Guides · Published October 23, 2026

IRS Publication 5708: what the IRS WISP sample covers, and what you still have to add

When tax professionals search for an "IRS WISP template", they usually land on Publication 5708. It is the IRS's own guide to writing a written information security plan, and it includes a sample. Here is what it gives you, what changed in the 2024 update, and what you still have to write yourself.

What Publication 5708 is

Publication 5708, "Creating a Written Information Security Plan for your Tax & Accounting Practice", is a 28-page guide written by the IRS and its Security Summit partners. It starts with the basics (how to get started, the legal requirements, your professional responsibilities), then gives an outline of a basic plan and a sample.

The IRS is clear that the sample is a starting point: "There is no one-size-fits-all WISP." Your plan has to fit the size, complexity and data of your own practice (IRS news release IR-2023-129).

Why you need one at all

Under the Gramm-Leach-Bliley Act, tax and accounting professionals are financial institutions, whatever their size, and the FTC Safeguards Rule (16 CFR Part 314) requires a written information security program. The IRS puts it plainly: "Federal law requires tax and accounting professionals to create and maintain a Written Information Security Plan." (IR-2026-92) When you renew your PTIN, line 11 of Form W-12 asks you to confirm you know it (more on that here).

What changed in the 2024 update

The IRS and the Security Summit released an updated Publication 5708 in August 2024 (CPA Practice Advisor). The update stresses:

• Multi-factor authentication for anyone accessing an information system, unless your Qualified Individual approves an equivalent control in writing.
• The FTC notice: a security event affecting 500 or more people must be reported to the FTC as soon as possible and no later than 30 days after discovery.
• Other notices: your IRS Stakeholder Liaison and the state tax agencies.

What the sample does not write for you

A sample shows the shape of a plan. These parts only you can fill in:

1. Your Qualified Individual, by name, and who backs them up.
2. Your risk assessment: the computers, phones, tax software, cloud storage and paper files your firm actually uses, and what could go wrong with each.
3. Your safeguards as they are today, including the ones not yet in place, with an owner and a date.
4. Your service providers and what your contracts say about protecting client data.
5. Your incident contacts: IRS Stakeholder Liaison, insurer, IT support, attorney.
6. Your state's breach rules. Several states add their own deadlines or agencies to notify. For example, New Jersey requires a report to the State Police before you notify clients, and Massachusetts requires its own written program.

Sample or builder?

Rewriting the 28-page sample by hand means working out every one of those sections yourself, in the middle of tax season. The WISP Builder asks about your firm and writes them for you: your systems, your people, your providers, your state's rules, and every gap turned into a dated action plan. What counts is a plan that describes your firm, signed and kept up to date.

Frequently asked questions

Rules quoted as of October 23, 2026.