A written information security plan (WISP) is a documented set of policies and safeguards that explains how a business protects sensitive customer information. It describes who is responsible for security, what risks the business faces, which protections are in place, and what happens if something goes wrong.
For many accounting firms, tax preparers, and other financial professionals, a WISP isn't optional. Federal rules require it. For other professional services firms, it's still one of the clearest ways to show clients that their information is handled responsibly.
Who Needs a WISP?
The FTC Safeguards Rule requires businesses that the rule treats as "financial institutions" to develop, implement, and maintain a written information security program. That category is broader than most people expect. It includes tax preparers, many accounting firms, mortgage brokers, and other businesses that handle consumers' financial information.
The IRS reinforces this for tax professionals. It published IRS Publication 5708, a guide and template for creating a WISP for tax and accounting practices.
Other firms, such as consultants, engineers, architects, and marketing agencies, may not fall under the Safeguards Rule. Many still create a WISP because clients ask for one, cyber insurance carriers expect one, or state privacy laws encourage reasonable security programs.
What Goes Into a WISP?
A WISP should fit your firm's size and complexity. Under the FTC Safeguards Rule, a written program generally covers these elements:
- A qualified individual who oversees the security program. This can be an employee or an outside provider.
- A written risk assessment identifying threats to customer information.
- Safeguards to control those risks, such as access controls, encryption, and multifactor authentication.
- Testing and monitoring to confirm those safeguards work.
- Staff training on security awareness.
- Service provider oversight for vendors who handle customer data.
- An incident response plan describing what to do after a security event.
- Regular reporting to firm leadership on the program's status.
Some requirements are scaled back for smaller businesses that maintain information on fewer than 5,000 consumers. Check the rule carefully, or with a qualified advisor, to see which apply to you.
WISP vs. IT Policy: What's the Difference?
An IT policy usually describes rules for employees, such as acceptable use or password requirements. A WISP is broader. It ties policies to risks, assigns responsibility, and explains how the whole program is maintained over time. Think of IT policies as chapters inside the WISP.
Common Mistakes Firms Make
Downloading a template and stopping there
Templates are helpful starting points. But a WISP that describes safeguards you don't actually have can create more trouble than having no plan at all. The document must match reality.
Writing it once and never updating it
Your firm changes. You add software, hire staff, open remote access, or switch vendors. The WISP should be reviewed at least once a year and after significant changes.
Leaving out the incident response plan
Many WISPs explain how to prevent problems but not what to do when one happens. Under amendments to the Safeguards Rule, covered businesses must also notify the FTC of certain security events involving the information of 500 or more consumers. Knowing your steps in advance matters.
Forgetting vendors
Cloud tax software, document portals, and outsourced bookkeeping all handle client data. Your WISP should explain how you evaluate and monitor them.
Frequently Asked Questions
How long should a WISP be?
Long enough to cover your real systems and risks. For a small firm, that might be 10 to 20 pages. Larger firms often have more.
Do I need to file my WISP with the government?
No. You keep it on file. You may need to show it to regulators, auditors, insurers, or clients who ask.
Can my IT provider write it for me?
An IT provider can help significantly, especially with the technical safeguards. Firm leadership should still review and own the final plan, because it reflects business decisions about risk.
Is a WISP the same as being compliant?
No. A WISP documents your program. Compliance depends on actually carrying out what the plan describes.
Getting Started
Begin with an inventory of the client information you hold and where it lives. Then review the IRS template or another reputable framework, adapt it honestly to your firm, and assign a qualified individual to keep it current.
For a look at what firms commonly overlook, see the compliance blind spot that could cost you thousands. Maise Technology helps firms build practical security programs through our compliance services, and we support accounting and financial practices through our IT support for financial firms.
Have a question about your firm's WISP? Get In Touch.
This article provides general information and is not legal advice. Consult qualified counsel about how the FTC Safeguards Rule applies to your business.
