Understanding WISP: A Practical FAQ Guide for Tax Professionals

WISP FAQ — Quick & Practical

What is a WISP?
A Written Information Security Plan that spells out how your firm protects client data—required by the IRS (Pub. 4557) and many states.

Do I really need one?
Yes—if you handle taxpayer information, the IRS and most state boards expect a documented plan, even for solo preparers.

What must it cover?
• Data encryption & backups  • Employee access controls  • Incident-response steps  • Ongoing risk assessments

How long does it take to draft?
A small firm can complete a solid first draft in a day using a good template and asset checklist.

How often do I update it?
Review at least annually—or sooner if you add new software, staff, or offices.

What are the penalties for ignoring it?
IRS can revoke your e-file privileges; states may levy fines; insurers may deny a cyber-claim without a WISP on file.

Does remote work change my WISP?
Absolutely. You must document VPN use, device hardening, and how home networks are secured.

How long does it take to draft?
A small firm can complete a solid first draft in a day using a good template and asset checklist.

Where should I store the plan?
Keep a signed PDF in your client-data vault and a printed copy on-site; regulators can ask for it without notice.

Fast-Track Checklist

• Inventory devices & data locations (laptops, cloud drives, USBs).
• Assign a security officer—even if it’s you.
• Adopt baseline controls: MFA, encrypted backups, patch management.
• Write incident steps: who calls clients, who files IR-202-S.
• Train staff yearly on phishing and safe data handling.
• Review + sign the plan every 12 months.

‍