What Does WISP Mean in Tax? The Written Information Security Plan, Explained
What does WISP stand for in tax?
In tax, WISP stands for Written Information Security Plan. As of November 2026, that is the name the IRS uses for the written program a tax practice keeps to protect client data. IRS Tax Tip 2026-49 (June 16, 2026) says, "A Written Information Security Plan – or WISP – is just one tool for tax professionals to protect their client's data, and it's required by law." Publication 5708 (Rev. 8-2024), the Security Summit sample, is titled Creating a Written Information Security Plan for your Tax & Accounting Practice.
The Safeguards Rule, 16 CFR Part 314, calls that document an information security program. Section 314.2 defines the program as the administrative, technical, and physical safeguards used to handle customer information. Section 314.3(a) requires it to be written and suited to the firm's size, complexity, activities, and the sensitivity of the information. Publication 4557 (Rev. 6-2024) and IR-2026-92 (August 18, 2026) use the same name.
Who is expected to keep one?
Paid tax return preparers are required by law to create and maintain one. Form W-12 (Rev. October 2026), line 11, states: "I am aware that paid tax return preparers are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information." The line is a required Yes or No box. The October 2026 instructions say to check it to acknowledge that awareness. The form sets no staff minimum. Is a WISP required for tax preparers? explains what maintaining the plan means in practice.
Section 314.1(b) lists tax preparation firms among the financial institutions under FTC jurisdiction. Section 314.2(h)(2)(viii) names an accountant or other tax preparation service that is in the business of completing income tax returns. Publication 5708 says those professionals are covered regardless of size, that the plan must be written and accessible, and that a sole practitioner can use a shorter plan than a larger firm. 16 CFR 314.6 sets aside four items in section 314.4 for a firm that maintains customer information on fewer than 5,000 consumers: the written risk assessment in (b)(1), the penetration-test and vulnerability-scan schedule in (d)(2), the written incident response plan in (h), and the annual written report in (i). The written program in section 314.3 remains. A WISP for a solo tax preparer covers the one-person office.
What goes inside a WISP?
A WISP is the written account of how that office protects customer information. Section 314.4 is the contents list as of November 2026.
- A Qualified Individual oversees and enforces the program and may work for the firm, an affiliate, or a service provider. If that person is outside the firm, the firm keeps compliance responsibility and names a senior member of its own personnel to oversee them.
- A risk assessment covers reasonably foreseeable internal and external risks. Unless section 314.6 applies, paragraph (b)(1) says the assessment is written and states how each risk will be mitigated or accepted.
- Safeguards in paragraph (c) include limited access, an inventory of data and systems, encryption in transit over external networks and at rest (or an alternative the Qualified Individual approves when encryption is infeasible), multi-factor authentication for any individual accessing an information system unless the Qualified Individual approves an equivalent in writing, and activity logs.
- Disposal is due no later than two years after customer information was last used for the related service, unless the office still needs it, law or regulation requires that it be kept, or targeted disposal is not reasonably feasible.
- The firm trains staff, selects and periodically reviews service providers, requires safeguards in their contracts, and updates the program when risks change.
- Above the 5,000-consumer line, the firm adds a written incident response plan covering the seven areas in paragraph (h) and a written report from the Qualified Individual at least annually.
Paragraph (j) is not in the section 314.6 exception. Effective May 13, 2024, a notification event involving at least 500 consumers is reported to the FTC no later than 30 days after discovery. Section 314.2 defines that event as unauthorized acquisition of unencrypted customer information. The notice was added at 88 FR 77508 (November 13, 2023).
Publication 5708's sample outline (objectives, people, risks, hardware, safety measures, an implementation clause, and attachments) says the sample is not a substitute for the firm's own plan. WISP template for tax professionals compares that sample with each element of section 314.4.
Do you send it to the IRS?
No. Form W-12 does not ask you to attach, upload, or mail the plan. Line 11 is the Yes or No acknowledgment. PTIN renewal and your WISP stays with what the form asks.
Keep the plan at the office. Publication 5708 says to store the WISP in a readable format, such as PDF or Word, make it available for training, and keep a copy offsite or in the cloud. IR-2026-92 says the plan must be written and accessible, then reviewed and updated. How to update your WISP each year covers that review. An incident notice is separate. The news release recommends contacting the IRS Stakeholder Liaison about a data theft, and section 314.4(j) requires the 500-consumer notice to the FTC. Publication 4557 says failing to create and enact security plans may result in an FTC investigation.
How do you start a first draft?
Start from the office you have. Publication 5708 is a sample. It says to read Publication 4557, Publication 1345, and the FTC Data Breach Response Guide, then scale the plan to your size, scope, complexity, and the sensitivity of the data, and to update the WISP as the business changes.
Home is where PlainWISP asks those questions in the browser and drafts the plan from the answers. Drafting and preview need no account. Your answers stay on your device. We never receive or store them. The export follows Publication 5708. You're responsible for implementing your plan. PlainWISP does not file it or set up the controls.
Solo is $149 when you are the only person who handles client files. Firm is $299 for one physical office with up to 10 staff. Multi-office is $599 for more than one physical office, or more than 10 staff. One-time payment. Includes 12 months of updates. No subscription, no automatic charges. See Plans and pricing.
PlainWISP is a document template tool. It is not legal advice, and it is not affiliated with or endorsed by the IRS. A written plan does not by itself meet a legal requirement. Ask a qualified attorney about your own obligations.