What Is a WISP and Who Must Have One: A Guide for Tax Professionals

Consider a firm that has spent the morning renewing its principal’s PTIN for the upcoming filing season. The practitioner reaches the final screens and encounters a question about whether the business maintains a Written Information Security Program—a WISP, in the jargon—and realizes, with the slow certainty that accompanies last-minute compliance, that no such document exists in any drawer, drive, or shared folder. The renewal can proceed, but the absence has been noted, and the question will return.

The WISP is, in the most literal sense, a document: the security policy that the Federal Trade Commission’s Safeguards Rule requires businesses to keep if they handle customer financial information. For tax preparers, enrolled agents, CPA firms, and bookkeepers, this is not an abstract requirement. The FTC mandates it. The IRS, through the PTIN renewal process, asks about it directly. Yet the acronym tends to arrive without explanation, buried in checklists between EFIN verification and software updates, as though its meaning were already common knowledge.

What the WISP actually contains—risk assessment, access controls, incident response, employee training, vendor oversight—is a separate matter from what it is: a maintained, written program, not a one-time purchase or a checkbox exercise. The confusion is understandable. Most practitioners encounter the term as an item to clear rather than a standard to meet, and by the time its significance becomes apparent, the renewal deadline or a preparatory compliance review has already tightened the schedule.

What a WISP actually is

A Written Information Security Program is, at bottom, a document. It identifies what could go wrong with your clients’ financial information—laptop theft, phishing, unauthorized access to cloud storage, a rogue employee, a vendor breach—and states, in writing, what your firm does to prevent, detect, and respond to each risk. The FTC Safeguards Rule calls it a WISP. Everyone else in the tax profession calls it that too, though the acronym tends to arrive without explanation, like a form you are expected to have signed without being shown the text.

It is worth clarifying what a WISP is not. It is not a piece of software. It is not a cyber insurance policy. It is not a task you complete once and file away. A WISP is a living document, which means it must be reviewed and adjusted as your firm’s technology, personnel, and risks change. The FTC expects you to have written it, to mean it, and to follow it.

The Safeguards Rule requires a WISP of all “financial institutions”—a term the FTC defines broadly enough to sweep in tax preparers, enrolled agents, CPAs, and bookkeepers who handle consumer financial data. The IRS, for its part, asks on the PTIN renewal whether the practitioner has a data security plan, which is functionally the same question. A “no” is not a prudent answer.

The document itself can be produced in several ways. Some firms adopt templates from the IRS—Publications 4557 and 5708 provide starting points—or from professional associations such as NATP or AICPA. Others hire an MSP to draft something bespoke. Still others purchase templates from specialized providers such as Tech 4 Accountants or Rush Tech Support. Each approach has its trade-offs in specificity, maintenance burden, and the degree to which the resulting document reflects the actual operations of the firm that adopts it.

The essential point is that a WISP exists on paper, governs practice in reality, and is subject to inspection by regulators who have grown less inclined to accept vague assurances in place of written specifics.

How a WISP tool solves the compliance problem

Most tax practitioners did not enter the profession to write information-security policy. The FTC Safeguards Rule requires a Written Information Security Program that addresses risk assessment, access controls, data encryption, incident response, and several other domains—each of which demands fluency in a vocabulary more commonly found in a CISO’s office than in a tax preparation suite. Drafting such a document from scratch is, for the typical sole practitioner or small firm, a project of uncertain scope and considerable opportunity cost.

A template or specialized service supplies the architecture. Products such as those from Tech 4 Accountants, Rush Tech Support, the IRS Publication 4557 and 5708 templates, or association offerings from NATP and AICPA provide pre-structured frameworks that map the Rule’s requirements to document sections. EEZY WISP operates in this same category: a written program that organizes the required elements into a coherent policy document. The practical benefit is coverage. A practitioner working without guidance might omit the incident-response plan or understate the vendor-management provisions; a purpose-built template prompts for these explicitly. The resulting document can be produced during a regulatory inquiry or shown to a client who asks, appropriately, how their data is protected.

The limitations deserve equal emphasis. A WISP, however well constructed, does not implement the safeguards it describes. It does not encrypt your hard drives, train your staff, or prevent a phishing breach. The Rule’s requirements for employee training, vendor due diligence, and periodic risk assessment remain the practitioner’s operational responsibility. The document is a map, not the territory. Consider a firm that purchases a thorough template, files it with its other compliance records, and proceeds as before: it has a WISP, but it does not have compliance. The practitioner must still execute what the document prescribes—update it after a systems change, follow the incident-response protocol when indicated, and maintain the administrative practices the Rule demands. The tool reduces the friction of documentation; it does not dissolve the obligation of implementation.

What EEZY WISP provides

EEZY WISP is a Written Information Security Program—the security policy document a business is required to keep, written and maintained. It is not a consultation, a network scan, or a binder that sits on a shelf until someone asks to see it. The product is the document itself, produced to satisfy the FTC Safeguards Rule and the IRS question on PTIN renewal that asks whether you have one.

The alternatives are not difficult to locate. Tech 4 Accountants and Rush Tech Support both offer WISP templates. The IRS publishes Publications 4557 and 5708, which include template language a practitioner might adapt. NATP and AICPA make templates available to members. Many firms receive a policy written by their managed service provider, sometimes thorough, sometimes a generic printout with their letterhead swapped in. Each of these approaches has its adherents. The MSP route, in particular, can be adequate if your provider understands tax practice; it can also be a photocopied afterthought billed as “compliance included.”

EEZY WISP occupies a narrower position: a purpose-built document, maintained as a product rather than a favor or a membership perk. Pricing is on the site. The infrastructure is hosted on Microsoft Azure. Support hours are Monday through Friday, 9 AM to 8 PM, and Saturday through Sunday, 9 AM to 12 PM Eastern, as published at eezycloud.com/support.

For firms that use other EEZY products, the account structure follows the EEZYVERSE model: one login across the EEZY products a company uses, with one central bill at eezycloud.com/account/. Each product is also sold on its own site, so a WISP purchased in isolation does not require committing to a broader platform.

The value proposition, such as it is, rests on specificity. A WISP from a generalist template library may require substantial editing to reflect a tax practice’s actual data flows, employee count, and software stack. One from an MSP may reflect what the MSP thinks you do. EEZY WISP is designed for the vertical it serves, which is a different thing from claiming it is the only reasonable choice. For some firms, the IRS template and a quiet afternoon with a red pen will suffice. For others, the cost of getting it wrong—an FTC inquiry, a preparer penalty, or simply the sleeplessness of knowing the document in the drawer would not survive scrutiny—outweighs the cost of having it done competently by someone who does this particular document repeatedly.

What it costs

EEZY WISP publishes its pricing at eezywisp.com. That is the extent of what may be stated here with certainty; the site will disclose whether the product is priced as a one-time purchase, an annual subscription, or some other arrangement. The same principle applies to every alternative worth considering. Tech 4 Accountants and Rush Tech Support both offer WISP templates; their pricing, too, resides on their respective sites. The IRS furnishes Publications 4557 and 5708 without charge, though the word “free” demands qualification: these templates require substantial adaptation, legal review, and ongoing maintenance, the cost of which is measured in hours rather than dollars. NATP and AICPA members may access templates through their associations; non-members face membership fees or separate purchase prices, again discoverable through direct inquiry. An MSP-written policy arrives with whatever that particular provider charges for professional services, a figure that varies by geography, firm size, and the MSP’s own pricing philosophy.

The broader calculation extends beyond the document itself. Consider a firm that selects the IRS template, spends six hours customizing it, another four consulting with counsel, and thereafter dedicates annual hours to revision. The arithmetic becomes personal and particular. Consider another firm that purchases a template from Rush Tech Support or Tech 4 Accountants and discovers the fit is imperfect, requiring supplemental work. Consider a third firm that engages an MSP and receives a thorough policy at professional-services rates, then faces the question of who maintains it when personnel change or regulations shift.

EEZY WISP’s pricing is on the site. Its structure belongs to the EEZYVERSE: one login across EEZY products a company uses, one central bill at eezycloud.com/account/. Support hours are published at eezycloud.com/support: Monday through Friday, 9 AM to 8 PM; Saturday and Sunday, 9 AM to 12 PM Eastern. The sites run on Microsoft Azure. These are fixed points in an otherwise variable marketplace. The prudent practitioner compares total cost of ownership, not merely the price at checkout, and recognizes that the cheapest initial outlay may not be the least expensive path to sustained compliance.

Getting started and the first week

Consider a firm that purchases EEZY WISP. The login arrives through the EEZYVERSE portal—the same credential they would use for other EEZY products, with billing centralized at eezycloud.com/account/. The document opens as a structured template, not a blank page. They see sections for risk assessment, access controls, incident response, and the other components the FTC Safeguards Rule enumerates. The first task is reading it through, which takes less time than one might expect from a regulatory document, though the subject matter rewards attention.

Customization follows. A sole practitioner operating from a home office will have different access protocols and vendor relationships than a four-partner firm with a downtown lease and three remote bookkeepers. The template accommodates both without pretending they face identical risks. The practitioner marks which sections apply, adjusts the inventory of information systems, and names the individual responsible for program oversight—a requirement that sounds ceremonial until one realizes it has real consequences for liability and for answering IRS inquiries during PTIN renewal.

The first week typically surfaces friction between policy and practice. Perhaps the firm discovers its backup schedule exists only in the head of a part-time IT contractor, or that “encryption” has meant the password on a spreadsheet. These gaps are the point of the exercise, not a failure of the template. The WISP from Tech 4 Accountants or Rush Tech Support would surface similar discrepancies; the IRS Publication 4557 template would too, though with more of the drafting burden on the practitioner. An MSP-written policy might arrive with less need for initial customization and a correspondingly higher invoice.

By week’s end, the firm has a dated document, an assigned compliance lead, and a calendar entry for the periodic review the Safeguards Rule mandates. The document is not finished—it is maintained. Support is available Monday through Friday, 9 AM to 8 PM Eastern, and Saturday through Sunday, 9 AM to 12 PM Eastern, should questions of interpretation arise.

The honest alternatives

Practitioners have several legitimate paths to a compliant WISP, and the choice depends largely on how much legwork you are prepared to do yourself.

The federal government offers free templates through IRS Publication 4557 and Form 5708. These documents are authoritative, cost nothing, and will satisfy a regulator who checks the box. What they do not offer is hand-holding. You must still conduct your own risk assessment, adapt the language to your firm’s actual systems and vendors, and maintain the document as those systems change. For a solo practitioner with modest technical infrastructure, this is genuinely workable. For a growing firm with multiple locations, cloud applications, and remote staff, the self-assessment burden grows quickly.

Industry associations provide another route. NATP and AICPA both offer WISP templates to members. These tend to reflect the specific concerns of tax and accounting professionals more precisely than government documents, and they arrive with the implicit endorsement of peers. The same caveat applies: the template is a starting point, not a finished program.

Specialized vendors have entered this space with more tailored offerings. Tech 4 Accountants and Rush Tech Support both provide WISP templates designed for tax preparers. These typically require less adaptation than government or association documents, though the degree of ongoing support and integration with other compliance tools varies. Neither publishes pricing in the materials reviewed for this article; interested firms should consult their respective sites.

Some practitioners engage their managed service provider to draft a policy, or hire a compliance attorney to build one from scratch. An MSP-written policy has the advantage of reflecting your actual network configuration; a compliance attorney’s work may hold more weight in a dispute. Both paths cost more in time or fees, and neither guarantees the document will be maintained without additional engagement.

A minority of practitioners simply draft their own. This is not reckless if you understand the Safeguards Rule’s requirements and your own environment. It is, however, a defensible choice only for those who can honestly assess whether their expertise matches the task.

How it fits with your firm’s stack and the EEZYVERSE

EEZY WISP is one product in the EEZYVERSE family. The arrangement is straightforward: one login across whatever EEZY products a company uses, one central bill at eezycloud.com/account/, and each product also available on its own site. For a small tax or accounting firm already managing a patchwork of practice management software, tax prep platforms, and cloud storage, this is less about technological integration than about administrative sanity.

The WISP itself does not replace your existing security stack. It documents it. Your firewall, your multi-factor authentication, your encrypted backup regimen—whatever measures you have in place—find their formal articulation in the document the FTC requires you to maintain. EEZY WISP sits alongside these tools rather than supplanting them, much as the WISP templates offered by Tech 4 Accountants, Rush Tech Support, or the IRS itself serve the same documentary function without touching your actual infrastructure.

The practical benefit of the EEZYVERSE model, such as it is, accrues to the person in your office who handles vendor relationships. One fewer login to misplace, one bill to reconcile, one set of support hours to remember: Monday through Friday 9 AM to 8 PM, Saturday and Sunday 9 AM to 12 PM Eastern, as published at eezycloud.com/support. Sites run on Microsoft Azure, which is neither distinctive nor disqualifying.

Consider a firm that already uses an EEZY product for another purpose—document management, say, or time tracking. Adding the WISP through the same portal requires no new procurement process, no fresh vendor security review, no additional point of contact when something goes wrong. This is not transformative. It is merely one less friction point in a profession where friction points accumulate faster than billable hours.

The alternatives remain viable. An MSP can draft your policy. NATP and AICPA offer templates. IRS Publications 4557 and 5708 provide free starting points. EEZY WISP’s case rests on the modest proposition that a compliance document need not arrive through a separate vendor relationship, with its attendant invoices and support queues, when it could simply appear in an account you already maintain.