Every paid tax preparer is required by federal law to maintain a current, signed Written Information Security Plan. Yet a surprising number of CPA firms discover this requirement for the first time when it’s already too late, during PTIN renewal, a cyber insurance application, or, worse, in the aftermath of a data breach.
If you have searched for a starting document to get ahead of the 2026 filing season, this guide walks through exactly what a compliant plan must contain, why a generic starting point is rarely enough on its own, and how to move from “we know we need one” to “we have an audit-ready plan on file.”
TechFiscal works exclusively with CPA firms, tax preparers, and accounting practices on IRS and FTC compliance, and this guide reflects the requirements our compliance specialists document for clients heading into every filing season.
What a WISP Actually Is (and Why It’s Not Optional)?
A Written Information Security Plan is a formal policy document that describes, in specific and verifiable terms, how your firm collects, stores, accesses, transmits, and disposes of client tax and financial data.
It is not a marketing brochure, and it is not a one-page acknowledgment form. Regulators, auditors, and cyber insurance underwriters treat it as the legal record of your firm’s data security program.
Three overlapping federal frameworks converge on this single requirement:
| Regulation | Applies To | Core WISP Requirement | Enforcement Body |
| IRS Publication 4557 | All paid federal tax return preparers | Written plan covering device inventory, access controls, breach response, staff training | IRS (PTIN/EFIN suspension) |
| FTC Safeguards Rule (16 C.F.R. Part 314) | Financial institutions, including CPA and tax firms | Documented program with a named Qualified Individual and annual risk assessment | Federal Trade Commission |
| Gramm-Leach-Bliley Act (GLBA) | Any firm handling consumer financial data | Written safeguards program with vendor oversight and review cycle | FTC / state regulators |
Since 2024, the IRS has folded WISP attestation directly into PTIN renewal through Form W-12.
Confirming you have a plan in place when you don’t is a false certification made under penalty of perjury, and it puts both your PTIN and your EFIN at risk, independent of whether a breach ever actually occurs.
The Core Elements Every IRS FTC Compliant WISP Must Contain
Regulators are consistent about what they expect to see documented, in writing, inside the plan itself. Before you rely on any starting document, confirm it addresses each of the following:
• Security Program Coordinator– a named individual accountable for maintaining and enforcing the plan
• Technology and data inventory– every device, application, and cloud platform that touches taxpayer data
• Written risk assessment– internal and external threats evaluated and scored, not just listed
• Access management controls– provisioning, termination, and multi-factor authentication requirements
• Encryption standards– for data at rest and in transit
• Vendor and third-party oversight– contractual data-security requirements for every service provider
• Incident response and breach notification procedures– including IRS, FTC, state, and client notification timelines
• Employee training and signed acknowledgment forms
• Annual review documentation– proof the plan has been revisited at least once every twelve months
This structure lines up with the framework IRS Publication 5708 lays out as a sample plan, and with the nine elements the FTC Safeguards Rule specifies for a qualifying information security program.
Why Is a Free WISP Checklist Is a Starting Point, Not a Finish Line?
Such a resource is genuinely useful for understanding the shape of the requirement, it tells you what sections a compliant plan needs and gives you language to work from. What it cannot do is describe your firm’s actual environment.
Regulators have been explicit that a security plan is expected to reflect the technology, staffing, and business processes of the specific practice that signs it.
A checklist filled in with placeholder language, or a WISP template downloaded and left unedited, creates a paper trail that looks compliant on the surface but will not hold up if an examiner, insurer, or plaintiff’s attorney asks follow-up questions.
The practical gap usually shows up in three places:
1. Risk assessments that were never actually performed– the free WISP checklist has a line for it, but no firm-specific analysis backs it up.
2. Vendor management sections that list no real vendors– tax software, cloud storage, and IT providers go unnamed.
3. Incident response contact lists that are blank or outdated– the exact information you need fastest during a real event.
Building Your WISP Step by Step
For firms building a plan internally, the process generally follows five stages:
1. Inventory your data and systems. Document every device, application, and location where taxpayer data lives, from tax preparation software to shared drives and email archives.
2. Assess your risks. Identify realistic threats, phishing, lost devices, vendor compromise, and rate each by likelihood and impact.
3. Write your safeguards. Translate the assessment into specific, measurable policies: password requirements, MFA enforcement, encryption standards, and physical security controls.
4. Document incident response. Define what counts as a security incident, who is notified, and the exact timelines for IRS, FTC, state, and client notification.
5. Review annually. Set a recurring date to revisit the plan and update it whenever technology, staffing, or operations change.
Common Mistakes Firms Make
| Mistake | Why It Matters |
| Signing a template without customizing it | Regulators can identify boilerplate language during a review |
| Skipping the annual review | IRS guidance requires review at least every 12 months |
| Leaving the Qualified Individual field blank | The FTC Safeguards Rule requires a named, accountable person |
| No documented employee acknowledgment | Training without signed records does not satisfy audit requirements |
| Ignoring vendor oversight | Third-party breaches are a leading cause of tax data compromise |
How TechFiscal Builds an Audit-Ready WISP?
Rather than starting from a generic document, TechFiscal’s compliance specialists build a fully customized plan around your firm’s actual technology stack, staffing structure, and workflows, delivered in a few business days.
The process starts with a short discovery consultation, moves through a compliance assessment of your current systems and access controls, and ends with a finished, signed, audit-ready plan mapped to IRS Publication 4557, the FTC Safeguards Rule, and GLBA requirements. You can review the full scope of what’s included on TechFiscal’s WISP Compliance page.
Who This Requirement Actually Covers?
One of the most persistent misunderstandings among tax professionals is that the WISP mandate scales with firm size. It does not. Federal guidance ties the obligation to activity, not headcount: a practice that prepares roughly 11 or more federal returns in a year falls squarely within the FTC Safeguards Rule’s definition of a covered financial institution.
That threshold captures the overwhelming majority of active preparers, from solo practitioners working out of a home office to multi-partner regional firms.
The plan itself should scale, a one-person practice does not need the same volume of documentation as a fifty-employee firm, but the underlying obligation to have a written, signed plan does not disappear because a firm is small.
What’s at Stake Without a Documented Plan?
The consequences of operating without a current WISP are not limited to a hypothetical future breach. Because PTIN renewal now requires an affirmative certification, the exposure exists the moment the form is signed inaccurately.
Beyond the immediate compliance risk, the financial stakes of an actual incident are severe: IBM Security’s 2025 Cost of a Data Breach Report puts the average cost of a breach at $4.88 million, and even a contained incident involving a few hundred client records routinely runs past $100,000 once forensic review, legal fees, notification costs, and lost clients are factored in.
A documented WISP does not make a firm immune to attack, but it is the difference between a firm that can demonstrate reasonable care and one that cannot.
Summing Up,
A downloadable starting point can help you understand the shape of the requirement, but the document that actually protects your PTIN, your EFIN, and your clients’ data is the one that reflects how your firm really operates.
Whether you build that plan internally using the checklist above or bring in a compliance specialist to deliver a custom, audit-ready version before the next filing season, the important step is making sure a signed, current WISP exists, not just the intention to write one.
Frequently Asked Questions
Does a solo practitioner need the same WISP as a large firm?
No. The plan should be proportional to your firm’s size and complexity, but every required section, coordinator, risk assessment, safeguards, incident response, training, and annual review, still needs to be addressed, even if briefly.
How long does it take to put a compliant plan in place?
Building one internally from a checklist can take anywhere from a few hours to several weeks, depending on how much of your environment is already documented. A professionally built plan, like the one TechFiscal delivers, is typically completed within five business days.
Is one WISP enough for a firm with multiple office locations?
Yes, provided the plan explicitly addresses the systems, staff, and risks specific to each location rather than treating the firm as a single undifferentiated environment.
Do Solo CPAs and Small Tax Firms Need a WISP? (2026 Requirements)
If you run a one-person tax practice or a small firm with just a handful of preparers, it is easy to assume that federal data security mandates were written with large institutions in mind, banks, insurance companies, national accounting networks. It is one of the most common and most costly misconceptions in the profession.
The requirement to maintain a Written Information Security Plan does not scale down to zero because your practice is small. This guide breaks down exactly who the rule covers, why the idea of a WISP exemption for small operators is largely a myth, and what solo and small-firm practitioners specifically need to do about it.
The Short Answer
Yes. If you prepare federal tax returns for compensation, hold a PTIN, or handle client financial data in any capacity, you are required to maintain a current, signed WISP, regardless of how many employees you have or how many returns you file in a season.
The Internal Revenue Service does not distinguish between a solo enrolled agent working from a home office and a fifty-person regional firm when it comes to the existence of the requirement. What differs is the scale and complexity of the plan itself, not whether one must exist.
Where the Confusion Comes From?
The misunderstanding around WISP for solo CPA practices generally traces back to one of three sources:
• Confusing the FTC’s activity threshold with an exemption.
The FTC Safeguards Rule applies to institutions “significantly engaged” in financial activities, and the agency has confirmed that preparing roughly 11 or more federal returns annually meets that bar.
Practitioners sometimes read this threshold as a size cutoff below which the rule does not apply, it is not. It is closer to a floor than a ceiling, and the overwhelming majority of active preparers, including part-time and seasonal ones, clear it easily.
• Assuming informal security habits count as a plan.
Using a password manager, backing up files, and being generally careful with client data are good practices, but none of that constitutes a written plan unless it is documented, dated, and signed.
• Believing PTIN renewal is a formality.
Since 2024, Form W-12 has included a direct attestation question about maintaining a data security plan. Answering it without an actual plan in place is a false certification made under penalty of perjury.
Federal Requirements That Apply Regardless of Firm Size
| Requirement | Who It Applies To | What Changes With Firm Size |
| IRS Publication 4557 written plan | All paid federal return preparers | Depth of documentation, not whether a plan is required |
| FTC Safeguards Rule Qualified Individual | Any firm meeting the “significantly engaged” threshold | In a solo practice, the preparer typically fills this role personally |
| Annual risk assessment | All covered firms | Scope of the assessment reflects the size of the technology environment |
| Employee training records | Firms with any staff, including part-time or seasonal | Solo practitioners document their own training and awareness instead |
| Vendor oversight | Any firm using outside software, cloud storage, or IT support | Fewer vendors to document, not zero |
What a Right-Sized Compliance Plan Looks Like?
The good news for solo and small practitioners is that a compliant plan does not need to resemble the security documentation of a national accounting firm. A right-sized approach to small tax firm compliance typically includes:
1. A single named coordinator– usually the owner or managing preparer, responsible for the plan.
2. A concise technology inventory covering the tax software, laptops, email, and cloud storage actually in use.
3. A focused risk assessment built around realistic threats: phishing emails, a lost or stolen laptop, or a compromised software vendor.
4. Documented core controls: multi-factor authentication on tax software and email, an encrypted device policy, and a password manager requirement.
5. A short, specific incident response plan listing exactly who to call, the IRS Stakeholder Liaison, the firm’s cyber insurance carrier, and any affected clients, and within what timeframe.
6. An annual review date, even if the review itself takes less than an hour for a simple practice.
None of this requires a dedicated IT department or a six-figure security budget. It requires a plan that is honest about a small environment and specific about how that environment is protected.
The Real Risk of Assuming You’re Exempt
Operating on the assumption that a small practice falls outside the requirement carries the same consequences as ignoring the requirement outright, because there is no size-based exemption to fall back on. The exposure includes:
• PTIN and EFIN risk tied directly to the W-12 attestation question
• FTC civil penalties that apply per violation, independent of firm size
• Denied cyber insurance claims, since most carriers now require a documented plan as a condition of coverage
• Client liability exposure, since courts have consistently recognized a duty of care owed to clients regardless of practice size
A solo practitioner handling two hundred returns a year holds the same category of sensitive data, Social Security numbers, bank routing information, dependent details, as a much larger firm, just in smaller volume.
Cybercriminals do not discriminate by firm size, and increasingly target solo and small practices precisely because they assume security maturity is lower.
Practical Next Steps for Small Practices?
For most solo and small-firm practitioners, the fastest path to compliance is to treat plan-building as a defined, bounded project rather than an open-ended obligation.
Start with an honest inventory of every system that touches client data, identify the handful of realistic risks specific to a small operation, and document the controls already in place alongside the ones that still need to be added.
Firms that want a faster, audit-ready outcome without dedicating internal hours to the process can have a plan custom-built around their exact setup through TechFiscal’s WISP Compliance service, which is scaled appropriately whether the client is a solo enrolled agent or a ten-person practice.
Why Small Practices Are an Attractive Target?
There is a persistent assumption that cybercriminals focus their efforts on large, high-profile targets because that is where the biggest payoff lies. Threat intelligence from the tax and accounting sector tells a different story.
Solo practitioners and small firms are frequently targeted precisely because attackers expect fewer technical safeguards, no dedicated IT staff, and less rigorous oversight of email and account access.
A single compromised email account at a small practice can expose every client file that preparer has ever handled, often going undetected for weeks because there is no monitoring system in place to flag unusual activity.
The concentration of Social Security numbers, banking details, and income documentation in a small practice’s systems makes it just as valuable a target, return for return, as a much larger operation.
How This Differs From State-Level Small Business Exemptions?
Some state consumer protection and data security statutes include carve-outs or reduced obligations for small businesses based on employee count or revenue. This has occasionally led practitioners to assume something similar exists at the federal level for tax preparers.
It does not. The FTC Safeguards Rule’s 2023 amendments specifically removed the informal distinction that previously allowed some smaller entities to operate under lighter documentation standards.
Every financial institution meeting the “significantly engaged” threshold, tax preparers included, is now held to the same baseline written security program requirements, whether the firm has one employee or one hundred. State-level rules may add obligations on top of the federal floor; they do not lower it.
To Sum Up,
Size is not a shield. Every paid tax preparer, solo, seasonal, or small-firm, falls under the same federal obligation to maintain a written, signed, and current data security plan. The scope of the document should reflect the size of the practice, but the requirement itself does not shrink along with it.
Addressing this now, ahead of the next filing season, is considerably less costly than discovering the gap during a PTIN renewal review or after a security incident.
Frequently Asked Questions
I only prepare taxes part-time during the season. Does that change anything?
No. Seasonal or part-time status does not affect the requirement. If you hold a PTIN and prepare returns for compensation, the obligation applies for as long as you are actively practicing.
What if I use a large, well-known tax software platform, doesn’t that cover security for me?
Your software vendor’s security practices are one component of your overall risk picture, but they do not substitute for your firm’s own written plan. Vendor oversight is itself one of the required sections of a compliant WISP.
Can I write my own plan without hiring a consultant?
Yes, particularly for a straightforward solo practice with a simple technology environment. The key is making sure every required section is addressed honestly and specifically, rather than filled in with generic language that does not reflect how the practice actually operates.
FTC Safeguards Rule Penalties 2026: What It Costs CPA Firms Without a WISP
Most CPA firms understand, in general terms, that operating without a Written Information Security Plan is a compliance gap. Far fewer have sat down and calculated what that gap could actually cost if it is discovered during an FTC review, a state investigation, or the aftermath of a breach. The numbers are larger, and compound faster, than most practitioners expect.
This guide walks through the real financial exposure behind an FTC Safeguards Rule penalty, what a WISP fine actually looks like once penalties stack across violations and days, and the fuller picture of non-compliance cost CPA firms face when regulatory, insurance, and client-liability exposure are added together.
The Legal Basis for Enforcement
The FTC Safeguards Rule, codified at 16 C.F.R. Part 314, is the implementing regulation for the Gramm-Leach-Bliley Act’s requirement that financial institutions protect consumer financial information.
The rule’s 2023 amendments significantly expanded what a compliant information security program must include, a designated Qualified Individual, documented risk assessments, multi-factor authentication, encryption standards, vendor oversight, and a written incident response plan.
Tax preparers, CPA firms, and bookkeeping practices fall squarely within the GLBA’s broad definition of a “financial institution,” and the FTC has confirmed this application directly. Since the amended rule took full effect, FTC enforcement activity against financial service firms, including accounting and tax practices, has increased accordingly.
What a Violation Actually Costs?
Civil penalty amounts under the FTC Act are adjusted for inflation annually, and the ceiling has climbed steadily over the past several years.
Regulatory guidance and current federal penalty schedules place the maximum civil penalty in the tens of thousands of dollars per violation, with figures reported by compliance authorities running as high as $51,744 per day for an ongoing violation.
The critical detail that catches most firms off guard is not the per-violation figure in isolation, it is how violations are counted.
| Penalty Type | Approximate Exposure | Key Detail |
| Per violation | Tens of thousands of dollars | Each missing required element can count as a separate violation |
| Per day of non-compliance | Up to $51,744/day (2026) | Penalties compound daily until the violation is remediated |
| GLBA / state-level violations | $100,000+ per incident | State attorneys general can bring independent action |
| Client data-breach lawsuit | Effectively unlimited | Civil liability is separate from and additional to regulatory penalties |
A firm that is missing several required elements of its information security program simultaneously, no named Qualified Individual, no documented risk assessment, no MFA policy, is not looking at a single fine.
Each missing element can be treated as its own violation, and if the deficiency persists over time, the exposure compounds by the day rather than resetting with each new filing season.
Why “We Haven’t Had a Breach” Doesn’t Help?
One of the most consequential misunderstandings about FTC enforcement is the assumption that penalties only follow an actual data breach. They do not. The Safeguards Rule is a documentation and implementation requirement in its own right.
A firm can be found non-compliant, and penalized accordingly, simply by failing to maintain the required written program, independent of whether any client data was ever actually compromised.
This is precisely why IRS Publication 4557 and the FTC Safeguards Rule penalty are framed as ongoing obligations rather than reactive ones: the absence of a plan is itself the violation.
The Layers of Non-Compliance Cost
A useful way to think about the full financial picture is as a set of overlapping exposures that can all activate from a single compliance gap:
• IRS consequences. PTIN and EFIN suspension following a false W-12 certification, which halts a firm’s ability to e-file entirely.
• FTC civil penalties. Direct monetary penalties assessed per violation and, in ongoing cases, per day.
• State regulatory fines. Many states layer independent data security and breach-notification laws on top of federal requirements, with reported penalty ranges from roughly $5,000 to $750,000 depending on jurisdiction and the scale of an incident.
• Cyber insurance exposure. Carriers increasingly require a documented WISP as a condition of coverage; without one, a claim can be reduced or denied entirely at the moment a firm needs it most.
• Civil liability. Courts have consistently recognized that tax and accounting professionals owe clients a duty of care, and the absence of documented security policies removes a firm’s primary evidence that reasonable precautions were taken.
• Breach response costs. Independent of any of the above, IBM Security’s 2025 Cost of a Data Breach Report puts the average breach cost at $4.88 million, a figure that would close most independent practices outright.
A Realistic Scenario
Consider a five-person CPA firm that has never formalized a written security plan. An employee’s email is compromised through a phishing attack, and the intruder accesses several dozen client tax files before the activity is noticed.
At that point, the firm faces IRS breach notification obligations, potential FTC scrutiny into whether a Safeguards Rule-compliant program existed at the time of the incident, state notification requirements with their own timelines, a cyber insurance claim that may be challenged for lack of documented controls, and the very real possibility of client complaints or legal action.
Every one of these threads traces back to a single missing document that would have taken days, not months, to put in place.
Reducing Exposure Before It Becomes a Liability
The relationship between compliance investment and penalty exposure runs in a clear direction: firms that invest in a documented, implemented WISP simultaneously reduce their exposure to FTC enforcement, state penalties, insurance claim disputes, and client litigation, because all of these downstream risks trace back to the same underlying gap.
TechFiscal builds fully customized, audit-ready WISPs for CPA and tax firms in a few business days, mapped directly to IRS Publication 4557, the FTC Safeguards Rule, and GLBA requirements. Firms can review the complete scope of the service on TechFiscal’s WISP Compliance page.
How Do Enforcement Actions Typically Unfold?
Firms sometimes assume that FTC enforcement arrives without warning, but the process generally follows a recognizable pattern. An investigation is often triggered by a breach report, a consumer complaint, or a referral from another agency, such as a state attorney general’s office.
Once an inquiry opens, the FTC typically requests documentation of the firm’s information security program, the written risk assessment, evidence of MFA implementation, vendor contracts with security provisions, and records of employee training. Firms that can produce this documentation quickly and completely are in a fundamentally different position than firms that cannot produce it at all.
The absence of documentation does not just weaken a firm’s defense; in many cases, it is itself the basis for the finding of a violation, since the Safeguards Rule is a documentation-and-implementation standard rather than a purely outcomes-based one.
Penalties Are Only Part of the Picture
Regulatory fines tend to dominate the conversation because they carry specific dollar figures, but firms that have gone through an actual enforcement action or breach event consistently report that the indirect costs exceed the direct penalty.
Legal fees for responding to an FTC inquiry, forensic investigation costs to determine the scope of a breach, the staff hours diverted from client work during an investigation, and the reputational damage of client-facing breach notifications all add up alongside any formal fine.
For a small or mid-sized firm, the combination of these indirect costs with even a modest civil penalty can represent a meaningful percentage of annual revenue, a disruption most practices are not financially structured to absorb during a single filing season.
State Enforcement Adds an Independent Layer
Firms sometimes assume that federal compliance is the full picture, overlooking the fact that state attorneys general can bring independent enforcement actions under their own data security and breach-notification statutes.
California, New York, and Massachusetts are among the states with the most active enforcement postures and the most detailed statutory requirements, each carrying separate penalty structures that apply on top of, not instead of, federal exposure.
A firm operating across state lines, or serving clients who reside in a different state than the firm itself, may find itself subject to more than one state’s notification and penalty framework following a single incident, each with its own timeline, its own reporting threshold, and its own independent set of monetary consequences that stack on top of the federal exposure described above.
Wrapping Up,
The cost of Safeguards Rule non-compliance cost CPA rarely arrives as a single, predictable number, it compounds across multiple regulatory bodies, insurance exposure, and client liability simultaneously, and it can be triggered without a breach ever occurring.
Measured against that exposure, the investment required to put a current, signed, and properly implemented security plan in place is modest. The firms most at risk are not the ones actively weighing that trade-off, they are the ones who have not yet realized the exposure exists.
