WISP for tax preparers: what the Safeguards Rule requires

Do tax preparers legally need a WISP?

Yes. In an August 2026 release, the IRS and the Security Summit partners said federal law requires tax and accounting professionals to maintain a written information security plan. The duty comes from the Gramm-Leach-Bliley Act and the FTC's Safeguards Rule, which treat tax preparers as financial institutions, whatever the size of the practice.

That framing surprises many solo preparers, who don't think of themselves as a financial institution. But the FTC's guidance names tax preparation firms as a covered example, and it looks at what a business does rather than how it describes itself.

The IRS's Publication 5708 provides a template, aimed particularly at smaller practices, and Publication 4557 covers safeguarding taxpayer data more broadly. Use them as a starting point. A filled-in template that nobody follows won't help you after a breach, so write down what you really do.

What must the plan cover?

The FTC's guidance sets out nine elements. This table shows each one and what it tends to look like in a five-person practice. The right-hand column is our illustration, not regulatory text.

How does the 5,000-consumer exemption work?

This is where many summaries are too loose. Under 16 CFR 314.6, institutions holding customer information on fewer than 5,000 consumers are relieved of four paragraphs of the rule: 314.4(b)(1), (d)(2), (h) and (i). Those cover the written risk assessment, annual penetration testing and six-monthly vulnerability scans, the written incident response plan and the annual report to the board.

Everything else still applies, including the Qualified Individual, safeguards, encryption, MFA, training and vendor oversight. And the IRS's position on a written plan doesn't carve out small firms, so don't treat the exemption as permission to skip the document. Many small firms keep a short risk assessment and incident plan anyway, as you can't choose safeguards sensibly without them.

Worked example: counting consumers

The rule counts consumers, so a client list can understate the figure. This example is illustrative. A firm has 2,300 active client records and 900 older records it hasn't deleted, for 3,200 records. If 1,500 are joint filers, spouses add 1,500 people, making 4,700. Add 800 dependents whose Social Security numbers appear on returns, and the raw count of named people reaches 5,500.

Whether each of those people counts as a "consumer" under the rule is a legal question, so ask a qualified adviser. The practical lesson is that the exemption may be closer than it looks, and that deleting records you no longer need also helps your count.

How do retention and disposal rules fit together?

Few WISP guides tackle this, yet it's where an honest plan gets awkward. The Safeguards Rule says customer information must be securely disposed of no later than two years after you last used it to serve the customer, unless there is a legitimate business need or legal requirement to keep it, or targeted disposal isn't feasible.

Other duties can run longer. For example, Publication 1345 requires EROs to keep Form 8879 for three years from the return due date or IRS received date, whichever is later. Your plan needs a schedule that shows the reasoning for each record type, along these lines:

Check other duties that may apply to you, including state rules and your professional body's requirements, and have your adviser review the final schedule. What matters is that each extended period has a written reason.

What should you do if there is a breach?

Under the Safeguards Rule, a notification event is the unauthorized acquisition of unencrypted customer information involving at least 500 consumers. You must notify the FTC as soon as possible, and no later than 30 days after discovery. That's another strong reason to encrypt, since encrypted data is treated differently.

The IRS also recommends a data theft response plan and contacting your IRS Stakeholder Liaison. Your plan should fit on one page, and be printed, because your systems may be locked when you need it.

1. Isolate affected devices, but don't wipe them, as you may need the evidence.
2. Call your Qualified Individual, IT provider and insurer.
3. Contact your IRS Stakeholder Liaison.
4. Work out which clients and what data are affected.
5. Check FTC and state notice duties with legal counsel.
6. Record each decision with the time and who made it.

State breach laws have their own deadlines and thresholds, so a smaller incident can still require action.

Where do small firms usually have gaps?

Walk through your own daily habits with these questions. Any "no" belongs in your risk assessment with a named owner and a date.

• Does each staff member use their own login, with MFA, on every system holding client data?
• Do you know every location where client documents sit, including phones and personal email?
• Do clients have a secure way to send documents, and do staff redirect them to it?
• Is customer information encrypted at rest and in transit?
• Do you remove access on the day someone leaves?
• Do you have written security answers from each software vendor?
• Has someone tested restoring a backup this year?
• Is there a dated training record for each person?

Email attachments usually show up as the biggest weakness, because tax documents get copied into mailboxes that nobody ever cleans out. Moving that one habit reduces your risk more than most purchases will.

How can you get a plan in place this month?

You don't need a consultant to get a first version finished, although you may want one to review it. Here's a realistic four-week schedule for a small practice before January.

• Week 1: name your Qualified Individual, download Publication 5708 and list each system and location holding client data.
• Week 2: write the risk assessment, and turn on MFA wherever it's missing.
• Week 3: collect vendor answers, set your retention schedule and delete what you no longer need.
• Week 4: write the incident plan, train staff, sign and date the document, and diary the next review.

This article is general information rather than legal advice. Rules depend on your circumstances and state, so speak with a qualified adviser about anything you're unsure of.

What should you ask your software vendors?

The rule requires you to select service providers that can maintain appropriate safeguards, to require those safeguards by contract, and to assess them periodically. A one-page questionnaire covers most of this for a small firm. Send the same questions to your tax software, email host, cloud storage, portal and IT provider.

1. Where is our client data stored, and who at your company can reach it?
2. Is it encrypted in transit and at rest?
3. Do you support multi-factor authentication for all our users?
4. Which independent security reports or certifications do you hold today, and can we see them?
5. How, and how quickly, will you tell us about an incident affecting our data?
6. How do we export our data, and how is it deleted when we leave?
7. Do you log user activity, and can we see those logs?
8. Which subcontractors handle our data?

File each reply with the date, and repeat the exercise yearly. A vague answer isn't automatically a deal-breaker, but your risk assessment should record it, along with what you've decided to do about it. You may accept a gap for a low-risk tool. You shouldn't accept it for the system holding Social Security numbers.

How Zaquil handles client data flow in your WISP

A clear statement first: software doesn't make a firm compliant. Zaquil holds no HIPAA or SOC certification and won't write your plan. Treat it like any other vendor in your oversight file, and ask for written answers on storage, encryption and deletion. What it can do is cut down how many places client data ends up, which makes your plan simpler to write and follow.

• What the client sees: a branded secure portal for uploading requested documents, filling in organizers and approving or e-signing letters, rather than attaching them to email.
• What the firm sees: a Documents hub with firm-only files, and client records with contacts, so your data inventory has one main location.
• Conversations: email, chat, SMS, WhatsApp and calls in one inbox against the client record, rather than on personal phones.
• Enforcing habits: automations can create tasks, such as a yearly WISP review or a leaver checklist, and recurring jobs bring back your annual training and vendor review.
• Requests: templates with checklists keep document requests to what each job needs, so you collect less in the first place.

See the accounting and tax setup for how this looks in practice. Plans start at $19 a month, with a 14-day free trial and no credit card needed.