WISP Template for Tax Professionals

What the Pub 5708 sample gives you, what the FTC Safeguards Rule still expects, and how to turn a template into a plan that describes your actual office.

If you searched for a WISP template for tax professionals, you probably want one today. PTIN renewal for 2027 is open, the renewal form asks about your written information security plan, and you'd rather not start from a blank page.

Good news: free samples exist, and the best known one is a fine starting point. The catch is that a sample is written for nobody in particular. A useful plan names real people, real systems and real vendors: who your Qualified Individual is, which software and devices hold client files, which outside providers touch that data, and what you will do, step by step, if something goes wrong.

This guide covers whether a WISP is required, what the free sample covers, what the federal rule still expects on top of it, and how to finish the job.

Is a WISP mandatory for tax preparers?

Yes, paid tax return preparers are required to create and maintain a written information security plan, including a one-person office. Is a WISP required for tax preparers? explains who that covers, what the renewal form asks, and what "maintain" means in practice.

What a sample WISP plan for tax preparers gives you: Pub 5708

Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice, is the free sample template from the IRS Security Summit. PlainWISP is not affiliated with or endorsed by the IRS. It's what most people mean by a "WISP template IRS" search. It gives you:

It is also clear about what it is not. Pub 5708 says it isn't meant to replace your own research or serve as a substitute for developing your own plan. It is a sample. It is not an approval, a certification or a filing.

Pub 5708 vs what 16 CFR 314.4 still expects

The Safeguards Rule lists the elements your written program must cover in §314.4. Here's a plain-English comparison. "Gives you" means the sample has a starting section; "still need your judgment" means you have to make decisions and write them down for your own office.

Rule element (§314.4) What Pub 5708 gives you What still needs your judgment
(a) Qualified Individual A responsible-person role (called "Data Security Coordinator" in places) Name the actual person, and use the rule's "Qualified Individual" role and duties
(b) Risk assessment A list of common risks A written assessment with criteria for rating risks, how each risk is addressed, and when you reassess
(c) Safeguards: access, inventory, encryption, MFA, disposal, change management, logging A hardware inventory and a policy checklist Who can open which client files; encryption in transit and at rest; MFA for anyone accessing client data; disposal no later than two years after last use (unless you have a reason to keep it) plus a periodic retention review; change management; activity logging and monitoring
(d) Testing General guidance Continuous monitoring, or an annual penetration test plus vulnerability scans at least every six months, written as a schedule
(e) Training and staff Employee code of conduct Security awareness training for your actual staff, and how you keep it current
(f) Vendor oversight Little beyond general mentions A list of service providers that touch client data (software, cloud storage, IT support), how you chose them, what the contracts require, and how you check on them
(g) Keeping the plan current Annual-review reminder What triggers an update: new staff, new systems, new vendors, an incident
(h) Incident response plan Notification contacts A written plan covering the rule's elements: goals, internal process, roles and decision authority, communications, fixing weaknesses, documentation and reporting, and a post-incident review
(i) Annual QI report Not included A yearly written report from your Qualified Individual to your board or senior person
(j) FTC notice Not covered in the 2024 sample Notifying the FTC within 30 days of discovering an event involving unencrypted information of 500 or more consumers

None of this makes Pub 5708 a bad document. It's a solid outline. It just leaves most of the decisions to you, which is why so many offices download it and then stall.

Want to skip the blank-page part? PlainWISP walks you through these questions in your browser and drafts the plan as you go. You can preview it for free, with no account. Start a draft at plainwisp.com →

PlainWISP by Desert Herders Collective LLC. Not legal advice.

The under-5,000-consumer exemption (§314.6)

Many small practices qualify for a partial exemption. Under 16 CFR 314.6, if you keep customer information on fewer than 5,000 consumers, these specific requirements don't apply to you:

What it does not do: remove the need for a written information security program. You still need a Qualified Individual, safeguards based on the risks you identify, access controls, encryption, MFA, training, vendor oversight and a plan you keep current. The exemption covers §314.4(b)(1), the part that says the risk assessment must be written; the rest of §314.4(b) still applies, so your safeguards should still rest on a real look at your risks. Many small firms write up a short risk assessment and incident plan anyway, because it's the part they'll need on a bad day.

Count consumers honestly. Past clients whose information you still keep may count, not just this season's returns.

W-12 Line 11 and the 2027 PTIN season

When you renew your PTIN, Form W-12 asks you to confirm you know about the WISP requirement. The Form W-12 instructions describe Line 11 as a box you check "to acknowledge awareness that paid tax return preparers are required by law to create and maintain a written information security plan to protect taxpayer information."

A few practical points:

What line 11 asks, and what the form text does not ask you to attach, is covered in PTIN renewal and your WISP.

If you've been renewing with a downloaded sample sitting unopened in a folder, this season is a good time to turn it into a plan that describes your office.

Static Word template vs a guided wizard

You have two practical ways to get from template to finished plan.

Editing a static Word file. Download Pub 5708 or a free Word copy and work through it section by section. It costs nothing. The hard part is knowing which paragraphs to delete, which to rewrite and which rule elements the sample never asks about. Many offices end up with a document that still reads like a sample.

Answering guided questions. A wizard asks about your office (staff, systems, vendors, contacts) and writes those answers into the right sections. You spend your time on decisions instead of formatting.

That's the approach PlainWISP takes. The license and the three plans are on WISP software for tax preparers.

The result is a template for you to finish and put into practice. A written plan does not make an office compliant by itself. You're responsible for implementing your plan, and for keeping it current as your staff, systems and vendors change. PlainWISP is not legal advice. If you have questions about your obligations, talk to a qualified attorney or security professional.

Finish your WISP this week

Free samples are a good place to start. A plan you can actually use names your people, systems and vendors, and covers the parts the sample leaves open.

Start your draft free at plainwisp.com →

PlainWISP is made by Desert Herders Collective LLC. It is a document template tool, not legal advice, and is not affiliated with or endorsed by the IRS or the FTC. You're responsible for implementing your plan.