In August 2026, the Internal Revenue Service reminded accounting firms and professional tax preparers that protecting client financial information requires a Written Information Security Plan (WISP). However, having a written plan does not automatically mean a firm is secure.
With more than three decades of experience in technology and cybersecurity, I have seen how documented policies can differ from actual security practices. A written policy cannot prevent ransomware, stop credential theft, or recover encrypted accounting databases without effective technical safeguards.
What Is a WISP, and Why Does It Matter?
A Written Information Security Plan explains how an organization protects sensitive information, identifies cybersecurity risks, and responds to security incidents.
These requirements stem from the Gramm-Leach-Bliley Act (GLBA) and the Federal Trade Commission’s Safeguards Rule, which applies to covered financial institutions, including tax preparation firms.
A WISP typically covers risk assessments, data protection, employee training, incident response, and regular security reviews. Although certain smaller firms may qualify for exemptions from specific provisions, they must still protect client information appropriately.
The IRS provides guidance through Publication 5708, Creating a Written Information Security Plan for Your Tax & Accounting Practice.
The Gap Between Compliance and Security
Consider a firm whose WISP restricts sensitive information to authorized employees. If multi-factor authentication is missing, former employees retain active accounts, or staff can access every shared folder, the firm’s technical controls contradict its written policies.
Similar gaps occur when firms maintain backups without testing recovery or require endpoint protection while remote laptops remain unmonitored.
Effective cybersecurity means translating written requirements into practical, verifiable safeguards. Security should be measured by what a firm can demonstrate, not simply what its documentation promises.
Essential Cybersecurity Controls for Accounting Firms
Multi-factor authentication and identity management: Multi-factor authentication (MFA) helps prevent unauthorized access through stolen credentials. Phishing-resistant methods, such as FIDO2 security keys, provide stronger protection. Firms should also review user permissions, administrative privileges, and employee accounts regularly.
Endpoint detection and response: Endpoint Detection and Response (EDR) identifies suspicious activity on workstations and servers, including unusual file encryption and malicious commands. Managed Detection and Response (MDR) adds security monitoring and investigation, including outside business hours.
Encryption and secure data handling: Accounting firms process sensitive information, including Social Security numbers, payroll records, and banking details. Drive encryption, secure document portals, encrypted communications, and protected cloud storage help safeguard this information.
Backup and disaster recovery: Successful backup reports do not guarantee recovery. Firms should maintain protected backups, establish recovery time objectives (RTOs), and regularly test restoration procedures. Incident response plans should explain how to isolate affected systems and when to contact cybersecurity specialists, insurers, or legal counsel.
Protecting Accounting Applications and Workstations
Accounting platforms such as QuickBooks Desktop, Thomson Reuters UltraTax CS, CCH Axcess, Drake Tax, and Intuit Lacerte depend on secure credentials, updated software, properly configured databases, and controlled user access.
Outdated workstations, insecure remote desktop environments, and poorly managed updates can expose confidential financial records. Shared accounting files also require properly configured server permissions and network services.
Specialized IT Services for Accounting Firms can address these challenges through proactive workstation management, cybersecurity monitoring, application support, and infrastructure planning. The goal is to protect client information without disrupting daily accounting operations.
Turning WISP Requirements Into Practical Security
Effective implementation begins with assessing the firm’s technology environment. Organizations should inventory systems and sensitive data, evaluate authentication and encryption, review endpoint protection and backups, assign security responsibilities, and address vulnerabilities according to their potential impact.
Employee training should cover phishing, secure information handling, and incident reporting. Regular monitoring, backup restoration tests, and service-provider reviews help ensure safeguards remain effective.
The NIST Cybersecurity Framework 2.0 offers a voluntary structure covering Govern, Identify, Protect, Detect, Respond, and Recover. Although it does not replace regulatory compliance, it helps connect written policies with operational security practices.
Cybersecurity Is an Ongoing Responsibility
A WISP should never become a document completed once and forgotten. Employees leave, applications change, cloud services expand, and new threats emerge, creating risks that require continuous attention.
Technology service providers can help implement safeguards and identify technical deficiencies, but accounting firms remain responsible for understanding and meeting their applicable legal obligations.
The objective is to establish a practical security program that protects sensitive information and supports business continuity.
For CPA firms, the essential question is not simply, “Do we have a WISP?” It is, “Can we demonstrate that our safeguards are actually protecting our clients’ information?”
Article received via email
