IRS WISP/Pub 4557

Paid tax preparers are treated as financial institutions under the Gramm-Leach-Bliley Act, so the FTC Safeguards Rule (16 CFR Part 314) requires them to keep a written information security plan, commonly called a WISP.

IRS Publication 4557, Safeguarding Taxpayer Data, is the IRS guide that translates that rule for tax professionals, and IRS Publication 5708 is a fill-in template for the plan itself. The IRS reinforces the requirement through the annual PTIN application and renewal.

Line 11 of Form W-12 (Rev. October 2025) asks preparers to acknowledge that paid tax return preparers "are required by law to create and maintain a written information security plan"; it is an acknowledgment of awareness, not a certification that a plan exists.

The written program must name a Qualified Individual responsible for it, rest on a risk assessment, describe the administrative, technical, and physical safeguards in place, cover oversight of service providers and staff training, and include an incident response plan.

Firms holding information on fewer than 5,000 consumers are exempt from the written risk assessment, the written incident response plan and the annual written report (16 CFR 314.6). Publication 5708's template recommends reviewing the plan at least annually.

A preparer who suffers a data theft is also expected to contact the IRS Stakeholder Liaison and, for Safeguards Rule purposes, notify the FTC as soon as possible, and no later than 30 days after discovery, of a notification event involving at least 500 consumers (16 CFR 314.4(j), in effect since May 13, 2024).