WISP for Tax Professionals: Is Your Information Security Plan Ready for the Real World?
By Mahfuzur Rahman | SecYork Technology
Tax and accounting firms manage some of the most sensitive information entrusted to any business. Taxpayer identification numbers, Social Security numbers, financial records, payroll information, banking details, and confidential business documents are routinely collected, processed, stored, and exchanged as part of everyday operations.
For many firms, these activities are essential to serving clients efficiently. They also create cybersecurity responsibilities that extend far beyond installing antivirus software or protecting office computers with passwords.
A single compromised email account, improperly shared document, lost laptop, or unauthorized access to a cloud application can create serious consequences for both the firm and the clients who depend on it.
Federal requirements recognize these risks. Tax professionals are expected to maintain a Written Information Security Plan (WISP) designed to protect customer information.
However, the real challenge is not simply producing a document. It is ensuring that the documented security program reflects how the business actually operates, addresses meaningful risks, assigns accountability, and supports effective security decisions.
At SecYork, we view a WISP as part of an organization's cybersecurity governance and risk management architecture—not merely a compliance document.
The central question is simple:
If a security incident occurred tomorrow, would your WISP help your organization respond
effectively, or would it simply be another document stored in a folder?
When a Routine Tax Practice Becomes a Cybersecurity Risk
Consider a small accounting firm providing tax preparation, bookkeeping, and payroll services.
The firm has several employees, uses cloud-based accounting applications, communicates with clients through email, and exchanges financial documents electronically.
Its operations may depend on a relatively small number of systems:
Business email and collaboration services.
Tax preparation and accounting software.
Payroll applications.
Client document storage and sharing.
Employee laptops and office computers.
Network connectivity and backup services.
Each system supports a legitimate business requirement. The risk emerges when sensitive data, access permissions, technology dependencies, and operational responsibilities are not managed consistently.
Imagine that an employee receives an email appearing to come from a long-standing business client. The message asks for an urgent change to payroll banking information. The employee processes the request without verifying it through an independent communication channel.
Later, the firm discovers that the client's email account had been compromised and the payment instructions were fraudulent.
The incident may now involve financial loss, client notification, an internal investigation, disrupted operations, and questions about the controls used to authorize financial changes.
This is a hypothetical scenario, not a report of an incident involving a particular organization.
The important lesson is that having email security technology does not necessarily mean a business has established appropriate procedures for managing financial and information-security risks.
A WISP should help connect those responsibilities. The issue is not simply whether an employee made a mistake. It is whether the organization designed safeguards to reduce the likelihood and consequences of that mistake.
What Is a Written Information Security Plan?
A Written Information Security Plan, commonly known as a WISP, documents how an organization intends to protect sensitive information through administrative, technical, and physical safeguards.
An effective plan should identify what information the organization handles, the risks associated with that information, and the people and processes responsible for managing those risks.
It should also explain how the organization evaluates security controls, responds to incidents, manages service providers, and updates its security practices as business operations change.
A WISP is not the same as a technology inventory, a security product list, or a generic policy template.
It is a structured information security program documented in a form that management and responsible employees can understand and apply.
A useful way to think about its purpose is:
Business Operations → Sensitive Information → Risk Assessment → Security Safeguards → Assigned Responsibility → Monitoring and Improvement
The value comes from connecting these elements rather than documenting them independently.
Why Tax Professionals Need a WISP
The Internal Revenue Service and its Security Summit partners have repeatedly emphasized that tax professionals must create and maintain Written Information Security Plans to protect client information. The requirement is connected to the Gramm-Leach-Bliley Act (GLBA) and the Federal Trade Commission's Safeguards Rule.
Under the FTC's framework, tax preparation firms can qualify as financial institutions because of the financial services they provide. Covered financial institutions must develop, implement, and maintain appropriate written information security programs. These programs must consider the size and complexity of the organization, the nature and scope of its activities, and the sensitivity of the customer information involved.
The IRS specifically reinforced these responsibilities in its August 18, 2026 Security Summit guidance.
The objective is not to make every small accounting firm operate like a large financial institution.
It is to establish security practices appropriate to the business and the information it handles.
Importantly, the FTC Safeguards Rule includes limited exceptions from certain provisions for covered institutions maintaining customer information concerning fewer than 5,000 consumers. These exceptions do not eliminate the overall responsibility to maintain applicable safeguards.
Organizations should therefore evaluate the specific requirements applicable to their activities rather than assume that being a small business creates a complete exemption.
What Should an Effective WISP Include?
An information security program should address the organization's real operating environment.
The following areas are particularly important.
1. Security Governance and Accountability
Every security program needs an accountable owner.
For businesses subject to the relevant FTC Safeguards Rule provisions, a Qualified Individual must be designated to oversee the information security program.
This individual may be an employee or an appropriately qualified external service provider, subject to the applicable oversight requirements.
The WISP should clearly establish:
Who is responsible for managing the security program.
Who approves security policies and major risk decisions.
Who manages access to sensitive information.
Who coordinates with external technology providers.
Who leads incident response and recovery activities.
Without clear ownership, even well-designed security controls can become ineffective.
2. Information and Asset Identification
A business cannot protect information effectively if it does not understand where that information resides. Tax practices may store client information across accounting applications, laptops, cloud storage, email, external drives, and physical records.
The WISP should identify the relevant information categories, business systems, authorized users, service providers, and data-handling processes. This does not necessarily require an expensive technology platform.
For a small organization, a well-maintained inventory and clear ownership can provide a practical foundation.
3. Risk Assessment and Security Safeguards
An effective security program should identify foreseeable threats and evaluate their potential business consequences.
Examples include:
Unauthorized access to tax or payroll information.
Phishing and business email compromise.
Lost or stolen devices.
Ransomware and malicious software.
Excessive access privileges.
Inadequate backup or recovery arrangements.
Unauthorized disclosure of physical or electronic records.
Third-party technology failures.
The organization should determine which risks require attention and what safeguards are appropriate. A documented risk assessment connects cybersecurity decisions to business priorities. It also helps management understand why particular controls deserve investment.
4. Identity, Access, and Data Protection
User accounts and access permissions are central to protecting confidential customer information.
Security policies should address appropriate authentication, access approval, access reviews, privileged accounts, device protection, encryption, and the removal of access when personnel leave the organization.
For covered institutions subject to the applicable Safeguards Rule provisions, multi-factor authentication and other specified technical controls may be required.
The goal is not simply to document that MFA exists. It is to establish how access is granted, reviewed, controlled, and maintained throughout its lifecycle.
5. Employee Awareness and Security Procedures
Employees regularly make decisions involving sensitive information. They receive client documents, respond to payment instructions, share files, access business applications, and communicate with external parties.
Security awareness therefore needs to extend beyond occasional training presentations. A practical program should address how employees verify sensitive requests, recognize suspicious activity, report incidents, handle confidential information, and follow approved security procedures.
Training should be relevant to the actual work employees perform.
6. Incident Response and Business Continuity
A WISP must account for the possibility that preventive safeguards will not always work. Consider what happens if a tax preparation system becomes unavailable during filing season.
Who identifies the incident?
Who contacts the technology provider?
Who determines whether customer information was affected?
How will operations continue, and who decides whether regulatory notification is necessary?
Incident response responsibilities should be established before an emergency occurs.
The organization should maintain appropriate response, escalation, documentation, communication, and recovery processes.
An incident response plan does not guarantee that an incident will be prevented.
It helps reduce uncertainty when timely decisions matter.
7. Vendor and Service Provider Oversight
Many small businesses outsource important technology functions. They may rely on managed IT providers, accounting software vendors, cloud platforms, payroll processors, and third-party document storage. Outsourcing technology does not automatically transfer all information-security responsibilities to the vendor.
The security program should identify relevant providers, their responsibilities, applicable security expectations, and appropriate methods for reviewing their performance.
The key management question is:
Who is responsible for protecting the information, and how does the organization verify that the responsibility is being fulfilled?
The New York SHIELD Act Adds Another Important Consideration
For organizations operating in New York, federal requirements may not be the only relevant obligations.
The New York Stop Hacks and Improve Electronic Data Security Act, commonly called the SHIELD Act, requires businesses maintaining covered private information to implement reasonable security safeguards.
These safeguards address three broad categories:
Administrative safeguards: Security responsibilities, risk assessment, personnel practices, vendor oversight, and security program maintenance.
Technical safeguards: Security considerations in systems and networks, protection of information processing and storage, and measures to detect and respond to attacks or failures.
Physical safeguards: Protection of records, offices, equipment, information storage, and secure disposal.
The law includes provisions recognizing the circumstances and resources of smaller businesses.
A firm should evaluate how these requirements apply to the private information it maintains and whether overlapping legal requirements affect how compliance is demonstrated.
An effective WISP can help organize relevant safeguards and supporting documentation.
However, possessing a WISP does not automatically establish compliance with the SHIELD Act or other applicable requirements. The documented program and the actual safeguards must be considered together.
The Difference Between Having a WISP and Having an Effective Security Program
A company may already have a Written Information Security Plan. That is an important starting point. But several questions still deserve attention.
Was the document tailored to the actual business, or copied from a general template?
Does it accurately describe the organization's technology and information-handling processes?
Are the documented security responsibilities assigned to identifiable individuals?
Have the stated safeguards actually been implemented?
Are employees familiar with the procedures that apply to their work?
Have significant changes in software, staffing, vendors, or operations been reflected in the plan?
Has management reviewed the security program recently?
These questions highlight an important distinction:
WISP documentation describes the security program. Security implementation determines how that program operates in practice.
Both matter.
A well-written policy cannot compensate for missing security controls. Equally, strong technical controls may be difficult to govern consistently when responsibilities, procedures, and review requirements are undocumented.
The stronger approach is to maintain alignment between security documentation and actual operations.
Why Generic WISP Templates Are Not Enough
The IRS provides Publication 5708, Creating a Written Information Security Plan for Your Tax & Accounting Practice, to help tax professionals develop appropriate security documentation.
It is a useful starting point, particularly for smaller practices.
However, organizations should not mistake a sample template for a completed security program.
Two accounting firms may use similar software while having very different operating environments.
One may have three employees and operate entirely through cloud services.
Another may have multiple offices, remote employees, internal servers, several external IT providers, and a much larger volume of customer information. Their risks, responsibilities, recovery arrangements, and security procedures may differ significantly.
A suitable WISP should reflect those differences.
The objective is not to produce the longest document. It is to produce a plan that is accurate, actionable, and appropriate for the organization.
WISP Readiness Assessment and WISP Development Are Different Services
Organizations generally approach WISP improvement from one of two starting points. Some already have a security plan and want an independent assessment of its completeness, currency, and alignment with applicable requirements.
Others need to establish or substantially update their written security program. These are related but distinct activities.
WISP Readiness Assessment
A readiness assessment examines existing documentation, security responsibilities, selected safeguards, and available supporting evidence. It helps management understand whether the documented program appears consistent with relevant requirements and which areas may require additional attention.
Typical outcomes include an executive assessment summary, an evidence-based gap register, regulatory control mapping, and a prioritized improvement roadmap.
WISP Development and Documentation
WISP development focuses on creating or updating the organization's written security program using company-specific information. It may include security governance, risk assessment methodology, information handling, identity and access procedures, vendor oversight, incident response responsibilities, and program maintenance.
Development should identify documented controls that are already operating, proposed controls that still require implementation, and responsibilities that management must formally assign or approve. Neither service alone guarantees compliance or eliminates cybersecurity risk.
A practical approach is:
Assess Current State → Identify Gaps → Develop or Update the WISP → Implement Required Safeguards → Review and Improve
Organizations with an established program may need only targeted validation or updates. Others may benefit from both assessment and documentation.
Building a Practical WISP Readiness Baseline
A small or mid-sized tax practice can begin by establishing a clear understanding of its current information-security arrangements.
A practical baseline should address the following:
Information Inventory: Identify sensitive customer information and the systems used to process and store it.
Accountable Security Ownership: Assign responsibility for the security program and management oversight.
Documented Risk Assessment: Identify meaningful internal and external risks and prioritize appropriate controls.
Identity and Access Management: Establish user access, MFA, privileged access, and account lifecycle procedures.
Data Protection: Define appropriate encryption, storage, sharing, retention, and disposal practices.
Employee Training: Provide role-relevant security awareness and reporting procedures.
Vendor Oversight: Document important service providers, responsibilities, and security expectations.
Incident Response: Define escalation, investigation, notification evaluation, and recovery responsibilities.
Monitoring and Testing: Establish appropriate safeguards review, testing, and evidence retention.
Program Maintenance: Review the WISP after significant business changes and at suitable intervals.
This baseline supports organized planning but does not replace the full requirements applicable to a particular covered institution. The objective is to create a sustainable process rather than a one-time documentation exercise.
Final Thoughts
Cybersecurity discussions with small businesses often begin with technology. Antivirus software, firewalls, cloud security, multi-factor authentication, and backup solutions are all important.
But technology alone does not answer every security governance question.
Who is accountable for protecting customer information?
Which risks matter most to the business?
How are safeguards evaluated?
Who responds when something goes wrong?
How does management know whether its security arrangements remain appropriate?
A Written Information Security Plan helps bring these responsibilities together.
For tax professionals, the importance is reinforced by federal information-security obligations and the sensitive nature of the information they handle.
For New York businesses, applicable state security requirements may provide additional considerations.
The goal should not be to create a document that can simply be presented when someone requests evidence of a security program. The stronger objective is to maintain a security program that management understands, employees can follow, and the organization can improve as its risks change.
At SecYork, we help organizations evaluate security readiness, understand relevant cybersecurity obligations, develop practical security documentation, and identify prioritized improvements across governance, risk, compliance, and technical safeguards.
Our approach connects security requirements with the business processes and information that organizations depend on.
The central principle is straightforward:
“A WISP should not exist merely to demonstrate that a security policy was written. It should demonstrate that information security is understood, assigned, implemented, and continuously managed.” — SecYork Cybersecurity Team
Does your tax or accounting practice have a current WISP? SecYork can help assess the readiness of your existing security program, identify documentation and safeguard gaps, and develop or update a Written Information Security Plan tailored to your operations.
Visit SecYork.com to discuss a WISP readiness assessment or documentation engagement.
Stay lean. Stay secure. Stay virtual, with SecYork.
Choose SecYork. Contact Us | www.secyork.com
Authoritative References
Internal Revenue Service: IRS and Security Summit — Tax Professionals Need a Written Information Security Plan (August 18, 2026)
Internal Revenue Service: Publication 5708 — Creating a Written Information Security Plan for Your Tax & Accounting Practice
Internal Revenue Service: Written Information Security Plans Are Essential for Tax Pros (June 16, 2026)
Federal Trade Commission: FTC Safeguards Rule: What Your Business Needs to Know
New York State Attorney General: SHIELD Act — Security and Data Protection Requirements
Comments