Free WISP template: safeguard your tax practice today

In an environment where cybersecurity and data protection have never been more important, having a Written Information Security Plan (WISP) isn’t just an operational benefit — it’s also a legal requirement for US-based accounting and tax practices. 

But what exactly is a WISP, and do you need one? Don’t worry, we’ve got you covered. In this article, we’ll explain everything you need to know about WISPs. But that’s not all! To save you time, we’ll provide you with a free WISP template you can download, customize, and use today. 

What is a WISP template?

A WISP template is a structured document designed to help businesses — including accounting and tax firms — outline their strategies for securing sensitive data. It enables them to record key information about their internal security controls, policies, and procedures. 

For accounting and tax practices, a WISP template has several purposes: 

• Provide a clear and consistent framework for protecting client data
• Help ensure compliance with data protection laws and industry standards
• Outline procedures for mitigating the risk of data breaches and cybersecurity threats 
• Foster client trust by demonstrating a commitment to data security

No two WISPs are the same, however. The exact information and elements you need to include will depend on the size of your practice, the scope and complexity of its services, and the type of client data you handle. That said, the Internal Revenue Service (IRS) states that a good WISP should focus on three core areas:

• Physical safeguards to protect client data from physical threats
• Technical safeguards to ensure that your devices and network are safe and secure
• Administrative safeguards to ensure your team is well trained and informed

IRS-mandated WISP requirements 

In recent years, the IRS issued an updated version of publication 5708. This publication outlines the requirement for accounting and tax professionals to implement and maintain a WISP. It also provides detailed information about how to create an effective and legally compliant WISP. 

The requirement for accounting and tax firms to maintain a WISP arose in response to the Gramm-Leach-Bliley Act (GLBA), which requires financial institutions to protect client data. In response to this act, the Federal Trade Commission (FTC) issued a range of measures that financial institutions must implement to keep client data safe, known as the Safeguards Rule. This includes the requirement to implement and maintain a WISP. 

Specifically, the FTC requires all accounting and tax firms to:

• Select a qualified person to coordinate its information security program
• Identify and assess the risks to client data across the firm’s operations
• Evaluate the effectiveness of the current safeguards for controlling these risks
• Design, implement, and monitor a safeguards program — and regularly test it
• Ensure that third-party service providers adhere to strict safeguards relating to the handling of client data
• Evaluate and adjust the WISP in line with business changes or the results of security testing 
• Outline the use of multi-factor authentication across your software and systems
• Report a security event directly to the FTC as soon as possible (no later than 30 days from discovery) if it affects 500 or more people

Under the Gramm-Leach-Bliley Act, failure to meet WISP obligations can lead to hefty fines from the FTC of up to $50,000. On top of financial penalties, being caught in the FTC’s crosshairs is bad for business, leading to reputational damage that can be hard to recover from.

Why is having a WISP essential for accounting professionals?

Maintaining a WISP brings many tangible benefits to accounting and tax practices in the US. In this section, we’ll explore some of the key advantages. 

Regulatory compliance

The accounting industry is overseen by stringent regulations — and for good reason. Accountants regularly handle sensitive personal and financial data. Maintaining a WISP is an effective way to stay on the right side of regulatory obligations. It not only helps you avoid crippling financial penalties but also helps you maintain your reputation as a trustworthy service provider. 

Protection of client data

Beyond being a regulatory requirement, maintaining a WISP has practical benefits for your business. It sets out clear processes and procedures to keep client data safe and secure, including encryption protocols, access controls, and regular audits. These safeguards reduce the risk of unauthorized access or data breaches, ensuring that personal and financial information remains secure.

In addition to a WISP, the software you use can play a major role in keeping client data secure. TaxDome, for example, offers a secure client portal where clients can manage all touchpoints with your firm — from uploading and e-signing documents to messaging accountants and making payments. 

Our client portal is the most secure on the market. TaxDome is the only practice management software that has passed both the Intuit and Google security reviews. Both reviews involved penetration testing, deployment reviews, and a policy and procedure review to ensure maximum data security. 

Effective risk management

As the world becomes ever more reliant on digital technology, the risk of cyberattacks and data breaches continues to grow. Accounting firms must be proactive in identifying and mitigating potential risks. A comprehensive WISP sets out protocols for assessing risks and uncovering vulnerabilities. It provides firms with the tools and processes they need to protect themselves against costly incidents. 

Trust and credibility

In accounting, trust and credibility are everything. Clients are more likely to trust firms that have a proven track record of keeping client data safe. Maintaining a strong WISP shows a commitment to data protection and regulatory compliance. In turn, this enhances your credibility.

Avoiding penalties

As we’ve already discussed, the FTC can levy hefty fines for not properly maintaining a WISP. For smaller firms, these fines could be crippling. But more than that, being on the end of disciplinary action will be a major red flag for existing and potential clients. By having a WISP in place, you can avoid these penalties and focus on making money, not losing it. 

Swift responses to data breaches

While a strong WISP provides safeguards against data breaches, no business is completely immune to cyberattacks or human oversight. In the event that client data is breached, a WISP will set out a detailed incident response plan. This enables you to act quickly, contain the breach, and limit potential damages. 

Employee training and awareness

Human error is the leading cause of data breaches, with 82% of incidents involving a human element. With this in mind, employee training and awareness is one of the most effective strategies your firm has for preventing data breaches. A comprehensive WISP addresses this by incorporating regular employee training sessions. 

Alignment with industry standards

Beyond compliance, a WISP aligns your accounting practice with broader industry standards for data security. It reflects a proactive approach to safeguarding client information. Ultimately, this serves as a competitive advantage in a world where professionalism and data security are paramount.

Sample free WISP template for download

So what exactly should a WISP include? While the details will differ from firm to firm, there are some essential elements you must incorporate to ensure that your WISP covers all bases. Based on the official guidelines from IRS publication 5708, a WISP should at least include sections on the following: 

• Purpose and scope. You should clearly define the objectives of the WISP, what it includes, and why. 
• Designated individual(s). Your WISP should name the qualified individual(s) responsible for coordinating your security programs and list their responsibilities and obligations. You should also list all authorized users at your firm, including their access levels and responsibilities.
• Risk assessment. Your WISP should list the types of data your firm handles, as well as any potential risks to that information. It should also document procedures to monitor, test, and ultimately mitigate these risks.
• Hardware inventory. Your WISP should include an exhaustive list of your physical hardware, where each item is located, and what data each item stores or processes.
• Safety measures. Your WISP should list any data security measures you have in place in your firm. You should also include an employee code of conduct that outlines data security responsibilities at the individual level, as well as guidelines for employee training, screening, and background checks.
• Implementation clause. You should add a declaration that your WISP complies with the GLBA and any other relevant legal requirements. Include the date of implementation and your firm’s name. Ensure that the clause is signed by the firm owner or principal operating officer. 

Download your free WISP template

To speed up the process of creating a WISP, we’ve put together a free WISP template tailored for accounting and tax professionals. To use the template, simply click the link below, copy and paste it into another Google doc or Word doc, and customize it to suit your needs. 

Download your free WISP template here >

Please note: this template is a rough guide for what a WISP should include. The information and bullet points provided are not exhaustive. They may not cover all legal, regulatory, or specific business requirements for your firm. Rather, they are guidelines for the type of information your firm should provide in your WISP. 

For more detailed information on how to draft and implement a WISP, we recommend a close look at the official IRS guidelines.

To sum up

To ensure compliance with the GLBA and other relevant laws and regulations, accounting and tax firms must now implement and maintain a WISP. This acts as a road map for your firm’s data security strategy, providing all the information, policies, and procedures you need to keep client data safe.

Drafting a WISP from scratch can be a time-consuming process. With the free template we’ve provided in this article, you’ll have a headstart in understanding the type of information to include in your WISP. We hope you find it useful. 

To take your client data security to the next level, you need the right tech. TaxDome offers the most secure client portal on the market, as well as a range of tools to help you stay compliant with the latest tax and accounting regulations. To see it in action, request a demo today. 

Resource links

• IRS publication 5708 — Creating a Written Information Security Plan for your tax and accounting practice
• IRS — Safeguarding Taxpayer Data: A Guide for Your Business
• FTC — Safeguards Rule
• FTC — Gramm-Leach-Bliley Act