Under federal law and IRS regulations, information security is no longer an optional IT best practice for accounting practices—it is a strict statutory requirement. Every professional tax preparer who registers for or renews a Preparer Tax Identification Number (PTIN) must affirmatively declare under penalty of perjury that their office operates under an active, formal Written Information Security Plan (WISP).
The Legal Foundation: IRS Publication 4557 & The Gramm-Leach-Bliley Act
The Internal Revenue Service published Publication 4557: Safeguarding Taxpayer Data to outline the minimum technical, physical, and administrative safeguards non-banking financial entities must maintain. Because tax preparers and accountants routinely handle client Taxpayer Identification Numbers (TINs), Social Security Numbers (SSNs), bank routing numbers, and corporate financials, federal law classifies even solo CPA practitioners under the Gramm-Leach-Bliley Act (GLBA).
When completing IRS Form W-12 (IRS Paid Preparer Tax Identification Number Application and Renewal), practitioners must check the box confirming:
"I am aware of the legal requirement to have a Written Information Security Plan (WISP) and provide data security protections for all taxpayer information..."
Checking this box without having an actual, tailored, timestamped document physically and digitally accessible in your firm constitutes a false statement on a federal declaration, exposing the practitioner to immediate EFIN (Electronic Filing Identification Number) revocation, administrative fines, and personal liability in the event of an undetected data incident.
The 7 Core Security Controls Mandated by IRS Pub 4557
An IRS-compliant WISP cannot simply be a generic, 2-page internet boilerplate. IRS auditors and cyber insurance underwriters evaluate whether your plan details the following seven operational domains:
- Designated Compliance Officer: Formal appointment of an internal individual or qualified external managed service partner responsible for overseeing the information security program.
- Access Control & Multi-Factor Authentication (MFA): Enforcing strict least-privilege role permissions and mandating multi-factor authentication across all cloud tax software, remote desktop sessions, and client portal access points.
- Encryption Standards (At Rest & In Transit): Mandating AES-256 encryption on all stored taxpayer data files, local hard drives (BitLocker / FileVault), and TLS 1.3 encryption across all client communications and file transfers.
- Continuous Network Telemetry & Perimeter Defense: Operating active business-grade firewalls, DNS filtering, and daily external vulnerability scanning to detect open attack surfaces before threat actors exploit them.
- Mandatory Staff Training & Phishing Defense: Conducting verified annual cybersecurity awareness training for all employees, partners, and seasonal interns, complete with timestamped certificates of completion.
- Third-Party Vendor Risk Due Diligence: Maintaining written affirmations from all software vendors (e.g., tax software providers, cloud backup services, CRM portals) confirming their adherence to FTC Safeguards Rule §314.4.
- Formal Incident Response & 72-Hour Reporting Protocol: Documenting immediate quarantine protocols and federal reporting procedures requiring IRS Stakeholder Liaison, state tax authorities, and FBI/CISA notification within 72 hours of discovering unauthorized client data access.
How CPA Security Automates Full Compliance
CPA Security was architected specifically to remove the burden of manual legal drafting. Our automated WISP engine gathers your firm's specific hardware inventory, cloud software stack, and office operational profile to dynamically generate an audit-ready, 30+ page formal WISP document formatted to pass IRS examiner reviews with zero legal overhead.
Coupled with our integrated employee training modules, plug-and-play internal network sensors, and external perimeter scanning, CPAs can protect their client relationships and PTIN status with complete peace of mind.