Securing the Tax Practice: WISP, IRS Pub 4557, and Practical Controls

📋 Overview

Every paid tax preparer is required to have a Written Information Security Plan (WISP), but many firms aren't sure what theirs is supposed to contain, and a downloaded template with the firm's name at the top rarely reflects how the practice actually operates. When a regulator, insurer, or breach investigator asks for documentation, the details matter. This session walks through the WISP section by section using IRS Publication 4557 as the guide, explaining what each part does, what it must address, and the records a firm should keep to show its plan is being followed. If you've ever looked at your WISP and wondered whether it would hold up, this session gives you the yardstick to measure it against. You'll learn the purpose of each required element, the security controls the IRS expects behind them, what to keep on file for the vendors who handle client data, and what an incident response plan needs to cover. You'll leave knowing what a complete plan looks like and where your own firm's plan likely needs work.

👥 Who Should Attend

Tax partners, solo practitioners, firm administrators, and IT managers responsible for tax data security.

🎯 Learning Objectives

• Identify the required elements of a WISP and the purpose of each under IRS Publication 4557
• Describe the documentation that supports a WISP, including a risk assessment and evidence of security controls
• Apply the IRS-recommended security controls to common tax practice scenarios
• Determine what information to request and retain when vetting vendors that store or process client data
• Outline the components of an incident response plan, including roles, containment steps, and required reporting

🚀 What You'll Walk Away With

• You'll stop wondering whether a generic security template satisfies the IRS.
• You'll spot the gaps where your current plan doesn't reflect how your office actually works.
• You'll know which records to request from your software vendors and keep on file.
• You'll know what your incident response plan needs to cover before you ever need it.
• You'll understand the documentation expected to show you're following Publication 4557.

📚 Major Topics

1. The WISP explained: each required element and what it must address
2. Security controls in practice: what the IRS expects and how to document it
3. Vendors and third parties: due diligence and what to keep on file
4. Incident response: what the plan must cover and the reporting steps

🏷️ Topics

❓ Questions

✍️ A Note from the Author

I've watched too many practitioners sign off on a security template they haven't actually read, only to panic when an insurer asks for proof of their internal controls. I wrote this course because a plan that doesn't reflect your daily workflow isn't just useless; it's a liability. You deserve a clear way to understand what your plan should say without getting lost in technical jargon.