaps that need attention before tax season. You can also check your email domain right now with our free DKIM checker.

7. Common WISP Mistakes

  • Downloading a template and never customizing it. A generic plan does not describe your firm's real systems.
  • Turning on MFA for some systems, but not all. Attackers look for the one login without it.
  • Emailing tax documents as plain attachments. Use a secure portal instead.
  • No plan for seasonal staff. Temporary preparers need their own accounts, training, and same-day offboarding.
  • Treating it as paperwork. The plan only protects you if the safeguards it describes are actually in place.

Frequently Asked Questions

Do tax preparers need a WISP?

Yes. Paid tax return preparers are covered by the FTC Safeguards Rule, which requires a written information security program. The IRS reminds preparers of this obligation in the PTIN application and renewal.

Is there a free WISP template?

Yes. IRS Publication 5708 provides a sample WISP for tax and accounting practices. It is a solid starting point, but it must be adapted to your firm's actual systems and procedures.

Does my CPA firm need a WISP if we do not prepare tax returns?

Very likely. Bookkeeping, payroll, and financial advisory work can also make your firm a "financial institution" under the Safeguards Rule. Check with your compliance advisor or attorney.

How often should a WISP be updated?

At least once a year, and whenever your firm makes a significant change, such as new software, a new office, remote work, or a security incident.

Can an IT provider be our Qualified Individual?

Yes. The rule allows a service provider to fill this role, but your firm remains responsible and must oversee their work.

This article is general information, not legal advice. Consult your attorney or compliance advisor about your firm's specific obligations.

Get Your WISP and Safeguards in Place Before Tax Season

TechTrone helps accounting and tax firms on Long Island and in New York City build a WISP that matches how their office really works, then puts the safeguards in place: MFA, encryption, secure file sharing, managed endpoint protection, backup, and staff training. Start with our free IT health check, or contact us for a WISP and Safeguards Rule review.

More IT Blog Articles