What Is a Written Information Security Plan (WISP) and Why Your Firm Must Have One

• 14 June 2025
• Security

A Written Information Security Plan or WISP is a formal, customized security framework that outlines the specific policies an organization has put in place to safeguard sensitive information. The key components of a WISP include conducting risk assessments, training employees on data security practices, implementing both physical and electronic safeguards, and establishing clear incident response procedures.

For accounting firms, maintaining a WISP is not just best practice—it’s a legal requirement. Without one, firms risk non-compliance, which could lead to severe consequences. Many accountants remain unaware of the legal obligations surrounding data protection and the need for a Written Information Security Plan (WISP).

Without a comprehensive WISP in place, firms risk exposure to data breaches, legal penalties, and even the loss of their Preparer Tax Identification Number (PTIN). These repercussions not only harm the firm’s reputation but also create operational challenges, potentially leading to costly fines and long-term consequences. Ensuring awareness and understanding of these legal obligations is essential for accounting firms to protect both their clients’ data and their own business operations.

Why Creating a WISP is Essential?

A well-structured WISP outlines the policies to help safeguard and respond to potential data breaches. Attempting to create a structured WISP on your own, without expert assistance can lead to costly mistakes. Legal requirements, such as those set by the IRS (Publication 5708) and the FTC Safeguards Rule (Gramm-Leach-Bliley Act), must be met to avoid penalties and protect client data effectively. Professional guidance ensures that your WISP aligns with these regulations and provides the necessary safeguards for your firm.

Key Steps to Creating a WISP

If your firm is looking to create your Written Information Security Plan, the IRS has laid out some essential points to consider and include in their policy.

• First, designate employees to manage and coordinate the firm’s information security program. This ensures accountability and clear responsibility for security practices.
• Next, conduct a thorough risk assessment of the firm’s operations and existing security measures. This will help identify any vulnerabilities in the current system and highlight areas needing improvement to better protect customer information.
• A robust security framework should then be implemented. Regular monitoring and testing of this program will ensure that it remains effective in protecting sensitive information.
• It’s also essential to select service providers with appropriate security protocols in place. Oversee their handling of customer data to maintain consistent protection across all business operations.
• Finally, regularly evaluate and adjust the security program in response to business changes and results from security tests. This continuous process helps ensure the plan adapts to emerging risks and maintains optimal security standards.

What Firms Must Include in a WISP?

The following key steps will help guide your firm in developing a robust WISP:

1. Involve IT Expertise

   IT professionals play a vital role in the development of a WISP. Their technical expertise ensures the plan accurately reflects current security measures, identifies potential vulnerabilities, and applies the best practices for safeguarding sensitive data. Collaborating with IT experts from the beginning provides a solid foundation for the WISP and ensures it addresses all technical considerations. You may choose to leverage your in-house IT staff for this task, provided you have full confidence in their expertise. However, if this isn’t a viable option, it’s worth considering partnering with a trusted service provider like Apps4Rent to address your security requirements.

2. Identify Security Measures

   Documenting your firm’s existing security protocols is an essential part of the WISP. This includes tools like antivirus software, firewalls, encryption, and multifactor authentication. By clearly outlining these security measures, you ensure comprehensive protection and provide a reference point for future updates. This step also highlights any gaps in your current security framework, allowing for corrective actions.

3. Familiarize with Data Disclosure Laws

   Complying with state-specific data breach laws is non-negotiable. Understanding these laws will help your firm avoid penalties and legal repercussions. A comprehensive WISP should integrate knowledge of these regulations to ensure that, in the event of a breach, the proper procedures are followed. Staying informed about data disclosure laws is essential to maintain trust with your clients and uphold your firm’s reputation.

4. Catalog Data Storage Locations

   Tracking all locations where client data is stored is a critical step in securing sensitive information. This includes both physical and digital storage sites. Proper cataloging ensures that no data is left vulnerable to theft or unauthorized access, and it supports compliance with data protection regulations. By documenting these locations, you create an organized framework for managing sensitive data and implementing appropriate security measures.

5. Designate a Security Manager

   Designating a dedicated security manager to oversee the WISP is crucial for successful implementation. This individual will be responsible for ensuring the plan is consistently followed, staff members are trained, and the firm remains compliant with security best practices. A security manager will also serve as the point of contact for any security-related incidents, ensuring a timely and efficient response.

6. Assess Current Security

   Conduct a thorough assessment of your firm’s existing security measures to identify any weaknesses or gaps in your current approach. This evaluation should cover all areas of data protection, including physical security, digital protocols, and employee access. Regular security assessments allow you to stay ahead of emerging threats and ensure your WISP evolves with the changing security landscape.

7. Implement Safeguards

   With the information gathered from assessments and expert input, implement a security program that is tailored to address the unique needs of your firm. This program should include specific protocols for securing data, managing employee access, and outlining acceptable conduct within your firm. Enforcement of these safeguards ensures consistency and a proactive stance on data protection across all levels of the organization.

8. Continuously Update the WISP

   A WISP is not a one-time document but a dynamic plan that should be reviewed and updated regularly. As your firm grows and new threats emerge, your security measures must adapt. By continuously updating the WISP, you ensure that your firm remains aligned with current industry standards, addresses evolving risks, and complies with any new regulations.

   By following these key steps, your firm can create a thorough and effective WISP that not only protects client data but also helps ensure compliance with legal requirements and industry best practices. A well-structured WISP is an essential tool for securing your firm’s information, maintaining client trust, and mitigating the risks associated with data breaches and security threats.

Conclusion: Safeguard Your Firm with a Robust WISP

Establishing a Written Information Security Plan is a critical step for tax preparers, ensuring the protection of sensitive client data, adherence to legal regulations, and the preservation of your firm’s reputation. A comprehensive WISP helps mitigate risks associated with data breaches, non-compliance, and potential security threats, fostering a secure environment for both your clients and your business.

While creating a WISP can be a complex task, partnering with a trusted expert like Apps4Rent can simplify the process. With our experience and specialized knowledge, we can guide you through the development and implementation of an effective WISP, ensuring your firm remains compliant with cybersecurity standards and prepared for emerging threats.

Act Today: Secure Your Business with Expert Support

Reach out to Apps4Rent to learn how we can help you implement a robust WISP and enhance your cybersecurity measures.