In "Why Boilerplate WISP Templates Fail CPA Firms," we argued that a downloaded security plan with your firm name swapped in will not withstand a real look. We still hold that view, with one exception. The IRS and its Security Summit partners built a free WISP template for tax professionals that is worth starting with, as long as you treat it as a draft you finish.
The short answer
Yes, for most small tax and accounting firms the free IRS template is the right place to start, as a draft. IRS Publication 5708 is a 28-page WISP template written for tax professionals in smaller practices, and the IRS says your plan must be written, accessible, and reviewed, tested and updated regularly (IR-2025-79). An insurer, a regulator or a client will hold it against the FTC Safeguards Rule: a named Qualified Individual, a written risk assessment, encryption of client data, multi-factor authentication, security training for every staff member, oversight of your vendors and a yearly written report. The template holds up once every placeholder carries your firm's real names, systems and evidence, its incident section lists who you would call and the FTC's 30-day notice deadline, and it says how staff may use Microsoft 365 Copilot with client files.
IRS Publication 5708 exists because the law applies to you whether or not you have an IT department. Under the Gramm-Leach-Bliley Act, tax and accounting professionals are considered financial institutions and must maintain a written, accessible security plan. The IRS also tells practitioners to review, test, and update that plan regularly.
The template works where generic ones fail because it was written against the rule you are measured by. It is also candid about its limits. According to CPA Practice Advisor’s coverage of the update, the IRS described the sample as a place to start, not the final word. Your job is to turn it into a description of how your firm actually operates.
Whether the reviewer is a regulator, a cyber insurer, or a client’s compliance team, they will compare your plan to the FTC Safeguards Rule. Section 16 CFR 314.4 lists the required elements, and several of them are easy to leave vague.
FTC Safeguards Rule
What a passing WISP shows a reviewer
Each line is a required element of 16 CFR 314.4. The exemptions below remove four of them for smaller firms.
A firm that holds customer information on fewer than 5,000 consumers is exempt from four of these requirements under section 314.6: the written risk assessment, the penetration and vulnerability testing, the written incident response plan and the annual report. Former clients count for as long as you keep their files. Confirm with counsel whether the exemption applies before you delete any section of the template.
A plan fails review when it asserts a control without showing who owns it or when it was last checked. For each element above, your WISP should answer three questions: who is responsible, what exactly is in place, and where is the proof.
Start with names. Put a real person in the Qualified Individual slot, with a backup. A plan that says “the firm” is responsible reads as though nobody is.
Next, map where client data lives. List every system that touches tax returns, including your tax software like Drake, UltraTax CS, CCH Axcess, scanning tools, email, file storage, client portal, and any laptops or phones that cache documents. The template walks you through this, but most firms underestimate the importance of the list. If you only inventory the systems you think about daily, your risk assessment will miss the ones an attacker finds first.
Then write the risk assessment in plain language. For each system, state what could go wrong, how likely it is, and what you decided to do about it. Accepting a risk is allowed, but the decision needs a name and a date beside it.
Replace every placeholder, including the ones in sections you think do not apply. Reviewers look for leftover brackets and generic phrases because those are the quickest signs that nobody read the document after downloading it.
Finally, build the incident response section with the people you would actually call. The IRS recommends a data theft response plan that includes contacting your IRS Stakeholder Liaison to report a security incident. Under 16 CFR 314.4(j), you must also notify the FTC within 30 days of discovering a security event that involves the information of 500 or more consumers. Write down the phone numbers, that deadline and the order of calls while things are calm.
If your firm runs on Microsoft 365, your WISP needs a short section on AI tools. Write it as a Microsoft Copilot policy that covers Word, Excel, Outlook and Teams one by one, because each touches different client data.
The security model is the reason this matters. Microsoft states that Copilot surfaces only organizational data to which a user has at least view permission. Microsoft’s architecture documentation states that Copilot operates via Microsoft Graph and only accesses what the signed-in user is authorized to see. That is reassuring only if your permissions are tight. If a staff member can open every client folder today, Copilot can summarize each one for them tomorrow. The tool does not create new access, but it makes existing access much easier to use.
The policy section should tie back to the controls the Safeguards Rule already requires. The same Microsoft architecture page says Copilot supports Conditional Access and multifactor authentication, which means your MFA requirement carries over to AI use, and you can state that in the plan.
Copilot policy
Settled before Copilot goes on
Copilot shows each user only what they can already open: Microsoft 365 Copilot architecture.
Microsoft is also considered a service provider under your plan. The rule requires you to assess your service providers periodically, so add Copilot to that review and record when you last read Microsoft’s privacy documentation. Microsoft’s data, privacy, and security page for Copilot is the document to check; its contents change, so note the date you reviewed it.
A WISP that passed review in January can fail by October if your staff, software, or vendors have changed. The IRS says the plan should be reviewed, tested, and updated regularly, and the Safeguards Rule’s annual written report provides a natural deadline. Put that review on the calendar and add a trigger for off-cycle updates: a new hire, a new software tool, a departed employee with system access, or a change, such as switching on a new Copilot feature.
Keep a short change log at the back of the document. Each entry needs a date, a one-line description, and the initials of the person who approved it. A reviewer who sees a living log concludes that the plan is in use. One who sees a pristine document with no history concludes it was written once and shelved.
If you have no WISP, use Publication 5708 and start this week. It is free, it matches the rule, and it was written for firms your size. If you already have a plan from a template vendor, compare it against the 314.4 elements above and look for placeholders, missing names, and missing evidence. Either way, the template only counts as a starting point. What passes review is the work you do afterward: real names, a written risk assessment, tested controls, and a plan that changes when your firm does.
For CPA firms
Get your WISP reviewed against the Safeguards Rule
PK Tech has worked with CPA firms as a managed IT provider for more than 16 years, and holds AICPA SOC 2 Type II attestation from an independent audit. Bring your current plan, template or not, and we will walk it against each element with you.
Schedule a WISP review with Jordan →