Free resource
WISP template
Replace every [BRACKETED] field with your firm's details. This template is a starting point, not legal advice.
Written Information Security Plan — [FIRM NAME]
Effective date: [DATE]
1. Purpose & scope
This Written Information Security Plan (WISP) describes how [FIRM NAME] protects taxpayer and client information as required by the FTC Safeguards Rule and recommended by IRS Publication 4557.
It applies to all owners, employees, contractors and systems that access client data.
2. Qualified Individual
Our designated security coordinator is [NAME, TITLE], reachable at [EMAIL / PHONE].
This person oversees, implements and reviews this plan at least annually.
3. Risk assessment
We identify reasonably foreseeable risks to client information, including: phishing, lost devices, unauthorized access, ransomware, and vendor breaches.
Risk assessment last performed: [DATE]. Next review: [DATE].
4. Safeguards
Access controls: unique user accounts, least-privilege roles, multi-factor authentication on all systems holding client data.
Encryption: client data is encrypted in transit and at rest. Clients exchange documents only through our secure portal, never by email attachment.
Devices: full-disk encryption, automatic screen lock after [X] minutes, current antivirus and OS updates.
Data retention: client records retained for [X] years, then securely destroyed.
5. Employee training
All staff complete security awareness training at hire and annually, covering phishing, password hygiene and incident reporting.
Training records kept by: [NAME].
6. Service providers
We select vendors capable of safeguarding client data and require it contractually.
Current vendors with access to client data: [LIST — e.g. client portal, tax software, cloud backup].
7. Incident response
Suspected incidents are reported immediately to the Qualified Individual.
We will contain the incident, assess impact, notify the IRS Stakeholder Liaison, state authorities and affected clients as required, and notify the FTC within 30 days for incidents affecting 500+ consumers.
8. Monitoring & review
We review access logs and audit trails [monthly/quarterly] and re-evaluate this plan at least annually or after any material change.
Plan approved by: [NAME] on [DATE].