Skip to main content

Tax pros: Protect client data with a Written Information Security Plan

 

Nov. 10, 2026

You must have a Written Information Security Plan, WISP, to protect your clients’ sensitive information. Federal law requires you to maintain this plan.

Your WISP should reflect your business’s size, complexity and the type of information you handle. Your plan should address employee training, information systems and responses to security failures.

To meet security requirements, you should:

  • Assign someone to oversee your security program.
  • Identify and assess risks to client information.
  • Evaluate your existing security safeguards.
  • Implement, monitor and regularly test security measures.
  • Ensure your service providers maintain appropriate safeguards.

You can use the IRS sample WISP guide PDF to create a plan tailored to your business and protect client information.