Does Your Tax or Accounting Firm Need a WISP? What the IRS and FTC Expect

The short answer

Yes, if you prepare tax returns. The IRS says tax professionals “are legally required to have a written, accessible plan and should review, test, and update it regularly” (IRS IR-2026-92). The FTC Safeguards Rule names tax preparation firms as covered businesses (FTC).

What applies to a smaller firm

Firms holding information on fewer than 5,000 people are exempt from only four items: a written risk assessment, penetration testing and scans, a written incident response plan, and an annual report (16 CFR 314.6). Even a two-person practice still needs:

• A named Qualified Individual to run the program (this can be an outside provider)
• Two-step login (MFA)
• Encryption of client data
• Staff training
• Oversight of your vendors
• Secure disposal of old data

Bookkeeping or accounting without tax returns

The rule may apply. It depends on whether your services count as financial activities. Tax preparation does.

If something goes wrong

If a breach reaches 500 or more people, you must report it to the FTC within 30 days, and those reports can be made public (FTC). The IRS asks tax professionals to contact their Stakeholder Liaison right away so it can block fraudulent returns (IRS).

Where to start

The IRS publishes a free WISP template for smaller practices, Publication 5708. The template is the easy part. The value is making it match what you actually do: who has access, where client files live, and what you do on a breach day. Your PTIN renewal also asks you to acknowledge this duty.