IRS WISP requirements: how to update your plan before the 2027 filing season

A written information security plan (WISP) is easy to write once and forget. IRS WISP requirements expect more: the plan has to keep up with the firm. The 2027 filing season is a good deadline to fix that. Between now and January, a tax practice can compare its plan to how the office actually runs, close the gaps, and go into busy season with a document that would hold up if a breach, an insurer or the FTC asked to see it.

How often do IRS WISP requirements say to update the plan?

At least once a year, and again after any material change. The rule behind the IRS guidance expects the plan to change when the firm changes. Tax preparers are financial institutions under the FTC Safeguards Rule (16 CFR 314.2(h)(2)(viii)), and 16 CFR 314.4(g) requires them to evaluate and adjust the information security program in light of testing results, material changes to operations or business arrangements, and risk assessment results.

The IRS repeated the point this summer. In IR-2026-92, issued August 18, 2026, the IRS and its Security Summit partners stated that "Federal law requires tax and accounting professionals to create and maintain a Written Information Security Plan." The IRS sample plan, Publication 5708, tells firms to review the plan "at least annually or whenever there is a material change."

The fall is the natural time to do that review. Staffing, software and vendor decisions for the season are mostly made, and nobody is yet working busy-season hours.

What counts as a material change?

Anything that moves client data to a new place or gives a new person access to it. For most practices, the past year produced at least one of these:

• New or departed staff, including seasonal preparers and remote workers.
• A new tax software version, client portal, e-signature tool or document management system.
• A move from an office server to cloud storage, or a new backup provider.
• New laptops, phones or home offices that now hold client files.
• A new IT provider, payroll vendor or bookkeeping platform with access to client data.
• A security incident, a near miss, or a phishing email that got further than it should have.

Each one should appear somewhere in the plan, with the safeguard that now covers it.

What did the IRS emphasize in 2026?

Multi-factor authentication (MFA) and scams aimed at preparers. In IR-2026-106 on September 4, 2026, the IRS told tax professionals to "use MFA across all services and data access points" and stated that "the MFA requirement applies to tax preparation firms regardless of size." The same release asks firms to require individual logins, so staff "never share usernames or passwords."

The summer series launch, IR-2026-81 on July 7, 2026, highlighted IRS impersonation, "new client" phishing, and scams seeking preparers' EFINs, PTINs and CAF numbers.

Your WISP should show where each of those is handled: which systems require MFA, how staff verify a new client before opening an attachment, and who controls the firm's EFIN and e-Services credentials.

Which sections of the WISP should you revisit?

Use the structure of Publication 5708 as a checklist. Its sample plan has sections for objective, purpose, scope, identified responsible officials, inside-the-firm risk mitigation, outside-the-firm risk mitigation, and implementation. Four of them usually need the most work:

• Responsible officials. Confirm the named Qualified Individual still works at the firm and has reviewed the plan this year. 16 CFR 314.4(a) requires a designated Qualified Individual. Firms that maintain information on 5,000 or more consumers also owe the Qualified Individual's annual board report.
• Inside the firm. Update the user list, access rights, device inventory, encryption status and training records. Section 314.4(c) requires MFA "for any individual accessing any information system" and encryption of customer information in transit and at rest.
• Outside the firm. List every service provider with access to client data and confirm each contract requires appropriate safeguards, as section 314.4(f) requires.
• Implementation. Record the date of this review, what changed, and who approved it.

What if your practice serves fewer than 5,000 clients?

Some written requirements fall away, and the core controls stay. Under 16 CFR 314.6, a firm that maintains customer information on fewer than 5,000 consumers is exempt from the written risk assessment, the penetration testing and vulnerability assessment schedule, the written incident response plan, and the annual written report to the board. The Qualified Individual, MFA, encryption, training and service provider oversight still apply. Keeping a short written risk assessment and incident plan anyway makes the rest of the WISP easier to defend.

What should the incident section say now?

Who calls whom, in what order, with phone numbers that still work. The IRS recommends that a practice report data theft to its local IRS Stakeholder Liaison so the IRS can block fraudulent returns, then to the appropriate state tax agency, and then inform affected clients.

The FTC has its own clock. Under section 314.4(j), a financial institution must notify the FTC no later than 30 days after discovering a notification event that involves the information of at least 500 consumers. A notification event is the unauthorized acquisition of unencrypted customer information. Put that threshold and the deadline in the plan, next to the name of the person who files the notice.

What should a practice do before January?

Work through a short list and date each item:

• Confirm the Qualified Individual by name and schedule the annual review.
• Walk the office and the staff list, and update the plan for every material change since last season.
• Verify MFA on email, tax software, the client portal, remote access, cloud storage and IRS e-Services accounts.
• Remove shared logins and disable accounts for anyone who has left.
• Confirm full-disk encryption on every laptop and any backup that leaves the office.
• Review vendor contracts for safeguarding terms.
• Refresh phishing training with examples of "new client" and IRS impersonation lures.
• Update the incident contact list, including the Stakeholder Liaison, the state agency, your insurer and your IT provider.
• Keep the signed, dated plan where the Qualified Individual can produce it quickly.

If your preparers are also renewing PTINs this fall, read our note on the Form W-12 WISP question.

This article describes what the FTC Safeguards Rule and IRS guidance say. It is not legal advice about your practice's specific obligations.

How s90 helps

s90 supports CPA firms and tax practices across Los Angeles and Orange County. We help firms update the WISP to match their real environment, then run the controls it describes: MFA, encryption, backups, monitoring, vendor records and staff training. If you would like a review of your plan before the season starts, we are happy to take a look.