Is There an "IRS-Approved" WISP Template? What the IRS Actually Provides

Published November 2, 2026.

Does the IRS approve WISP templates?

No. The IRS does not approve WISP templates. The free download is Publication 5708 (Rev. 8-2024), a sample PDF, and the publication does not call that sample approved.

The opening paragraphs say the document "is intended to provide sample information and to help tax professionals, particularly smaller practices, develop a Written Information Security Plan or WISP." They continue: it "is not intended to replace your own research, to create reliance or serve as a substitute for developing your own plan based upon the specific needs and requirements of your business or firm."

The duty to keep a written program is in the FTC Safeguards Rule. 16 CFR 314.3 says a firm shall develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The safeguards have to fit the firm's size and complexity, the nature and scope of its activities, and the sensitivity of the customer information. 16 CFR 314.4 lists the elements of that program. The text of those two sections does not name Publication 5708, and it does not describe a process for approving a template.

IRS Tax Tip 2026-49 (June 16, 2026) says the IRS and the Security Summit partners "have created an easy sample guide that tax pros can use when making their own WISP." IR-2026-92 (August 18, 2026) says Publication 5708 "provides a template to help tax professionals, especially smaller practices, develop a WISP," and that the plan has to be written and accessible, then reviewed, tested, and updated. A forum post or a vendor page that adds the words "IRS-approved" is using a label those sources do not use.

Form W-12 (Rev. October 2026), line 11, "Data Security Responsibilities," is a required Yes or No box. The line states: "I am aware that paid tax return preparers are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information." Under that sentence the form says, "See IRS Publication 5708 and 4557 for more information about your responsibilities." The box records awareness. The form text does not ask you to attach the plan. Is a WISP required for tax preparers? covers who line 11 addresses.

PlainWISP is a document template tool. It is not legal advice, and it is not affiliated with or endorsed by the IRS.

What is the Pub 5708 sample?

Publication 5708 (Rev. 8-2024) is the free sample the IRS publishes for a written information security plan. The cover title is Creating a Written Information Security Plan for your Tax & Accounting Practice, catalog number 93462W. The PDF is 29 pages, and it has no fill-in fields.

The Security Summit prepared it. The publication describes the Summit as a partnership of the Internal Revenue Service, state tax agencies, private-sector tax groups, and tax professionals. Its stated mission is to fight identity theft and tax refund fraud.

The file is a guide followed by fill-in text. The guide's outline is:

• Define the WISP objectives, purpose, and scope.
• Designate a qualified individual, and list authorized users, their access, and their responsibilities.
• Assess risks: the types of information the office handles, internal and external ways that data can be lost, and how the office will monitor and test.
• Inventory hardware: a description and physical location of each item, and the types of information stored or processed on it.
• Document safety measures. The outline names data collection and retention, data disclosure, network protection, user access, electronic data exchange, Wi-Fi access, remote access, connected devices, reportable incidents, and an employee code of conduct.
• Draft an implementation clause.
• Add attachments.

The sample itself is headed "Sample Template Written Information Security Plan (WISP)" and "For [Your Firm Name Here]." In that sample, personally identifiable information, which it calls PII, means a first and last name, or a first initial and last name, together with a data element the firm keeps. The listed elements include a Social Security number, date of birth, employment data, income and tax filing data, and a financial account number. The sample says PII does not include information taken from publicly available sources.

Six sample attachments follow.

• Attachment A is a record-retention policy.
• Attachment B is rules of behavior for safeguarding client PII.
• Attachment C is security breach procedures and notifications.
• Attachment D is an employee or contractor acknowledgment.
• Attachment E is a hardware inventory.
• Attachment F is a list of people authorized to access PII.

The guide says there is no one-size-fits-all WISP. A sole practitioner can use a more abbreviated and simplified plan than a 10-partner accounting firm. Before writing, it says to read Publication 4557 (Rev. 6-2024), Publication 1345, and the FTC Data Breach Response Guide. Publication 4557 says that under the Safeguards Rule, tax return preparers must create and enact security plans to protect client data, points to Publication 5708 for the written plan, and says failure to do so may result in an FTC investigation. It also says the written plan describes the firm's program and must fit the firm's size, complexity, activities, and the sensitivity of the customer information.

WISP template for tax professionals compares this sample with each element of section 314.4.

What do you still have to fill in yourself?

The firm name, the people, the devices, the vendors, the dates, and the choices the sample leaves blank.

The header is "[Your Firm Name Here]." The responsible-officials section uses "[Employee's Name]" for the Data Security Coordinator and again for the Public Information Officer. The guide says to identify those people by name and position and to define their duties. It says that in most firms of two or more practitioners the two roles should be different people. The Data Security Coordinator runs the security process, including training. The Public Information Officer is the person who speaks for the firm to clients, law enforcement, the news media, and other businesses. Section 314.4(a) uses a different title for the coordinator: Qualified Individual, the person responsible for overseeing, implementing, and enforcing the information security program. The Qualified Individual may work for the firm, an affiliate, or a service provider. If that person is outside the firm, the firm keeps responsibility for compliance and names a senior member of its own personnel to direct and oversee them. The sample keeps the title "Data Security Coordinator." The real name, and the match to the rule's role, are still yours to write.

The same PDF leaves these items open:

• "Last Modified/Reviewed," with a date, and a bracketed note to review and update at least annually. In the sample text, the coordinator reviews the scope of the security measures at least annually, or when a material change in business practices affects records that contain PII.
• An annual calendar review date in the risk-mitigation section.
• An implementation clause. The guide says the clause should show the implementation date, the firm name, that the plan is in place for the Gramm-Leach-Bliley Act and the Federal Trade Commission Financial Privacy and Safeguards Rule, any additional state requirements that apply, and the signatures of the owner or principal operating officer and the Data Security Coordinator.
• Attachment A leaves the retention period blank: paper or electronic records containing PII kept no longer than a number of years written on the line. Section 314.4(c)(6) states its own disposal schedule. Secure disposal is due no later than two years after the last date the information is used in connection with the product or service to the customer it relates to, unless the information is necessary for business operations or for other legitimate business purposes, law or regulation requires that it be retained, or targeted disposal is not reasonably feasible because of the way the information is stored. The same paragraph says to review the retention policy periodically to minimize unnecessary retention.
• Attachment C is the breach procedure. The guide says this attachment will need to be updated annually for accuracy. The sample text includes notice to the IRS Stakeholder Liaison, and a report to the FTC when a security event affects 500 or more people, within 30 days of discovery. Section 314.2 defines a notification event as acquisition of unencrypted customer information without the authorization of the individual to whom the information pertains. Customer information counts as unencrypted for that purpose if an unauthorized person accessed the encryption key. Section 314.4(j) requires notice to the FTC no later than 30 days after discovery when a notification event involves the information of at least 500 consumers. The names to call, and the steps the office will take, are still specific to that office.
• Attachment D is an acknowledgment with the person's name, title, the firm name, and the training date. The guide recommends a signed copy at hire and a refresh at the annual training.
• Attachment E is a hardware table. The columns are the item, its location, the principal user, the in-service date, and the date it was last inventoried. The guide says to catalog devices that come into contact with taxpayer data, including computers, phones, printers, and network equipment, and to record what information each one stores or processes.
• Attachment F is an access table. The columns are name, role, job duties, access level, the date access was granted, and the date access was terminated. The guide says to include contractors who can reach stored PII, such as an IT provider, and to record the date access ends.

The requirements section at the front of Publication 5708 also lists multi-factor authentication for any individual accessing any information system, unless the qualified individual has approved in writing the use of reasonably equivalent or more secure access controls. The sample's remote-access paragraph says remote access is allowed only with multi-factor authentication in addition to a username and password. Whether the office allows remote access, and on which systems, is still a fact about that office.

Does the downloaded PDF count as your plan?

No. The downloaded PDF is the sample, and the header still reads "[Your Firm Name Here]." Publication 5708 says the sample is not a substitute for a plan based on the specific needs and requirements of the firm. It also says the WISP must be written and accessible. IR-2026-92 says firms should review, test, and update the plan regularly, and adjust it when operations change or when security testing and monitoring give a reason to change.

Publication 4557 (Rev. 6-2024) says the Safeguards Rule requires a written information security plan that describes the company's program to protect customer information. A PDF that still carries the sample's brackets describes the sample. Form W-12, line 11, points to Publications 5708 and 4557 for more information. The line does not collect the file. The Yes or No box is the awareness statement printed on the form.

Word vs PDF: which is easier to maintain?

A Word document is easier to maintain. Publication 5708 does not rank the formats. It says, "Once completed, keep your WISP in a format that others can easily read, such as PDF or Word." Tax Tip 2026-49 (June 16, 2026) says to keep the completed plan "in an easy-to-read format such as a PDF or Word document," to store a digital copy in case of a natural disaster or emergency, and to review and update the plan as the size, scope, and complexity of the business change.

The publication calls a WISP an evergreen document that is regularly reviewed, tested, and updated along with changes to the size, scope, and complexity of the business. The sample header says to review and update at least annually. That review changes names and lists: a new coordinator, a laptop on the inventory, a vendor on the access list, a new "Last Modified/Reviewed" date, a refreshed breach-contact list. A Word document is the copy where those edits are ordinary. The IRS file is a 29-page PDF with no fill-in fields. To change a name, copy the text into an editable document and edit that copy.

Use each format for a job the publication already describes. Edit the Word document through the year. When the review is done, save a PDF for staff and for the copy kept offsite or in the cloud. The publication says, "Making your WISP available to employees for training purposes is encouraged. Storing a copy offsite or in the cloud is a recommended best practice in the event of a physical disaster."

The file IRS news releases link is the PDF. In Publication 5708 and in Tax Tip 2026-49, Word is the name of a readable format for the finished plan.

Home is where PlainWISP asks questions about the office in the browser and drafts the plan from the answers. Drafting and preview need no account. Your answers stay on your device. We never receive or store them. The export follows the structure of Publication 5708. The Word and PDF files download only after a license key is accepted. You're responsible for implementing your plan. PlainWISP does not file it or set up the controls.

Solo is $149 when you are the only person who handles client files. Firm is $299 for one physical office with up to 10 staff. Multi-office is $599 for more than one physical office, or more than 10 staff. One-time payment. Includes 12 months of updates. No subscription, no automatic charges. See Plans and pricing.

PlainWISP is a document template tool. It is not legal advice, and it is not affiliated with or endorsed by the IRS. A written plan does not by itself meet a legal requirement. Ask a qualified attorney about your own obligations.