Accounting & Tax CyberSecure
Starter Kit$149
Professional$249
Tax professional WISP guide
WISP template for CPA and tax firms, built on IRS Publication 5708
Federal law requires tax and accounting professionals to keep a written information security plan. Here is what that means in plain English, and an editable WISP that follows the IRS outline.
- Plain English
- Editable Word & Excel
- Free self-assessment
Updated October 18, 2026 · Get the free self-assessment
The requirement
Why your firm needs a WISP, in plain English
Under the Gramm-Leach-Bliley Act, tax preparers and accounting firms count as financial institutions. The FTC Safeguards Rule (16 CFR Part 314) therefore requires them to keep a written information security plan, or WISP. The IRS repeated this reminder in August 2026.
IRS Publication 5708 gives a sample outline for small practices, and Publication 4557 explains the safeguards: multi-factor authentication, encryption when you send client files, secure disposal, staff training and an incident plan.
Under the Safeguards Rule, your plan must name a Qualified Individual, rest on a written risk assessment and include safeguards such as access control, encryption and MFA. It must also cover service provider oversight, regular testing and updates.
If unencrypted information about 500 or more people is taken, the FTC must hear from you within 30 days of discovery. The IRS also asks you to report client data theft to your IRS Stakeholder Liaison.
Requirement by requirement
Where each requirement is covered in the Accounting & Tax CyberSecure kit
Every document is editable Word or Excel. Items marked Pro are in the Professional Edition only.
| Requirement | What it means for you | Kit documents |
|---|---|---|
| Written plan (WISP) | One document that describes how you protect client data. |
|
| Qualified Individual | Name the person who runs the plan. |
|
| Risk assessment and data inventory | Know where taxpayer data lives and what threatens it. |
|
| MFA and access control | Multi-factor login and least-privilege access to tax software and files. |
|
| Encryption and secure file exchange (Pub 4557) | Encrypt sensitive files; don't email returns in plain text. |
|
| E-file and EFIN security | Protect IRS e-Services, EFIN and e-file credentials. |
|
| Vendor and tax software oversight | Check your tax software, portal and IT providers. |
|
| Incident response and IRS reporting | Know who to call, including the IRS and states, when data is stolen. |
|
| Taxpayer information disclosure (§7216) | Control how taxpayer information is used and disclosed. |
|
| Annual report | The Qualified Individual reports to partners at least yearly. |
|
See a sample page
What the Written Information Security Plan (WISP) looks like
Plain-language templates with bracketed fields for your details, policy IDs that stay the same when you upgrade, and a footer reminding you to customize before use.
- Download right after checkout
- Edit in Microsoft Word, Google Docs or any word processor
- One-time price: Starter $149 · Professional $249
What's inside
Every file in each edition
Policy numbers carry over from the Starter Kit to the Professional Edition, so you can start small and upgrade without renumbering.
Starter Kit
$14924 editable files
Policies 15
- ACT-CYB-001Information Security Program & Qualified Individual Policy
- ACT-CYB-002Risk Assessment & Data Inventory Policy
- ACT-CYB-003Access Control & Least Privilege Policy
- ACT-CYB-004Multi-Factor Authentication Password Policy
- ACT-CYB-005Encryption & Secure Client File Exchange Policy
- ACT-CYB-006Acceptable Use & Workstation Security Policy
- ACT-CYB-007Email Security, Phishing & Impersonation Policy
- ACT-CYB-008Personnel Security & Confidentiality Policy
- ACT-CYB-009Security Awareness & Training Policy
- ACT-CYB-010Physical Security & Clean Desk Policy
- ACT-CYB-011Backup & Recovery Policy
- ACT-CYB-012Records Retention & Secure Disposal Policy
- ACT-CYB-013Service Provider & Tax Software Oversight Policy
- ACT-CYB-014Incident Response, IRS & State Reporting Policy
- ACT-CYB-015Remote Work, Mobile & Seasonal Staff Policy
Plans, guides & assessments 8
- WordImplementation Guide
- WordStaff Cybersecurity Quick Guide
- WordIncident Response Plan
- WordWritten Information Security Plan (WISP)
- WordClient Data Security Notice
- Word30-60-90 Day Action Plan
- Word50-Point Cybersecurity Checklist
- WordCybersecurity Maturity Assessment
Workbook 1
- ExcelAccounting & Tax CyberSecure Toolkit
Professional Edition
$24942 editable files
Policies 21
- ACT-CYB-001Information Security Program & Qualified Individual Policy
- ACT-CYB-002Risk Assessment & Data Inventory Policy
- ACT-CYB-003Access Control & Least Privilege Policy
- ACT-CYB-004Multi-Factor Authentication Password Policy
- ACT-CYB-005Encryption & Secure Client File Exchange Policy
- ACT-CYB-006Acceptable Use & Workstation Security Policy
- ACT-CYB-007Email Security, Phishing & Impersonation Policy
- ACT-CYB-008Personnel Security & Confidentiality Policy
- ACT-CYB-009Security Awareness & Training Policy
- ACT-CYB-010Physical Security & Clean Desk Policy
- ACT-CYB-011Backup & Recovery Policy
- ACT-CYB-012Records Retention & Secure Disposal Policy
- ACT-CYB-013Service Provider & Tax Software Oversight Policy
- ACT-CYB-014Incident Response, IRS & State Reporting Policy
- ACT-CYB-015Remote Work, Mobile & Seasonal Staff Policy
- ACT-CYB-016Taxpayer Information Use & Disclosure (§7216) Policy
- ACT-CYB-017E-File, EFIN & IRS e-Services Security Policy
- ACT-CYB-018Vulnerability, Patch & Security Testing Policy
- ACT-CYB-019Generative AI & Cloud Application Use Policy
- ACT-CYB-020Payment, Payroll & Refund Change Verification Policy
- ACT-CYB-021AI Governance Policy
Plans, guides & assessments 10
- WordProfessional Edition Implementation Guide
- WordIncident Response Plan & Playbooks
- WordTabletop Exercise Kit
- Word30-60-90 Day Action Plan
- WordStaff Cybersecurity Quick Guide
- WordWritten Information Security Plan (WISP)
- WordClient Data Security Notice
- Word50-Point Cybersecurity Checklist
- WordCybersecurity Maturity Assessment
- Word50-Question Accounting & Tax Cybersecurity Self-Assessment
Forms & templates 10
- FORM-01Bank Account, Refund & Payment Change Verification Form
- FORM-02Access Request Form
- FORM-03Staff & Seasonal Offboarding Checklist
- FORM-04Software & SaaS Request Form
- FORM-05Security Exception Request
- FORM-06Incident Intake Form
- FORM-07Vendor Security Questionnaire
- FORM-08Confidentiality Policy Acknowledgment Form
- FORM-09Data Theft & Breach Notification Worksheet
- FORM-10Qualified Individual Annual Report & Management Review
Workbook 1
- ExcelAccounting & Tax CyberSecure Professional Toolkit
Questions
Frequently asked questions
Is a WISP really required for a small tax practice?
Yes. The IRS says federal law requires tax and accounting professionals to create and maintain a written information security plan. The requirement comes from the FTC Safeguards Rule under the Gramm-Leach-Bliley Act.
What's the difference between IRS Pub 4557 and Pub 5708?
Publication 4557, Safeguarding Taxpayer Data, explains the security steps. Publication 5708 is a sample WISP outline for small practices. The kit's WISP follows the 5708 structure and maps to the Safeguards Rule.
Do we need to notify the FTC after a breach?
If unencrypted information about 500 or more people is acquired without authorization, notify the FTC within 30 days of discovery. Also contact your IRS Stakeholder Liaison and check your state's breach laws.
Does the kit cover seasonal staff?
Yes. It includes a Remote Work, Mobile & Seasonal Staff Policy and a staff and seasonal offboarding checklist.
Is this legal advice?
No. These are editable templates and plain-English education. Have your attorney review documents that carry legal obligations.
Free download
Free Accounting & Tax cybersecurity self-assessment
Answer 50 yes / no / not sure questions across 10 areas. Score your results and get clear next steps for your industry.
- Small Business, Law Office, Real Estate, Healthcare, Accounting & Tax, Insurance Agency, Financial Advisor, Auto Dealer, Mortgage & Title, and Cyber Insurance Readiness editions
- Starred priority questions and a scoring table
- Printable PDF
Your assessment is ready
Thanks. Your download should start automatically. If it doesn't, use the button below.
Download the PDFQuestions about your results? Email info@cybriva.ai.
Ready to put it in writing?
Get the Accounting & Tax CyberSecure kit
Start with the Starter Kit or get every policy, form and workbook in the Professional Edition. Policy numbers carry over if you upgrade.
See the full Accounting & Tax CyberSecure pageSources
- IRS: Security Summit reminds tax pros they need a WISP (IR-2026-92)
- 16 CFR Part 314, FTC Standards for Safeguarding Customer Information (eCFR)
- FTC Safeguards Rule notification amendment, 88 Fed. Reg. (Nov. 13, 2023)
This guide is plain-English education, current as of October 18, 2026. It is not legal advice, an audit or a compliance determination, and Cybriva is not affiliated with any regulator or standards body named here. Rules change and vary by state; confirm how they apply to you with your attorney or compliance advisor.