Blog · 14 October 2026

Your Firm's WISP: A Practical Guide to the FTC Safeguards Rule and IRS Security Six

By Keshav Bansal, CA

Many small and mid-sized tax practices take security seriously in practice. They use strong passwords, lock down laptops and back up regularly, yet they have nothing written down. Regulators, the IRS and cyber insurers increasingly expect a document. October is Cybersecurity Awareness Month, which makes it a good time to check whether your firm's written information security plan (WISP) reflects what you actually do.

Why a written plan is required

As CPA Practice Advisor explained in a plain-language guide (October 2, 2026), the Gramm-Leach-Bliley Act treats paid tax preparers as financial institutions. Under the FTC Safeguards Rule, the core duty is a written information security plan that reflects the firm's actual size and data. Informal practices with nothing written down don't count.

The IRS has reinforced this. IRS Tax Tip 2026-72 (October 1, 2026), wrapping up the Security Summit's 2026 "Protect Your Clients; Protect Yourself" series, highlighted the federal WISP requirement and IRS Publication 5708, which helps tax professionals create a WISP. It also covered scams targeting EFINs, PTINs and CAF numbers, phishing (spear, clone and whaling), and IP PIN and MFA tools. For Cybersecurity Awareness Month, IR-2026-119 (October 2, 2026) also reminded tax professionals about WISPs. Our notes also record that PTIN renewal includes a data-security-plan acknowledgment.

What a WISP should cover

Based on the FTC Safeguards Rule elements summarized in the CPA Practice Advisor guide, a practical WISP should include:

• A named Qualified Individual responsible for the program. One of the most common gaps is having no named owner.
• A risk assessment of what client data you hold, where it lives and who can reach it.
• Access controls. Each person gets only what their role needs, and access is removed promptly when roles change.
• Encryption of client data, in storage and in transit.
• Multi-factor authentication. The guide flags missing MFA as a frequent gap.
• Vendor oversight for software providers, IT support and any outsourced teams.
• An incident response plan that says who does what when something goes wrong.
• Training and periodic review so the plan stays current.

The IRS "Security Six" baseline

IRS Publication 4557 sets out the "Security Six" basics: antivirus software, firewalls, multi-factor authentication, backup software and services, drive encryption, and a VPN for remote access. These are a minimum, not a complete program. If any of them is missing, fix that first.

If something goes wrong

IRS Tax Tip 2026-72 sets out steps for a data breach: report it to your IRS Stakeholder Liaison and to the relevant state tax agency, tell affected clients, and consider whether Form 14039 (Identity Theft Affidavit) is appropriate for affected taxpayers. Write these steps and the contact details into your incident response plan now, so nobody has to look them up mid-incident.

Outsourcing and the WISP

If your firm uses outsourced or offshore teams, or AI tools, your WISP has to cover them. Record what data each provider receives, how access is granted and removed, what safeguards they've committed to in writing, and how you'll know if something goes wrong. Return information shared with others also raises §7216 consent questions, which should be handled alongside your WISP.

Who should own it in a small firm

In a two- or three-partner practice, the Qualified Individual is usually a partner or office manager rather than a dedicated security specialist. That's fine, provided the role is written down, the person has time set aside for it, and outside IT support is managed under the vendor oversight section. Keep the WISP short enough that staff actually read it. A clear plan that matches daily practice is more useful than a long template nobody follows.

A one-afternoon starting point

1. Download IRS Publication 5708 and use it as your outline.
2. Name your Qualified Individual.
3. List every place client data lives: systems, devices, cloud services and vendors.
4. Check the Security Six against each, starting with MFA.
5. Write down your incident response steps and contacts.
6. Schedule a review date, and put it in the calendar.

Common gaps to look for

• Shared logins to tax software, client portals or accounting files. Every user should have their own credentials so activity can be traced.
• Former staff and vendors who still have access. Make offboarding a checklist item, not a memory exercise.
• Client documents sent by plain email. Use a portal or another secure transfer method, and write that requirement into the plan.
• Untested backups. A backup you have never restored from is a hope, not a control.
• A plan written once and never revisited. Review the WISP when you add a new system, vendor, office or remote arrangement, and at least on the schedule your plan sets.

None of these needs expensive tools. Most need a named owner and a calendar reminder.

Security is part of every outsourcing conversation. If you're evaluating help for your US CPA firm, ask any provider, including us, to explain in writing how they handle client data.

Check current IRS guidance: this article summarizes sources as of 14 October 2026 and is general information, not tax advice. Rules, dates and figures can change. Confirm them against the cited IRS release or publication and current IRS.gov guidance before acting.