Written Information Security Plan for CPA Firms

A Written Information Security Plan (WISP) documents how a CPA or tax-preparation firm protects customer information. For firms covered by the FTC Safeguards Rule, the information-security program must be written and appropriate to the organization’s size, complexity, activities, and information sensitivity.

This guide is educational and not legal advice. Use counsel and qualified security professionals to tailor the plan.

A WISP can sound like a document created only to satisfy a regulator. In practice, it should be the playbook your firm can actually use when hiring an employee, approving a vendor, changing a system, reviewing a security alert, or responding to an incident. If the plan does not reflect how your firm really operates, it will quickly become shelfware.

Quick answer: A CPA firm WISP should identify who owns the security program, what customer information and systems the firm maintains, the risks to that information, the safeguards used to reduce those risks, how vendors are supervised, how incidents are handled, and how the plan is tested, reported and updated.

Assign Ownership and Approval

Name the Qualified Individual responsible for implementing and supervising the information-security program. Document who provides executive oversight, who approves risk decisions, and who maintains each supporting procedure. A service provider may assist with technical responsibilities, but management should understand the program and its status.

Connect the WISP to the Risk Assessment

The WISP should not be a generic policy binder. It should connect identified customer information, systems, threats and vulnerabilities to specific safeguards and responsible owners. Maintain a remediation register showing the risk, planned action, priority, owner, due date and completion evidence.

Document Technical and Operational Safeguards

Describe how the firm manages identities, privileged access, multifactor authentication, encryption, supported devices, endpoint protection, email security, network controls, logging, monitoring, backups, secure disposal and change management. The plan should point to detailed procedures rather than becoming an unmanageable list of product settings.

What Should a CPA Firm WISP Include?

• Purpose, scope, definitions, and governing authority
• Designation and responsibilities of the Qualified Individual
• Customer-information and system inventories
• Written risk-assessment methodology and results
• Access control, MFA, encryption, endpoint, email, network, and logging requirements
• Data retention and secure disposal
• Security awareness and role-based training
• Vendor selection, contractual safeguards, and monitoring
• Testing, vulnerability assessment, penetration testing, and remediation
• Change-management requirements
• Incident-response and recovery procedures
• Annual reporting and approval

Start With a Data and Systems Inventory

Identify where nonpublic personal information is collected, stored, processed, transmitted, archived, and disposed of. Include tax applications, accounting systems, portals, email, Microsoft 365, cloud platforms, endpoints, mobile devices, backups, paper records, vendors, and personnel.

Connect the WISP to the Risk Assessment

A template alone is not sufficient. Safeguards should respond to documented risks, responsible owners, implementation dates, validation methods, and residual risk. Reassess after material system, staffing, vendor, or threat changes.

Use Authoritative Sources

Review the FTC Safeguards Rule compliance guide, 16 CFR Part 314, and the Gramm–Leach–Bliley Act. The IRS also publishes security resources for tax professionals.

WISP Maintenance Checklist

• Review the plan at least annually and after material changes.
• Document completed training and testing.
• Track remediation through closure.
• Review access regularly and remove unnecessary accounts.
• Reassess service providers and contracts.
• Exercise incident-response and recovery procedures.
• Prepare the Qualified Individual’s written report.

WISP FAQs

Can an MSP write the entire WISP?

An MSP can supply technical information and implementation support, but the firm remains responsible for its program and should involve management and legal counsel.

Is a downloaded template sufficient?

No generic template can document a firm’s actual data, risks, safeguards, vendors, testing, and responsibilities without careful customization.

Who should approve the WISP?

Appropriate senior leadership should review the Qualified Individual’s reporting, approve risk decisions and confirm that resources and accountability are assigned. Firms should ask counsel how approval should be documented for their circumstances.

When should the WISP be updated?

Review it regularly and whenever material changes affect systems, personnel, vendors, threats, incidents, business operations or the risk assessment. Supporting inventories and procedures should also stay current.

InnerPC can help document technical controls through a CPA cybersecurity assessment.