IRS Written Information Security Plan (WISP): What CPA Firms in California Must Do
Tax professionals hold sensitive taxpayer information. The FTC Safeguards Rule requires covered tax preparation firms to develop, implement, and maintain a written information security program. The IRS offers guidance and a sample written information security plan, often called a WISP, to help firms get started. See IRS Publication 5709 and the FTC guide.
In brief: A WISP should fit the firm's size, operations, and the sensitivity of the information it handles. The Safeguards Rule includes requirements for a qualified individual, risk assessment, safeguards, staff training, service-provider oversight, and program evaluation. Some specific provisions have exceptions for institutions maintaining information concerning fewer than 5,000 consumers. Review the rule and your facts with qualified advisers.
What belongs in a security plan?
The FTC's Safeguards Rule guide explains the program requirements. A practical plan should identify the qualified individual responsible for oversight, assess risks to customer information, describe the safeguards used to address those risks, and explain how those safeguards are monitored and updated. It should also address staff training and oversight of service providers. A template must be adapted to the firm's actual practices.
The rule's specific obligations and exceptions matter. Institutions maintaining information about fewer than 5,000 consumers are exempt from certain provisions, including the written risk assessment, specified testing, written incident response plan, and annual written report requirements. That does not exempt them from the Safeguards Rule or the duty to maintain an appropriate security program. Even where an incident response plan is not specifically required, planning for a data theft remains prudent.
What technical safeguards should a tax firm review?
- Limit access to customer information and remove access promptly when it is no longer needed.
- Protect customer information in transit and at rest as required, or document an approved alternative where the rule permits one.
- Use multifactor authentication for access to information systems unless the qualified individual approves an equivalent control in writing.
- Monitor and test safeguards, apply updates, and manage vulnerabilities in proportion to the firm's risks and applicable requirements.
- Review contracts and security practices of providers that handle customer information.
- Practice the response to a suspected incident, including contacts for the firm's IRS Stakeholder Liaison, insurers, legal counsel, and service providers.
Where the rule's testing provision applies, it calls for continuous monitoring or, in its absence, annual penetration testing and vulnerability assessments at least every six months. It does not impose annual penetration testing on every tax firm regardless of its circumstances.
When must a firm notify the FTC?
The FTC's notification provision applies to a qualifying event involving unauthorized acquisition of unencrypted customer information concerning at least 500 consumers. Covered institutions must notify the FTC as soon as possible and no later than 30 days after discovery, subject to the rule's terms. See the FTC reporting guidance. Other federal, state, contractual, and professional notification obligations may also apply.
Does California privacy law apply to every CPA firm?
Not automatically. California privacy requirements depend on the business, the data, statutory thresholds, and applicable exemptions. A firm should ask qualified counsel to assess its circumstances, alongside federal requirements and professional obligations.
How can AdVran help?
AdVran's compliance and risk management services can help inventory systems, configure safeguards, document technical controls, and support ongoing monitoring. The firm and its advisers remain responsible for its security program and legal decisions.
Related reading
Spent years in physical security at Rapid Response Monitoring, first running large help desk and support operations, then training staff and helping keep contracts with major security companies on track. He now runs AdVran's support desk and manages its larger cybersecurity projects.
Written by engineers who run the work.
- 4+ yrs
- Founder's engineering at Boeing, incl. NASA projects
- 3.5k+
- Endpoints managed
- 24/7
- SOC monitoring
- 5.0
- Clutch rating, 4 verified reviews
Healthcare, financial services, legal, aerospace and defense, manufacturing, education and non-profit clients. Every one of them has a named engineer.
