A WISP in a weekend for tax preparers

A written information security plan is a short document that names who is responsible for client data, lists where that data lives, and states the safeguards you actually use. The IRS asks tax professionals to confirm at PTIN renewal that they are aware of the requirement and have a plan, and its Publication 5708 is a free template. A nine-person firm can write a truthful one in a weekend with no consultant. Here is the shape, using Ortiz CPA as the example.

Ortiz CPA is a nine-person CPA and tax firm on Microsoft 365, with Drake for preparation and TaxDome for the client portal. Daniel Ortiz, the partner, got the PTIN renewal question in October, checked the box last year, and this year wants a plan that would survive a client asking to see it. He is the qualified individual. The weekend is his.

The nine elements of 16 CFR 314.4

The FTC Safeguards Rule at 16 CFR 314.4 lists what an information security program must contain. The IRS template follows the same list, so the plan writes itself in that order:

1. (a) A qualified individual responsible for the program.
2. (b) A risk assessment of the data you hold and the threats to it.
3. (c) Safeguards: access controls, an inventory of data and systems, encryption in transit and at rest under (c)(3), secure development, multi-factor authentication under (c)(5), secure disposal, change management, and logging of user activity.
4. (d) Regular testing or monitoring of the safeguards.
5. (e) Staff training and security awareness.
6. (f) Oversight of service providers, by contract and by periodic assessment.
7. (g) Adjusting the program as the business and the threats change.
8. (h) A written incident response plan.
9. (i) An annual written report to the owner or board.

Paragraph (j) adds a duty to notify the FTC within 30 days of an event affecting 500 or more consumers. Under §314.6, a firm holding information on fewer than 5,000 consumers is exempt from the written risk assessment in (b)(1), the written incident response plan in (h) and the annual report in (i). Ortiz CPA, with a few hundred clients, qualifies. Daniel writes short versions anyway, because the IRS template asks for them and because a one-page incident plan is what you want at 7 am on the day something goes wrong.

Saturday morning: the facts (elements a and b)

• Name the qualified individual: Daniel. Name a backup for when he is away.
• List the client data you hold: returns, W-2s and 1099s, SSNs, bank account numbers for direct deposit, copies of IDs used for identity verification.
• List where it lives: Drake, TaxDome, Microsoft 365 mailboxes, two laptops that travel, the scanner, the file room, and the backup.
• List who has access: four preparers, two seasonal preparers from January to April, the office administrator, the outside IT person, and the firm’s three software vendors.
• Write the risk assessment as a table: for each place data lives, what could go wrong (phished mailbox, lost laptop, wrong recipient, vendor breach) and what you do about it. Half a page is honest; ten pages is theatre.

Saturday afternoon: the safeguards (elements c, d and e)

• Access controls: everyone signs in as themselves; no shared passwords; seasonal staff removed on a named date after the filing deadline.
• Encryption: Drake and TaxDome encrypt at rest (confirm in their documentation and cite the page); laptops use full-disk encryption; email is covered in the Sunday section.
• MFA: on Microsoft 365, Drake, TaxDome and the bank. Element (c)(5) does not offer a way around this.
• Disposal: paper shredded on a schedule; old laptops wiped and the certificate kept.
• Logging and testing: the Microsoft 365 audit log retained; PXCMail per-message records; a quarterly check that the controls are still on.
• Training: a short session each January before the season, with the sign-in sheet kept. Publication 4557 lists the topics the IRS expects a preparer to cover.

Sunday morning: the email section

This is where most WISPs are fiction. Write what is true:

• “Client documents are encrypted in transit because our email gateway requires TLS and uses encrypted delivery when a recipient cannot.”
• “Tax documents (W-2, 1099, 1040) and SSNs are detected before sending and encrypted automatically.”
• “Every account uses multi-factor authentication; seasonal staff are removed at season end.”
• “Email is archived for seven years and the vendor provides an annual confirmation of safeguards.”

If you cannot write those sentences truthfully, the plan tells you what to buy. For Ortiz CPA the missing pieces were enforced TLS with a fallback and automatic detection of tax documents. The firm put PXCMail Gateway in front of Microsoft 365, kept every mailbox where it was, and signed the Data Processing and Safeguards Addendum during signup. That addendum is the service-provider contract that element (f) asks for.

Sunday afternoon: providers, incidents and the report (elements f to i)

• Service providers: list Drake, TaxDome, Microsoft, the email gateway and the IT contractor, with the contract or addendum that binds each and the date you last read their security page.
• Incident response: one page. Who calls whom, in what order; how to reset accounts; when to notify clients, the IRS stakeholder liaison for your state as Publication 4557 instructs, your carrier and, if 500 or more consumers are affected, the FTC within 30 days under (j).
• Annual report: a dated memo from Daniel to the partners saying what changed, what was tested and what is still open.
• Adjust: a calendar note for the first week of October, before PTIN renewal, to reread the whole thing.

Keep it alive

Date it, sign it, review it each October before PTIN renewal, and attach the annual safeguards letter PXCMail issues. Keep the prior version; a client or an examiner who asks to see the plan is reassured by one that has been revised. The 12 email questions → · The Safeguards Rule, in plain English →

Questions

Does the IRS review my WISP when I renew my PTIN?

No. Renewal asks you to confirm you are aware of your data security responsibilities, including having a plan. The plan matters when a client, a state board, a carrier or the FTC asks for it after an incident, which is exactly when a checked box is worthless.

We have fewer than 5,000 clients. Can we skip the plan entirely?

No. §314.6 exempts small firms from three written items; the rest of 314.4, including encryption, MFA, training and service-provider oversight, still applies, and the IRS still expects a written plan.

Is the Publication 5708 template enough on its own?

It is a good skeleton. The value is in the facts you add: your systems, your people, your vendors, and sentences about email you can defend. A template with the blanks filled in generically is the checked box again.

How much does the email part cost a nine-person firm?

PXCMail Gateway is $6 per seat per month billed yearly, or $9 with the seven-year accounting archive; nine seats is $54 or $81 a month, above the $49 minimum. It goes in front of the Microsoft 365 account you already have.

What counts as a consumer for the 5,000 threshold?

Individuals whose nonpublic personal information you hold, including former clients whose records you still keep. Count your files, not your active engagements.

---

Was this useful? Tell us at [email protected]. Related: checklists · regulations in plain English.

Sources

• 16 CFR 314.4, Elements of an information security program — lists the nine elements, including encryption in transit and at rest at (c)(3), MFA at (c)(5), training at (e), service providers at (f) and FTC notification at (j).
• 16 CFR 314.6, Exceptions — exempts firms holding information on fewer than 5,000 consumers from the written risk assessment, the written incident response plan and the annual report.
• IRS Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice — the IRS template a preparer’s WISP can follow.
• IRS Publication 4557, Safeguarding Taxpayer Data — describes the safeguards, training topics and reporting steps the IRS expects of tax professionals.