The CPA Firm Cybersecurity & IRS WISP Compliance Guide

• The IRS requires every tax preparer and CPA firm to maintain a Written Information Security Plan (WISP). This is not optional, and firm size does not exempt you.
• The FTC Safeguards Rule, which applies to tax preparers as “financial institutions,” requires a documented risk assessment, designated security coordinator, and specific technical controls.
• Most small CPA firms have gaps in three areas: multi-factor authentication enforcement, third-party vendor vetting, and incident response documentation.
• Meeting compliance is concrete. The IRS published a WISP template in 2022 specifically for sole proprietors and small firms, and the core controls are achievable without an enterprise IT budget.
• Cloud hosting and managed IT providers built for accounting firms handle most of these requirements by default. Knowing which ones to consider is half the battle.

The IRS requires all tax preparers, including solo CPAs and small firms, to maintain a Written Information Security Plan under Internal Revenue Code Section 7216 and the Gramm-Leach-Bliley Act. CPA firm cybersecurity is not a best practice, it is a regulatory obligation. The FTC Safeguards Rule independently mandates a risk assessment, an information security coordinator, and documented technical controls. Non-compliance exposes firms to IRS sanctions, FTC enforcement actions, and state-level penalties. Both requirements apply regardless of firm size.

---

Why Small CPA Firms Are the Primary Target, Not an Afterthought

Solo practitioners and firms with under ten staff hold the same category of data as a regional bank: Social Security numbers, income records, business financials, and in many cases, payroll data for dozens of employer clients. A breach at a 300-client solo practice is just as profitable for an attacker as a breach at a larger firm, and significantly easier to execute.

The IRS’s own Security Summit has documented a consistent pattern: tax professionals are one of the most targeted groups for identity theft-related phishing, precisely because compromising a single preparer’s credentials can yield hundreds of fraudulent returns. Credential theft, ransomware, and business email compromise are the three attack types that account for the overwhelming majority of incidents at accounting firms.

The belief that cybersecurity is an enterprise problem comes partly from how the topic gets covered. Headlines feature breaches at Fortune 500 companies. But the enforcement actions from the IRS and FTC increasingly target smaller preparers, because they handle the same sensitive data with far fewer controls.

---

What Does the IRS Actually Require for a WISP?

The IRS requirement for a Written Information Security Plan stems from the FTC Safeguards Rule, which classifies tax preparers as financial institutions under the Gramm-Leach-Bliley Act. In 2022, the IRS Security Summit published a WISP template specifically for tax professionals, including sole proprietors. This template is the clearest public signal of what the IRS expects to see.

A compliant WISP must address five core areas:

1. Designated Security Coordinator: Someone in the firm must be named as responsible for the information security program. At a solo practice, this is the owner. At a multi-partner firm, it should be a named partner or senior staff member, not “IT.”
2. Risk Assessment: A documented evaluation of where client data lives, who can access it, and what threats exist. This must be written, not just performed mentally, and reviewed regularly.
3. Information Safeguards: Technical controls that address the risks identified. This includes encryption, access controls, multi-factor authentication, and firewall configuration.
4. Third-Party Oversight: Any vendor with access to client data must be covered by a written contract that requires them to maintain appropriate safeguards. This includes your cloud hosting provider, your practice management software vendor, and any outsourced IT support.
5. Incident Response Plan: A written procedure for what happens when a breach occurs, including who gets notified, how clients are informed, and how the IRS is contacted through the appropriate channels.

The IRS template runs to several pages and includes fillable sections for each requirement. It is not a light read, but it is specific. If your WISP cannot map to each of these five areas, it is incomplete.

---

How Does the FTC Safeguards Rule Apply to Tax Preparers?

The FTC Safeguards Rule, updated in 2023, expanded its requirements significantly. It now requires firms with 5,000 or more customer records to implement additional controls: encryption of customer data at rest and in transit, multi-factor authentication for anyone accessing customer financial data, penetration testing and vulnerability assessments on a defined schedule, and an annual written risk assessment signed off by a qualified individual.

Firms below the 5,000-record threshold still must comply with the core Safeguards Rule requirements, including a written security plan and designated coordinator. A firm with 200 active clients that also manages payroll for each client’s 15 employees can cross the 5,000-record threshold faster than the partners realize.

The FTC’s enforcement posture shifted after the 2023 rule update. Prior guidance emphasized good-faith efforts. Current guidance emphasizes documented, verifiable controls. “We have a firewall” is not a compliance statement. “We run quarterly vulnerability scans, documented in these reports” is.

---

The Found On AI WISP Gap Audit

After reviewing IRS guidance, FTC enforcement patterns, and common audit findings across accounting practices, three failure points appear repeatedly. The Found On AI WISP Gap Audit is a structured diagnostic framework for identifying where a firm’s written plan diverges from its actual security posture. It exists because the gap between having a WISP document and running a real information security program is where most enforcement exposure lives. These are the three checks that separate firms with a functioning program from firms with a PDF that no one reads.

Gap 1: MFA Is Configured But Not Enforced

Multi-factor authentication is configured on the firm’s email platform, but it is set to optional rather than required. One staff member has not enrolled. That one account is the breach. MFA must be mandatory for every user who can access client data, including temporary staff and contractors. No exceptions.

Gap 2: Vendor Agreements Do Not Address Data Security

Most small firms have signed vendor agreements for their tax software, document storage, and client portal without ever negotiating or reviewing the data security provisions. A compliant WISP requires you to identify every vendor who touches client data and confirm, in writing, that they maintain appropriate safeguards. If your agreement does not include a security provision, you need an addendum or a different vendor.

This applies directly to cloud hosting providers for tax software. Firms using hosted environments for Drake, UltraTax, or Lacerte should confirm their provider’s security certifications before assuming the WISP box is checked. Our review of QuickBooks hosting providers for accounting firms covers what to look for in vendor security documentation, and the same criteria apply to any hosted tax application.

Gap 3: The Incident Response Plan Is Theoretical

Many WISPs include a section that says “In the event of a breach, we will notify affected clients and the IRS.” That is not a plan. A real incident response plan names who makes the call that a breach has occurred, specifies the timeline for client notification (most states require 30-72 hours), identifies the IRS Stakeholder Liaison contact number, and documents how the firm will preserve evidence. The IRS expects preparers to report identity theft-related data breaches through their local Stakeholder Liaison. That contact information needs to be in the document, not Googled during an incident.

---

What Technical Controls Does a CPA Firm Actually Need?

The IRS and FTC do not prescribe specific software products. They require controls that achieve specific outcomes. Here is what those outcomes map to in practical terms for a firm of one to twenty people.

Required Outcome	Practical Control	Priority
Authenticated access to client data	MFA on all accounts (email, cloud storage, tax software, client portal)	Immediate
Encrypted data in transit	TLS/SSL on all web-based tools; VPN for remote access	Immediate
Encrypted data at rest	Disk encryption on all workstations (BitLocker or FileVault); encrypted cloud storage	Immediate
Controlled access to client records	Role-based permissions in practice management software; no shared logins	High
Protection against malware and ransomware	Endpoint detection and response (EDR) on all devices, including personal devices used for work	High
Secure client file exchange	Encrypted client portal; no unencrypted email for tax documents	High
Patch management	Automatic OS and software updates; documented patch schedule	Medium
Backup and recovery	Automated daily backups; off-site or cloud backup with documented restoration test	Medium
Vulnerability identification	Annual vulnerability scan; quarterly for firms over 5,000 records	Medium
Staff security awareness	Annual phishing simulation and security training, documented with completion records	Medium

The client portal requirement deserves emphasis. Sending tax documents via standard email, even with a password, does not meet the FTC’s encryption requirements. A dedicated encrypted client portal is the baseline. Our comparison of client portal tools built specifically for accounting and tax firms covers the security architecture differences between the major options, including which platforms provide the contractual data security language your WISP’s vendor oversight section requires.

---

How Should a Small CPA Firm Actually Build Its WISP?

Start with the IRS’s published template. Download it, work through every fillable section with your designated security coordinator, and do not leave any section blank because it feels complicated. A blank section in an IRS audit is worse than an imperfect answer.

The risk assessment section trips up most small firms because it requires a systematic inventory of where client data lives. Work through it in order:

1. List every place client data is stored: local servers, laptops, cloud drives, email archives, USB drives, practice management software, tax software, and client portals.
2. For each location, document who has access and under what conditions.
3. Identify the most plausible threats for each location: phishing for email, ransomware for local servers, credential theft for cloud applications.
4. Rate the risk and document the current control that addresses it, or note that no control exists yet.

This inventory often surfaces surprises. Many firms discover that an employee’s personal Google Drive contains client documents that were shared years ago and never removed. That is a data exposure event waiting to happen, and the risk assessment is how you find it before the IRS does.

Once the WISP is drafted, have it reviewed annually and any time a significant change occurs: a new software platform, a new staff member with data access, or a vendor relationship change. Document the review with a date and the name of whoever conducted it.

Firms evaluating practice management platforms should confirm whether their software vendor’s agreement satisfies the third-party oversight requirement. A detailed breakdown of accounting practice management software tools for CPA firms includes how the major platforms handle data security and what their vendor agreements typically cover, directly relevant to WISP documentation.

---

What Are the Penalties for Not Having a WISP?

The IRS does not publish a flat penalty figure for WISP non-compliance in isolation, because enforcement typically occurs alongside a broader audit or incident investigation. What is documented: the FTC can impose civil penalties for Safeguards Rule violations, and the IRS can revoke a preparer’s PTIN and refer cases for criminal prosecution under IRC Section 7216 for improper disclosure of taxpayer information resulting from inadequate security practices.

State-level penalties are often more immediate. Most states have data breach notification laws with penalties for failure to notify, and several states have enacted their own information security requirements for financial service providers that are stricter than the federal baseline. A breach without a documented incident response plan means you cannot demonstrate good-faith compliance, which is the primary mitigating factor in regulatory enforcement.

The practical risk for most small firms is not a six-figure FTC fine on the first violation. It is a client breach that triggers state attorney general investigation, client lawsuits, and reputational damage that costs far more than the compliance program would have.

---

Who Handles WISP Implementation for Firms Without In-House IT?

Two categories of providers cover this for small accounting firms: managed IT service providers with accounting-specific experience, and cloud hosting providers that host tax and accounting software in SOC 2-certified environments.

A managed service provider (MSP) focused on accounting firms will typically handle endpoint management, patch cycles, backup configuration, and security awareness training. They can also assist with the technical sections of your WISP and provide the documentation you need for vendor oversight compliance. The key qualifier is accounting-specific experience. A general MSP may not understand IRS e-file security requirements or the data handling implications of specific tax software.

Cloud hosting providers address a different piece: the risk associated with running tax and practice software on local hardware. Moving Drake Tax or Lacerte to a hosted environment operated by a SOC 2 Type II certified provider transfers significant infrastructure risk and simplifies several WISP sections. Our roundup of Drake Tax software hosting providers covers the security certifications and compliance documentation that the leading providers offer, including which providers supply the audit-ready SOC 2 reports your WISP vendor oversight section needs.

Neither option replaces the firm’s obligation to have a written plan. The WISP must document the relationship with these vendors, confirm their security credentials, and establish what happens if they experience a breach. A SOC 2 report from your hosting provider is not your WISP. It is evidence that supports one section of your WISP.

Firms evaluating their full technology stack alongside compliance requirements may also find value in reviewing AI tools built for accountants and CPA firms, particularly for understanding how newer AI-assisted platforms handle data residency and access controls, both of which have direct WISP implications.

---

Frequently Asked Questions

Is a WISP mandatory for all tax preparers, including solo practitioners?

Yes. The IRS and FTC Safeguards Rule require every tax preparer who handles federal tax returns to maintain a Written Information Security Plan. There is no size exemption. A solo practitioner with five clients and a sole proprietor with 500 clients face the same requirement. The IRS published a simplified WISP template in 2022 specifically to help small and solo practices comply without enterprise-level resources.

What is the difference between the IRS WISP requirement and the FTC Safeguards Rule?

The FTC Safeguards Rule is the underlying federal regulation. It classifies tax preparers as financial institutions under the Gramm-Leach-Bliley Act and requires an information security program. The IRS enforces compliance with this rule as part of its oversight of tax professionals. Both agencies can take action. The IRS focuses on preparer sanctions and PTIN revocation. The FTC focuses on civil monetary penalties for businesses that fail to protect consumer financial data.

How often does a WISP need to be updated?

The IRS guidance requires annual review at minimum. The WISP must also be updated any time a material change occurs in the firm’s operations, technology, or personnel. Adding a new cloud software platform, hiring a staff member who will access client files, changing your hosting provider, or experiencing a security incident all trigger a required review. Document every review with a date and the name of the reviewer.

Does using cloud-hosted tax software satisfy the WISP requirements?

Partially. A SOC 2 Type II certified cloud hosting provider addresses infrastructure security, encryption, and physical access controls. These satisfy several WISP sections. The firm still must document the vendor relationship, obtain and retain the provider’s security attestation, maintain its own access controls, train staff on phishing and security practices, and maintain an incident response plan. The WISP must cover the whole environment, not just the hosting layer.

What should a WISP incident response plan actually include?

At minimum: a named decision-maker who determines whether a breach has occurred, the criteria for that determination, a timeline for notifying affected clients that meets applicable state law (typically 30-72 hours), the IRS Stakeholder Liaison contact information for reporting identity theft-related breaches, steps for preserving evidence, and a process for reviewing and updating the WISP following the incident. Store this information somewhere other than the compromised system. A printed copy in a locked drawer is not a bad idea.

Can a CPA firm use a template for its WISP or does it need to be custom?

A template is an appropriate starting point. The IRS’s own Publication 5708 is a template. The requirement is that the completed WISP accurately reflects the firm’s actual practices, data inventory, and controls. A template filled in with real firm-specific information is compliant. A template left with placeholder text or generic descriptions that do not match the firm’s actual environment is not. An IRS examiner comparing your WISP to your actual systems will notice the discrepancy.

---

The Actual Work Required Is Smaller Than Most Firms Assume

Most CPA firms are closer to WISP compliance than they realize. If you have MFA active on your email, use an encrypted client portal, back up your data, and have not shared login credentials across staff, you have the skeleton of a compliant program. What is usually missing is documentation: a written risk assessment, named personnel, and a written incident response procedure. Those are hours of work, not months.

The harder part is keeping it current. A WISP written in 2022 that has never been reviewed is not a compliant program. It is a document. The program is the annual review cycle, the vendor agreement audit, the staff training records, and the patch management log. Those are operational habits, not one-time projects.

The firms that handle this well treat the WISP as infrastructure, the same way they treat their engagement letter templates or their quality control procedures. It exists, it is reviewed, it is updated, and it is stored somewhere accessible. That posture, consistently maintained, is what protects the firm from regulatory exposure and from the much larger operational cost of an actual breach.