What Is a WISP and Who Is Required to Have One?

Consider a firm that has just received a letter from the IRS. Not an audit of a return — a request to see the firm’s Written Information Security Program. The owner knows such a document exists, or at least existed at some point, because someone drafted one years ago. What she cannot say, with any confidence, is where it is. It may be in a folder on a server that was replaced in 2023. It may be in the email account of a bookkeeper who left in 2024. It may simply be gone.

This is more common than anyone in the profession likes to admit. The FTC Safeguards Rule requires tax preparers, enrolled agents, CPA firms, and bookkeepers who handle client financial data to maintain a WISP — a written, current, accessible document that describes how the firm protects nonpublic personal information. The IRS, for its part, asks about it on the PTIN renewal. Both regulators expect the same thing: a document that exists on paper, in a known location, that can be produced on request. Not a policy that was described in a staff meeting. Not a set of security practices that everyone more or less follows. A document.

The distinction matters because the absence of one is difficult to explain after the fact. A firm that has been encrypting its files, using multi-factor authentication, and training its staff on phishing has done the substantive work — but without the written program, it has no way to demonstrate that work to anyone who asks. Regulators do not grade intentions. They ask to see the policy, and the conversation goes considerably better when the answer is a drawer that opens.

The document the PTIN renewal keeps asking about

Every year, somewhere between the continuing-education credits and the fee payment, the PTIN renewal presents a checkbox that gives people pause: Written Information Security Program. The wording is unhurried. It does not explain what a WISP is, where one might obtain such a thing, or what happens to the preparer who checks the box on faith. It simply expects the document to exist, and expects you to know that.

The expectation is not baseless. The IRS requires tax professionals to maintain a written information security plan as a condition of holding a PTIN, and the Federal Trade Commission’s Safeguards Rule obliges tax preparers — along with CPAs, enrolled agents, and bookkeepers who handle client financial data — to keep a written security program of their own. Two agencies, one document. The WISP is that document: a written record of how your firm protects client information, who is responsible for it, and what you do when something goes wrong. It is a policy, not a product. Not software, not insurance, not a certificate to frame. The paper itself, kept current, available on request.

The consequences of not having one are real, though the renewal screen is too polite to say so. The IRS can suspend or revoke a PTIN over a deficient security plan, and the FTC can pursue enforcement against firms that fail to maintain adequate safeguards. Neither agency needs to find a breach to find a problem; the missing document is the problem.

None of this requires panic, but it does require a document you can locate. Some firms write their own from IRS Publication 4557 and the accompanying templates, or adapt materials from professional associations such as NATP or the AICPA. Others purchase a prepared template from a specialist vendor. The distinction matters less than the drawer: whatever you choose, you should be able to open it and put your hands on the thing — because the renewal assumes you already have.

What a WISP is, and what it is not

A Written Information Security Program is a document. That sounds almost too plain to state, but the plainness matters, because much of the confusion around the requirement comes from treating it as something other than what it is.

The document does three things. It identifies the customer financial information your firm holds — tax returns, bank details, Social Security numbers, the quiet accumulation of a filing season. It describes the risks that information faces: a stolen laptop, a phished password, a former employee whose access was never revoked. And it sets out what you do about those risks — who is responsible, which safeguards you have in place, how you will respond when something goes wrong. The FTC’s Safeguards Rule expects this program to be written, and it expects the writing to be maintained as your practice changes. A policy written for a two-person firm in 2019 says little about the firm that firm became.

What a WISP is not: it is not software. Nothing runs in the background because a document exists. It is not a contract with a client, though clients may ask to see it. It is not a certificate, and no one hands you one for having written it.

It is also worth being honest about what the document accomplishes on its own. A WISP organizes your obligations and demonstrates that you considered them seriously. It does not, by itself, encrypt a single file or block a single login. The thinking and the doing are related but distinct, and a drawer full of unimplemented policy is its own kind of exposure.

The Safeguards Rule’s insistence on a written, maintained program is why the dusty PDF ages poorly. A trade-association template — the IRS offers Publication 4557 and Publication 5708, and NATP and AICPA members receive their own versions — provides a starting structure. But a template filled in once and forgotten does not reflect the firm you actually run, and the gap between the two is where examiners tend to look.

Who is actually required to have one

The FTC Safeguards Rule was written for “financial institutions,” a phrase that conjures banks and brokerages. The FTC reads it more generously. If your firm handles client financial data — tax returns, bank statements, payroll records, Social Security numbers — you are likely inside the definition, regardless of what your business card says. The rule does not care whether you work from a suite of offices or a spare bedroom.

Consider a firm that is, in every practical sense, three people and a filing cabinet. The Safeguards Rule applies to that firm with the same force it applies to a national accounting network. There is no small-business carve-out, no headcount threshold below which the obligation dissolves. “We are only three people” is a reasonable thing to say at a dinner party. It is not an exemption the rule recognizes.

The IRS adds its own layer. When you renew your PTIN, the IRS asks whether you have a written information security plan in place. This is not a rhetorical question. Publication 4557 lays out the Security Six and the broader expectations, and the PTIN renewal process puts the WISP question directly in front of you, each year, with a checkbox.

So the population of firms that need one is broad: tax preparers, enrolled agents, CPA firms, bookkeepers, and any small business that touches client financial information as part of its work. If you collect a client’s W-2, you are in.

The document itself can come from several places. Some firms adopt the templates in IRS Publications 4557 and 5708. Others use WISP templates from Tech 4 Accountants or Rush Tech Support, or templates offered through NATP or AICPA membership. Some ask their IT provider to draft one. The source matters less than the result: a written program, kept current, that you can produce when asked. The IRS and the FTC are not grading your prose. They want to see that the document exists, that it reflects your actual practice, and that you can find it.

Where firms usually get one, and the trade-offs

A firm that needs a WISP has four realistic routes, and each carries a different set of obligations.

The first is the do-it-yourself path. IRS Publications 4557 and 5708 contain template material a firm can adapt, and both are free. The catch is that a template is a starting point, not a finished program. Someone inside the firm has to read it, fill in the firm’s actual practices, and keep it current as those practices change. That someone is usually the person who already has the most to do.

The second route runs through professional associations. NATP and the AICPA offer WISP templates to their members. These tend to be better tailored to tax and accounting work than the IRS versions, and the price of admission is membership rather than a separate purchase. The same caveat applies: the template still needs to reflect what your firm actually does, and nobody from the association will check whether it does.

The third route is a vendor template. Tech 4 Accountants and Rush Tech Support both sell WISP templates aimed squarely at the same reader as this article. These are built for the requirement rather than adapted from general guidance, which saves time. Pricing is on their respective sites. What a purchased template generally does not do is maintain itself; the annual review and update remain the firm’s job.

The fourth route is an MSP. Some managed service providers will draft a WISP as part of a broader engagement — the security policy arrives bundled with the monitoring, the backup, and the monthly invoice. This can work well, though the document sometimes reflects what the MSP’s tools do rather than what the firm does, and a policy written to justify a contract is not quite the same thing as a program written for the rule.

EEZY WISP occupies the fourth chair at this table: a maintained document, written and kept current for the requirement itself. The distinction matters less on day one than it does in year three, when the review comes due and the drawer has to open.

What EEZY WISP is, stated plainly

EEZY WISP is a Written Information Security Program. That is the document itself — the security policy a business is required to keep, written and maintained. It is not software that scans your network, and it is not a service that manages your firewalls. It is the policy document, the one the FTC Safeguards Rule expects you to have written down and the IRS asks about when you renew your PTIN.

This puts it in a recognizable category. The same category includes the WISP templates sold by Tech 4 Accountants and Rush Tech Support, the templates the IRS publishes in Publications 4557 and 5708, and the templates that NATP and AICPA make available to their members. A firm with a capable MSP may also have had that MSP write a policy. These are all real ways to arrive at a written program, and a reasonable person could choose any of them.

EEZY WISP exists for the tax preparer, enrolled agent, CPA firm, or bookkeeper who wants the document itself handled — written and maintained — without having to assemble it from a template or delegate it to a vendor whose main business is something else. Pricing is on the site at eezywisp.com.

EEZY WISP is also part of the EEZYVERSE family, so if your firm uses other EEZY products, you carry one login and one central bill. That is context, not a reason to buy. The reason to buy, if there is one, is simpler: you need a WISP, and this is a WISP.

The first week with a written program

Consider a firm that has just signed up for EEZY WISP, or downloaded the IRS Publication 4557 template, or taken delivery of a policy from its MSP. The document arrives. It is longer than expected. The sensible first move is to print it, read it once without editing anything, and then read it a second time with a pencil, marking every sentence that does not match the office as it actually runs.

The gaps announce themselves quickly. The policy says passwords are changed every ninety days; the office has not changed a password since the software vendor forced one. The policy assigns security oversight to a named employee who left in March. The policy requires encryption on laptops; one laptop predates the policy and nobody has checked. None of this is unusual. It is, in fact, the normal condition of a small firm that has had a WISP for years without opening it.

The first week is for closing the obvious ones. Name a current employee as the responsible party. Turn on the password manager. Confirm the backups run and, more important, that a restore has been tested. Write down where client data lives — every laptop, every portal, every shared drive — because the policy will assume a tidy map and the office will have a messy one.

What the first week is not: finished. The document is the beginning of the work, not the end of it. A WISP describes a program, and a program has to be operated — reviewed on a schedule, updated when staff or software changes, revisited after anything goes wrong. This is where most programs quietly fail, not in the writing but in the maintaining, when the binder goes back in the drawer and the drawer stays shut.

A firm that spends its first week honestly reconciling policy to practice will have a weaker document and a stronger program than one that files the WISP unread. The IRS, on a PTIN renewal or in an examination, will ask to see the program. The better question is whether the person who answers the door can describe what it actually does.

How a WISP sits among the rest of your obligations

A WISP is not a freestanding chore. It sits inside a practice that already has obligations, and it reads better when you treat it as one document in a drawer that also holds your engagement letters, your software agreements, and whatever password policy you have actually been following. The FTC Safeguards Rule asks for a written program that fits your size and the data you hold. The IRS asks for the same document at PTIN renewal. Neither agency expects a treatise. Both expect the document to exist, to be current, and to bear some resemblance to how the firm actually operates.

Consider a firm that already sends engagement letters, runs practice management software, and stores client files in the cloud. The WISP does not replace any of that. It names it. The letter that tells a client how their data is handled, the software vendor’s security page, the firm’s own rules for remote access: the WISP gathers these into one place and states who is responsible for keeping them true. If your firm uses a template from Tech 4 Accountants, Rush Tech Support, the IRS 4557 or 5708 materials, a NATP or AICPA model, or a policy your MSP drafted, the WISP is that document, maintained. The source matters less than the upkeep.

Where a firm buys its WISP matters less than whether the document survives contact with January. A WISP that names software the firm no longer uses, or an employee who left, is a liability dressed as a policy. This is the quiet argument for keeping the document close to the rest of the practice’s operations. EEZY WISP is part of the EEZYVERSE family, which means one login across the EEZY products a company uses and one central bill at eezycloud.com/account/, with each product also sold on its own site; the sites are hosted on Microsoft Azure. The point is not the family name. The point is that a document kept near the tools it describes is more likely to be updated when those tools change.

The requirement is real, and the document is obtainable. The distance between having a WISP and not having one is smaller than the distance between having one and maintaining it. The first is a purchase or an afternoon. The second is a habit, and it is the habit the examiners are grading.