safeguardsmonitor.com/wisp-template· printed from the live page · figures carry their own as-of dates

Free WISP Template for Tax Preparers: A Starting Point Built from IRS Pub 5708

Checked against the primary record: July 17, 2026 · Source revision: IRS Publication 5708 (Rev. 8-2024)

This page offers a free WISP template and explains what completing one involves. It is general information, not legal advice for your specific situation. For that, consult a qualified professional.

Prefer to read before you fill anything in? Download the PDF version of the same document.

This template is educational, adapted from IRS Publication 5708. It is general information, not legal advice for your specific situation, and completing it does not by itself make your firm compliant. For advice on your situation, consult a qualified professional.

#CopiedWhat does the free WISP template include?

The template is a fill-in document that follows the structure of IRS Publication 5708, the IRS's own "Creating a Written Information Security Plan" sample, with the guidance rewritten in plain English and the current rule text checked section by section. What it is: a complete working skeleton your firm fills in and signs. What it is not: a finished plan, a compliance verdict, or a substitute for the decisions only your firm can make.

• The plan itself, in the IRS's own section order: objective, purpose, scope, responsible officials, risk assessment, the inside-the-firm policies (collection and retention, personnel accountability, disclosure, reportable events), and the technical policies (network protection, access control and MFA, encrypted exchange, Wi-Fi, remote access, connected devices, training).
• A rule map showing where each element of 16 CFR 314.4 lives in the document, which Publication 5708 itself does not provide.
• YOUR FIRM DECIDES boxes at every deliberate blank, each stating what to decide and why, with its rule anchor.
• Eight working attachments: retention and disposal policy, employee rules of conduct, incident procedures with a filled notification-contacts table, an acknowledgment form, hardware and access inventories, a service-provider list, and a review log.
• A sources page: every regulatory reference in the document, with its revision date and a link to the primary source, each checked on July 17, 2026.

One design choice worth naming. This download is free the way a document should be free: no email wall, no account, a named publisher, and an honest disclaimer on the cover. In the July 2026 market scan behind this page, those four rarely travel together: of the two lookalike template domains we checked at page depth, neither carried a disclaimer and one named no operator at all, and the named vendors in our scan gate their free templates behind a contact form. We publish under our own name and ask for nothing, because this template is also how you judge us.

#CopiedWhat does IRS Pub 5708 leave blank?

Publication 5708 is genuinely good, and it is honest about what it is. The IRS states outright that it provides "sample information," that there is "no one-size-fits-all WISP," and that the document is not a substitute for developing a plan based on your own firm's needs. The skeleton is the IRS's gift; the blanks are the actual work. Concretely, the sample leaves your firm to decide who runs the program day to day (the rule's Qualified Individual, which the IRS sample calls the Data Security Coordinator), who speaks for the firm if an incident happens, what data you actually hold and where, how long you keep records and how you destroy them, which third parties touch your client data, your password and MFA setup, your rule for remote access after hours, and the date you will actually review the plan again.

None of those blanks is a flaw. They are the decisions that make the plan yours, and a plan that skips them is paper. Our template keeps every one, marks it, and explains it, so the blank you are staring at comes with the reason it exists and the rule element it serves. The full map, what each section asks and what only your firm can decide, is in our Publication 5708 walkthrough. The legal duty behind the whole exercise sits in the FTC Safeguards Rule, which requires a written information security program from any firm significantly engaged in preparing returns for compensation.

#CopiedHow do you complete it?

The template walks this order, and each step below carries the rule element it serves. The written-program duty itself is 16 CFR 314.3(a); the elements are 314.4.

1. Name the responsible person (314.4(a)). One named person oversees and enforces the program. In a solo practice that is you, by name.
2. Inventory your systems and data (314.4(c)(2)). Computers, server, cloud services, tax software, paper files: the template's Attachment E is the working list.
3. Fill the risk grid (314.4(b)). What you hold, where it lives, what could realistically go wrong, and what stands in the way. Under 5,000 consumers the formal written risk assessment of 314.4(b)(1) is set aside by 16 CFR 314.6, but the program must still be based on a risk assessment, and the grid is how a small firm does it.
4. Set the safeguard policies (314.4(c)). Access controls, encryption in transit and at rest, multi-factor authentication with its narrow written exception, disposal timing, change management, and monitoring: the template states each in plain English with the subsection beside it.
5. Record training (314.4(e)). Staff read the plan, sign the acknowledgment, and sit the annual training; the template carries the forms.
6. List and bind your service providers (314.4(f)). Tax software, portals, backup, IT support: capable providers, safeguard language in the contract, periodic reassessment.
7. Sign it, date it, and calendar the review. The signature and date come from Publication 5708's own implementation clause; the duty to review and adjust is the rule's (314.4(g)). An unsigned plan with no review date is a form, not a program.

This template is educational, adapted from IRS Publication 5708. It is general information, not legal advice for your specific situation, and completing it does not by itself make your firm compliant. For advice on your situation, consult a qualified professional.

#CopiedCan a free template satisfy PTIN renewal?

This question deserves a precise answer, because the renewal moment is where the field sells the most confidence. Line 11 of the current Form W-12 (Rev. October 2025), labeled "Data Security Responsibilities," asks you to attest that you are aware that paid preparers are required by law to create and maintain a written information security plan. It is an awareness attestation. It is not a certification that your plan exists or meets any standard, and no template, free or paid, turns the checkbox into one.

The seriousness runs the other way. The W-12 is signed under penalties of perjury, so the awareness you attest to should be real, and the duty you are attesting awareness of is the FTC's written-program requirement. The honest sequence is: know the duty, hold the document, keep it current. A completed template is how the middle step stops being hypothetical. Whether your particular plan meets the rule for your particular firm is a judgment question, and the one place on this page we will say it plainly:

If you are checking Line 11 and are unsure whether your plan actually covers your firm's situation, put the question to a qualified professional before renewal season, not after. This template gives you the document to bring to that conversation.

#CopiedWhat does a WISP cost if you don't do it yourself?

The market for WISP help sorts into a few classes, and the honest map matters more than any vendor's name. We deliberately name no vendors here; classes are enough to know what you are looking at.

Where does the free path genuinely stop? At the decisions. Any honest template, ours included, can structure the work and explain the blanks; it cannot know your systems, your clients, or your risk appetite. Paying is rational when you want another professional to carry part of that judgment, not because a checkbox demands it.

#CopiedFAQ

#CopiedThe bottom line

The rule asks for a written plan; the IRS gives you the skeleton; this template turns the skeleton into a document you can actually fill in, and it costs nothing to find out. Download it, work the seven steps, and sign it. And if you first want the requirement itself in plain terms, or you are not sure it reaches your kind of practice, the Safeguards Rule explainer covers what the rule requires, who is covered, and which duties a small firm can set aside.

Reading first? The PDF version is the same document.

This template is educational, adapted from IRS Publication 5708. It is general information, not legal advice for your specific situation, and completing it does not by itself make your firm compliant. For advice on your situation, consult a qualified professional.