Whip Your WISP Into Shape

In just a few minutes, a stolen laptop, an undetected phishing email, or compromised cloud storage credentials can expose hundreds of taxpayer records. With the October deadline in practitioners’ rearview mirror, now is the time to complete an annual data security review and update your tax practice’s written information security plan (WISP).

As part of a five-part series that focuses on tax professionals’ security, the campaign aims to provide timely tips to help protect sensitive taxpayer data and businesses from identity theft. IRS News Release IR-2026-92 reminds tax practitioners that they should review their data security plans annually.

• Designate at least one employee, known under the regulations as a “responsible official,” to coordinate the security plan
• Identify and assess risks involving taxpayer information
• Create, implement, regularly monitor, and test security safeguards
• Vet service providers and require contractual compliance

It is reported that 65% of financial service businesses were attacked by ransomware in 2024, and the 2025 Verizon Data Breach Report found that small businesses are four times more likely than their larger counterparts to be targets for a cyberattack.

Data Breaches Can Be Catastrophic

For practitioners, a data breach can threaten a business’s viability and damage a practitioner’s professional reputation. A breach destroys client trust and often leads to business loss because compromised data can circulate on the dark web for years, creating ongoing risk. When these factors combine, they can sometimes lead to a well-established firm closing and can negatively impact the practitioner’s reputation and future earnings.

WISP is a Requirement, Not a Suggestion

While WISP requirements arise under the Gramm-Leach-Bliley Act (GLBA) and the FTC Safeguards Rule, tax practitioners should also know that unauthorized disclosures of taxpayer information may result in separate penalties under §7216. Violations of this Code section can trigger penalties of up to $100,000 plus prosecution costs. A violation may also result in up to a year in prison. The law attaches severe penalties for improper disclosure of taxpayer information, providing a strong incentive to protect it from threats that could lead to its release. Not every cybersecurity breach creates a §7216 disclosure violation, but some may.

Tax practitioners should be alert to the federal government’s WISP requirements. IR-2026-92 states that a WISP should stress the following topics, as these are issues in almost all tax practices

• Employee management and training
• Information systems
• Detecting and managing system failures

It subsequently mentions the need for a data theft response plan. A data breach response plan is important because it’s best to think through a written plan before the unthinkable happens. This plan should state the need to report a data breach to the relevant IRS Stakeholder Liaison, including their email address and phone number.

Regular and Annual WISP Review Requirements

The WISP requires firms to designate an official to be the Data Security Coordinator (DSC). The DSC is the responsible individual for the firm’s data security policies and procedures. The DSC implements, supervises, and maintains the WISP. IRS Pub. 5708 outlines the following WISP responsibilities for a DSC.

• Implementing the WISP, including its daily operational protocols
• Identifying where the tax practice stores client data and ensuring that access to the data is restricted
• Verifying all employees have completed their recurring information security plan training
• Monitoring and testing employee compliance with the WISP’s policies and procedures
• Evaluating the ability of third-party service providers to comply with the WISP’s security protocols
• Requiring third-party service providers to implement and maintain their own security measures that comply with the WISP
• Reviewing the scope of the security measures in the WISP at least annually or whenever a material change in business operations affects the security or integrity of records containing personally identifiable information (PII)
• Conducting an annual training session for all owners, managers, employees, and independent contractors, including any temporary or contract employees who have access to PII

Key Elements to Review This Fall

Autumn is a great time for tax practitioners to complete their annual review. Changes in personnel, software, remote-work arrangements, and especially newly discovered cyber threats can make even the most thoughtful WISP obsolete within a year. As the year draws to a close, tax practitioners can review the following aspects of their WISPs.

• Verify that the list of security personnel is still valid
• Repeat employee cybersecurity training, especially the requirements for electronic and physical security of the tax practice
• Evaluate vendors in light of their security plans, particularly if they have access to taxpayers’ information
• Update the practice’s inventory of hardware and software
• Review policies for the protection of employees’ portable devices that can access taxpayer data
• Test incident-response procedures for handling a data breach
• Verify that all computers use password-protected screen savers or equivalent access controls
• Confirm contact information for IRS Stakeholder Liaison personnel and state tax personnel who must be notified

Sources

• Written Information Security Plans and Protecting Client Data (2023) | University of Illinois Tax School
• Cost of a Data Breach Report 2026 | IBM Security
• IRS, Security Summit Remind Tax Pros They Need a Written Information Security Plan to Protect Client Data | Internal Revenue Service
• Publication 5708: Creating a Written Information Security Plan for Your Tax & Accounting Practice | Internal Revenue Service
• Safeguards Rule | Federal Trade Commission
• Report a Data Breach | Federation of Tax Administrators
• Stakeholder Liaison Contacts | Internal Revenue Service
• The State of Ransomware in Financial Services 2024 | Sophos
• 2025 Data Breach Investigations Report | Verizon Business