A written information security plan is the document a tax or accounting practice keeps to show how it protects client information. Federal law requires one. The Internal Revenue Service (IRS) reminds tax professionals of that duty. The plan earns its keep only when it describes the real office: who runs it, where client data lives, who can open it, how it’s protected and tested, which outside companies touch it, and what happens if data is stolen.

A downloaded template filed away is a start, not a plan. It doesn’t describe the real office, so when client data is at risk, it may not tell anyone what to do. And the plan is a legal requirement, not a nice-to-have. For a Florida tax office, the job is to check whether the plan matches how the office works, then close the gaps before filing season.

What Is a Written Information Security Plan?

It’s a written description of how a practice protects client information. It covers the people who handle that data, the computers and accounts they use, the outside companies that touch it, and what happens when something goes wrong. Tax and accounting practices sometimes shorten the name to four letters (WISP).

The IRS says it plainly in its reminder to tax professionals about the plan: “Federal law requires tax and accounting professionals to create and maintain a Written Information Security Plan to help protect client information from identity thieves and data breaches.”

That duty comes from the Gramm-Leach-Bliley Act. The IRS puts it this way: “Under this law, tax and accounting professionals are considered financial institutions and must implement a data security plan.” The IRS adds that the law requires financial institutions to protect customer data.

The Federal Trade Commission (FTC) enforces that duty through its Safeguards Rule. The rule names “tax preparation firms” among the businesses it covers. It also asks for a security program “written in one or more readily accessible parts.” Both phrases sit in the rule’s text.

What Should the Plan Include?

The IRS lists four things the FTC requires each firm to do as part of its plan. Name a coordinator. Size up the risks to client data. Put safeguards in place and test them. Hold service providers to the same standard. The IRS also points to three areas a good plan focuses on.

  • Name who runs it. The IRS wording is “Designate one or more employees to coordinate the information security program.” One person, by name, with the time and the authority to do it.
  • Find where client data lives and what could go wrong. The IRS wording is “Identify and assess risks to customer information in relevant areas of the company’s operation and evaluate the effectiveness of safeguards.” In office terms: workstations and laptops, the email system, tax software, cloud storage, scanned files, paper files and phones. Write down who can open each one.
  • Put safeguards in place and check them. The IRS wording is “Create, implement and regularly monitor and test security safeguards.” Sign-in and access controls, encryption, backups, updates and staff training can all live here. So can a way to know they work, like a test restore or a review of who still has access.
  • Hold outside companies to the same standard. The IRS wording is “Select service providers that can maintain appropriate safeguards and ensure their contracts require compliance.” That can cover the IT provider and cloud services. Anyone else who handles client data belongs on the list.

Those three areas are employee management and training, information systems, and detecting and managing system failures. In a small office, the first can be as plain as who gets access on the first day and what staff are taught to watch for. The second is the equipment and accounts that hold client data. The third is spotting when something breaks or looks wrong, and who to tell.

Does a Small Practice Need Every Part?

The written plan itself isn’t optional. The IRS says, “Tax professionals are legally required to have a written, accessible plan and should review, test, and update it regularly.” The FTC rule does relax four of its more detailed requirements, though, for a firm that holds information on fewer than five thousand consumers.

The four relaxed requirements, in plain words:

  • A written risk assessment.
  • Continuous monitoring, or periodic penetration testing and vulnerability assessments.
  • A written incident response plan.
  • A regular written report from the person running the program to the board or a senior officer.

The written security program itself comes from a separate part of the rule. It isn’t one of the four.

The IRS publishes a template. It’s called Publication 5708, and the IRS describes it as meant to help tax professionals, “especially smaller practices,” develop a plan. A template is a starting point. It still has to be filled in with the office’s real people, systems and vendors.

For how that exemption works, see what the Safeguards Rule’s small-firm exemption covers. How the rule applies to one particular practice is a question for its own attorney or professional adviser.

What Happens If Client Data Is Stolen?

The plan should already say who does what. The IRS recommends that tax professionals “develop a data theft response plan, including contacting their IRS Stakeholder Liaison to report a security incident.” Writing those names down in advance is easier than sorting them out under pressure.

The FTC’s Safeguards Rule also requires a covered firm to tell the FTC about certain security events. The trigger is an event involving the information of five hundred or more consumers. The notice goes in as soon as possible, and no later than thirty days after the firm discovers it. The IRS adds that tax professionals can share information with the appropriate state tax agency.

The response section can name people, not procedures. Who calls the IT provider. Who contacts the IRS Stakeholder Liaison. Who speaks to an attorney. Where the contact list lives if the computers are down, which may mean a printed copy in a drawer.

State law can add its own notice steps on top of the federal ones. For those, see Florida’s data breach notification rules.

When Should the Plan Be Reviewed?

Regularly, and whenever the office changes. The IRS says, “Firms should make adjustments based on changes in operations or results from security testing and monitoring.” So a review isn’t tied to the calendar alone. A change in how the office works can be the reason to open the plan again.

Changes that can trigger a review:

  • A hire or a departure.
  • An added computer or laptop.
  • A cloud service or software the office starts using.
  • Staff working from home.
  • A change of IT provider or other vendor.
  • Test results that show a gap.

The weeks before filing season can be a practical checkpoint. Filing season is the heavy stretch, so a short review beforehand can confirm the plan still matches the office. If it doesn’t, the gaps are easier to close then.

O&O Systems’ Cybersecurity and Compliance page says its team helps draft and maintain IT security policies and performs assessments and audits to uncover vulnerabilities.

Frequently Asked Questions About a Written Information Security Plan

Is a template enough?

A template is a starting point. The IRS publishes one, and it can save hours of drafting. It turns into a plan once it names the actual computers, accounts, staff and outside companies in the practice. A template with blanks left in it describes no office at all.

Who should run the plan?

The IRS’s wording is one or more employees to coordinate the information security program. In a small office that may be the owner or the office manager. What matters is having the time and the authority to do it. An IT provider can help with the technical parts, while the coordinator stays inside the practice.

Does a one-person tax office need one?

The IRS says tax professionals are legally required to have a written, accessible plan. The FTC rule relaxes four of its more detailed parts for a firm that holds information on fewer than five thousand consumers. The written program itself isn’t one of those four. The specifics for a single practice are worth checking with its own adviser.

How much does a written information security plan cost?

It depends on the size of the practice and on what the review turns up. The IRS publishes a template, so the document itself needn’t be a purchase. The larger costs tend to be the time it takes to fill it in honestly, plus any IT fixes the review brings to light.

Does the plan have to be one printed document?

No. The FTC rule asks for a program written in one or more readily accessible parts. What matters is that the people who need it can reach it. That includes the stretch when the computers are down, so a copy they can still get to then is worth keeping.

Make the Plan Match the Office

A plan that matches the office is useful on an ordinary day and on a bad one. It names a person. It says where client data lives and who can open it. It records the safeguards and how they get tested, and it says what happens if client data is stolen.

If your written information security plan is still a template on a shelf, ask O&O Systems about the IT side of your security plan.