Written Information Security Plan (WISP)

What a written information security plan is and who needs one

A written information security plan is the document version of your security program: who runs it, what risks you found, which safeguards you use, and how you respond when something goes wrong. Under the FTC Safeguards Rule, a covered financial institution must "develop, implement, and maintain a comprehensive information security program" in writing ¹.

The rule implements the Gramm-Leach-Bliley Act (GLBA), so "GLBA compliance" for a non-bank business usually means meeting this rule ¹. It covers financial institutions under FTC jurisdiction that are not subject to another regulator's enforcement authority ¹. The rule and the FTC's guide name examples ¹²:

• Tax preparers and accountants. The definition expressly includes "an accountant or other tax preparation service that is in the business of completing income tax returns" ¹.
• Mortgage brokers and lenders, payday lenders and finance companies ¹².
• Auto dealers that lease vehicles on a nonoperating basis for more than 90 days, and dealers that arrange financing for customers ¹.
• Other non-bank businesses that offer financial products or services; the FTC guide lists more examples ².

Banks and federally insured credit unions answer to their own regulators, and SEC-registered firms fall under Regulation S-P instead ⁹. If you are unsure which applies, confirm with counsel. Our pages on IT for accounting firms and IT for financial services firms cover the systems those practices run.

FTC Safeguards Rule requirements: what the WISP must contain

A WISP that meets the Safeguards Rule covers nine elements, which the FTC summarizes in its business guide ². As a checklist:

1. A Qualified Individual who oversees the program. This can be an employee, an affiliate's employee or a service provider, but the business stays responsible ¹.
2. A written risk assessment that identifies foreseeable internal and external risks to customer information ¹. See our cybersecurity risk assessment guide.
3. Safeguards under 314.4(c) ¹: - access controls limited to what each person needs - an inventory of data, devices, systems and facilities - encryption of customer information in transit and at rest, or compensating controls the Qualified Individual approves - secure development practices for in-house apps - multi-factor authentication for anyone accessing any information system - secure disposal no later than two years after last use, with listed exceptions - change management procedures - monitoring and logging of user activity
4. Monitoring and testing. Continuous monitoring, or else annual penetration testing and vulnerability assessments at least every six months ¹. See penetration testing.
5. Security awareness training for staff, updated as risks change ¹.
6. Service provider oversight: pick capable providers, require safeguards by contract and check on them ¹.
7. Keeping the program current as the business and threats change ².
8. A written incident response plan ¹.
9. A written report from the Qualified Individual to the board or equivalent governing body, at least annually ¹.

Small firms, the 5,000-consumer exemption and MFA

Businesses that keep customer information on fewer than 5,000 consumers are exempt from four provisions, and from nothing else ¹. The four are the written risk assessment, continuous monitoring or annual penetration testing, the written incident response plan and the annual board report ¹.

Everything else still applies, including the Qualified Individual, encryption, MFA, training, secure disposal and service provider oversight ¹. A three-person tax office still needs MFA on every system that holds client data, unless the Qualified Individual approves equivalent controls in writing ¹.

The size exemption does not change what the IRS expects of tax professionals. IRS Publication 5708 says tax and accounting professionals are financial institutions under the rule regardless of size and that the law requires them to have a WISP ⁵. It also says a sole practitioner can use "a more abbreviated and simplified plan than a 10-partner accounting firm" ⁵. Short is fine. Missing is not.

MFA matters beyond compliance: a Microsoft study found it lowered the risk of account compromise by 99.22% ¹¹, and it appears on insurers' lists of key controls ¹². See cyber insurance requirements.

The 30-day FTC breach notification

Since May 13, 2024, covered businesses must notify the FTC as soon as possible, and no later than 30 days after discovery, of a notification event involving at least 500 consumers ¹³. The FTC defines a notification event as "unauthorized acquisition of at least 500 consumers' unencrypted information" ². Reports go through an online form on the FTC's website ³.

Two details matter for small firms:

• Encryption changes the outcome. The trigger is unencrypted information ². An encrypted laptop that goes missing is a very different event from an unencrypted one.
• State law runs separately. Notices to the affected consumers themselves are governed mainly by state breach laws, which set their own deadlines.

Put the FTC deadline, your insurer's claims number and your IT provider's emergency contact in the incident response section of the WISP. If a breach is happening now, call your cyber insurer's hotline first if you have a policy, report to the FBI at ic3.gov, and do not wipe or rebuild systems before evidence is preserved ¹⁰. Our incident response page covers the first hours.

Tax preparers: IRS Publications 4557 and 5708 and the PTIN question

Tax professionals get the most direct guidance of any covered group. IRS Publication 4557, Safeguarding Taxpayer Data, says that under the Safeguards Rule tax return preparers "must create and enact security plans to protect client data," and that failing to write one may lead to an FTC investigation ⁴.

IRS Publication 5708, Creating a Written Information Security Plan for your Tax and Accounting Practice, is a sample WISP template written for smaller practices ⁵. It is a practical free starting point for a tax office, and we do not offer a substitute download. Publication 5709 is a shorter companion guide ⁶. In August 2026 the IRS and the Security Summit repeated that federal law requires tax and accounting professionals to create and maintain a WISP ⁷.

The PTIN application now asks about it. Form W-12, line 11, "Data Security Responsibilities," has preparers check Yes or No to a statement that they are aware paid preparers are required by law to create and maintain a WISP ⁸. The form asks you to confirm awareness of the requirement. It is not an IRS review of your plan. Answering Yes while having no plan is a poor position to be in if an incident follows.

A tax office WISP built from Publication 5708 should still be fitted to your actual systems: tax software, client portal, email, scanners and backups. Generic text that names systems you do not use is a red flag to anyone reviewing it.

NYDFS Part 500 for New York financial firms

New York financial firms regulated by the Department of Financial Services (DFS) face a stricter cybersecurity regulation, 23 NYCRR Part 500. Its second amendment took effect November 1, 2023, with phased deadlines that ended November 1, 2025 ¹³. Key points:

• MFA: since November 1, 2025, MFA for any individual accessing any information system, unless the CISO approves a compensating control or the firm qualifies for the limited exemption ¹⁴.
• Asset inventory: written procedures for a complete, documented asset inventory since November 1, 2025 ¹³.
• 72-hour notice: report a cybersecurity incident to DFS within 72 hours of determining it occurred ¹³.
• Annual filing: a certification of material compliance, or an acknowledgment of noncompliance, by April 15 each year ¹³.

The limited exemption in 500.19(a) covers firms with fewer than 20 employees and contractors, less than $7,500,000 in gross annual revenue in each of the last three fiscal years, or less than $15,000,000 in year-end total assets ¹³. Exempt firms still owe a risk assessment, asset inventory, incident notice, the annual filing and MFA for remote access and privileged accounts ¹³¹⁴. A virtual CISO often fills the CISO role at small firms.

Policy templates and IT documentation to attach

A WISP is easier to follow when it points to short, specific policies instead of trying to hold everything. The rule requires the program to be written ¹; it does not prescribe a format. Common attachments:

• Acceptable use policy. What staff may do on company devices, email and internet, and that client data stays in approved systems.
• Password and authentication policy. Passphrase length, a password manager, no shared accounts, and MFA everywhere, matching 314.4(c)(5) ¹.
• Incident response plan. Who decides, who calls the insurer, who files the FTC report within 30 days ¹².
• Access and offboarding procedure. How access is granted, reviewed and removed the day someone leaves.
• Data retention and disposal. Secure disposal within two years of last use unless an exception applies ¹.
• Vendor list. Every service provider with access to customer data and the safeguards each contract requires ¹.
• IT documentation. The asset and data inventory, network diagram and backup schedule.

Templates from IRS Publication 5708 ⁵ or a reputable source save time, but replace every placeholder with your real systems and names. A managed IT provider can supply much of the inventory and evidence; see what an MSP does and managed IT for small business.