Why a small firm needs one
Under the FTC Safeguards Rule, a paid tax return preparer counts as a financial institution. That brings an obligation to maintain a written information security program covering how client data is protected — regardless of whether the firm is twelve people or one. IRS Publication 4557, Safeguarding Taxpayer Data, sets out the same expectation in plainer language, and the IRS asks preparers to confirm they have a plan at PTIN renewal.
The rule is deliberately scaled: the program has to be appropriate to your firm's size and complexity, the nature of what you do, and the sensitivity of what you hold. A solo practice does not need the same document as a regional firm. What it does need is a document that addresses every element honestly and describes what the firm actually does — an aspirational plan nobody follows is worse than a modest one that's true.
0 · Firm details
Open with the identifying facts, so the plan is unambiguously yours and unambiguously current.
1 · Designate a Qualified Individual
The Safeguards Rule (16 CFR 314.4(a)) requires one named person accountable for your information security program. In a solo practice that is you; the point is that the accountability is written down rather than assumed. Name them and define their authority.
2 · Risk assessment
Identify reasonably foreseeable internal and external risks to the confidentiality, integrity and availability of client data — and, crucially, where that data actually lives. Most firms are surprised by how many places the answer includes.
- Where is client PII stored? (tax software, email, cloud drive, paper, portals)
- Who has access, and how is that access granted and revoked?
- How is data transmitted to and from clients?
- What are the top three threats to that data today?
3 · Safeguards in place
The controls you have implemented. Work down the list honestly — every unchecked box is an action item, and a plan that records the gaps alongside a date to close them is more defensible than one that quietly claims everything is fine.
- Multi-factor authentication (MFA) on email, tax software, and cloud accounts
- Encryption of client data at rest and in transit
- Access limited to the minimum staff who need it (least privilege)
- Strong, unique passwords via a password manager
- Anti-malware and firewall on every device that touches client data
- Secure disposal of paper and electronic records
- Automatic screen lock and full-disk encryption on all devices
- Regular, tested backups stored securely
4 · Service providers
Vendors that touch client data — tax software, cloud storage, email, e-file providers — must be capable of protecting it, and you are expected to have satisfied yourself of that. List them and confirm safeguards.
5 · Incident response plan
Under IRS rules you must be able to report a data breach quickly, which means deciding who does what before the morning it happens.
- Who is notified first, and how?
- How do you contain and assess the incident?
- Report to the IRS Stakeholder Liaison and your state within required timelines
- Notify affected clients and, where required, the FTC
6 · Employee training & the annual review
A plan written once and filed away is the most common failure mode. Record training and schedule the review.
- All staff trained on this plan at onboarding and annually
- Plan reviewed and updated at least once a year, or after any major change
- Preparer PTINs and W-12 renewals tracked
7 · Attestation
The Qualified Individual attests that the plan has been implemented and will be maintained. This is what turns a document into a commitment.
Take the template
WISP Starter Kit
All eight sections above as a fill-in-the-blanks PDF, with the safeguards checklist and the attestation block laid out to sign.
✓ Ready — download the PDF ↓Stop filling it in by hand
BlackTally builds and maintains the plan for you.
It generates your WISP from these exact controls, publishes it with an attestation and version history, tracks the annual review, and keeps your preparer roster and PTIN renewals current — alongside chasing your clients for missing documents.