Short version. A Dallas CPA firm has to keep a written information security plan, and IRS Publication 5708 is the template the IRS points to. It has 7 parts, from a named coordinator to a breach attachment. It stops short of the Safeguards Rule on testing schedules, risk ratings, a full incident response plan and a yearly written report. Fill in the template first. Then add those four.
A Dallas CPA firm must keep a written information security plan under the FTC Safeguards Rule, and IRS Publication 5708 is the template the IRS offers for writing it. The template is a start. This guide covers what a WISP for accounting firms has to hold, what the template asks you to write down and where the rule asks for more.
This guide sits under our overview of IT services for accounting firms in Dallas and covers one document. If you’re a partner who has heard “you need a WISP” and never saw what goes in one, this is for you.
What a WISP for Accounting Firms Is and Why Every Dallas CPA Firm Needs One
A written information security plan, or WISP, is a document that says how a firm protects client data. It names who runs security, lists the risks, inventories the devices that hold client records, and sets the rules for access, retention and breach response. For tax and accounting firms the FTC Safeguards Rule requires one.
Size doesn’t change that. IRS Publication 5708 says tax and accounting professionals count as financial institutions under the Gramm-Leach-Bliley Act regardless of size. The IRS repeated the point on Aug. 18, 2026 in release IR-2026-92, which says federal law requires tax and accounting professionals to create and maintain a written plan, and Publication 5708 adds that the plan has to be accessible to the people who must follow it.
Dallas has plenty of firms. The Bureau of Labor Statistics Quarterly Census of Employment and Wages counts 512 private CPA offices in Dallas County for 2025, averaging 26.7 employees each, and 1,114 across Dallas, Collin, Denton and Tarrant counties. A 27-person firm owes the same plan as a sole practitioner with one laptop. It just has more places for client data to sit. That’s the real difference. Size isn’t the test.
What IRS Publication 5708 Asks You to Write Down
Revision 8-2024 is current. It was prepared by the Security Summit, a partnership of the IRS, state tax agencies and the tax industry, and it says plainly that it isn’t a substitute for a plan built around your own firm. It also says a sole practitioner can use a shorter plan than a 10-partner firm.
The outline has 7 parts. Here’s what each one holds, with a Dallas firm in mind.
| Part of the template | What goes in it | What it means for a Dallas firm |
|---|---|---|
| I. Objective, purpose and scope | Why the plan exists and what counts as client data | The template’s definition of PII reaches past Social Security numbers to email addresses and unlisted phone numbers |
| II. Responsible individuals | The coordinator for the program, plus a list of who may open client files | Name a person. The template calls the role Data Security Coordinator and adds a spokesperson for outside questions |
| III. Risks | Types of information handled, ways it could be lost, how you’ll test | The template’s own examples include fire, hurricane and tornado, which a North Texas spring makes less theoretical |
| IV. Hardware inventory | Each device, where it sits and what client data it touches | Computers, phones, printers, routers and modems all count |
| V. Safety measures | Policies for retention, disclosure, network, user access, data exchange, Wi-Fi, remote access, connected devices and incidents | Plus a code of conduct for staff. This is the longest part |
| VI. Implementation clause | When the plan takes effect and who reviews it | The template says to review it at least once a year |
| VII. Attachments | Six samples, A through F, from record retention to the list of employees who may access client data | Attachments D and F change every tax season |
Sample text is the trap. It’s written in the voice of a finished plan, so it’s tempting to swap in the firm name and call it done. Every policy in it is a promise your staff will be held to, and a promise nobody keeps is worse than a blank line. Write only what you’ll do.
Where Publication 5708 Stops and the Safeguards Rule Keeps Going
Most firms miss this part. The template is good at what it does, and the IRS never calls it complete. Still, the rule at 16 CFR 314.4 asks for several things the template leaves thin or leaves out.
I searched the full text of the Revision 8-2024 template for two words, penetration and board. Neither appears. The rule asks for annual penetration testing and a yearly written report to the owners. A firm that stops at the template has a gap it can’t see.
| Safeguards Rule requirement | What Publication 5708 gives you | What you still write |
|---|---|---|
| Qualified Individual, 314.4(a) | A named coordinator and a list of duties | The name in writing. If an outside provider fills the role, a senior person at the firm oversees it |
| Written risk assessment, 314.4(b) | Prompts to list the information you hold and how it could be lost | Criteria for rating each risk, and a record of what you fixed and what you accepted |
| Access control and MFA, 314.4(c) | Unique passwords, MFA for remote login, encrypted drives and Wi-Fi | MFA on every system that holds client data, unless the Qualified Individual approves an equivalent control in writing |
| Data disposal, 314.4(c) | Destroy records at the earliest opportunity consistent with business and legal needs | A dated retention schedule. The rule’s outer limit is 2 years after last use, with listed exceptions |
| Testing, 314.4(d) | A line saying to regularly monitor and test | An annual penetration test and vulnerability scans every 6 months, unless you monitor continuously |
| Incident response plan, 314.4(h) | One line asking for both a response plan and a notification plan, plus Attachment C | A written plan with roles, decision authority, communications, remediation and a review afterward |
| Annual report, 314.4(i) | An annual plan review | A written report from the Qualified Individual to the owners at least once a year |
| FTC notice, 314.4(j) | The 500-person, 30-day rule, listed in Attachment C | Who files it, and who decides when the clock started |
That’s the gap. There’s one more thing the template doesn’t tell you. Under 16 CFR 314.6, a firm holding information on fewer than 5,000 consumers is exempt from 4 items in that table, the written risk assessment, the testing schedule, the incident response plan and the annual report. The FTC describes it as an exemption from certain provisions, not from the rule. Publication 5708 never mentions the 5,000 line, so a small firm reading only the template can’t tell which rows apply. Count your records first. Don’t guess.
How to Fill In the Template at a Dallas Firm
Three local details matter.
Your headcount isn’t the same in August
The same BLS data tracks tax preparation services, NAICS 541213, month by month. In 2025 the four core counties employed 4,407 people in that industry in February and 2,748 in August. That’s a 60% jump. Plan for February, not August. Those figures include retail tax chains, so a CPA firm’s own swing may be smaller, but the shape holds.
Every employee and contractor, temporary staff included, signs an acknowledgment under the template, and a list shows who may access client data, which means a firm that hires in January and lets people go in May is updating both documents twice a year. Attachments D and F aren’t a one-time task. Someone has to add the new hires, and someone has to take access away from the people who left.
Texas has its own backup line
Texas adds a rule of its own. The Texas State Board of Public Accountancy has one on confidential client communications, 22 TAC 501.75. It says licensees must take all reasonable measures to protect client records and keep a back-up system that lets them immediately identify and notify clients of a loss, which makes it a backup duty as much as a security one. Your retention and backup section is the natural place to show how you do that. Show your work.
Cloud tax software belongs in the inventory
The template’s retention section already lists web portals and cloud applications as places client data lives. The hardware inventory should follow that lead. If preparers work in a hosted tax desktop, list it, who administers it, and who can sign in. Same for a client portal. Holds a return? It’s in scope.
Here’s a 30-day working order.
- Name the coordinator and write the name into Part II.
- List every place client data lives, on paper and in the cloud.
- Fill in Attachments E and F from that list.
- Turn on MFA for every system that holds client data, and save the enrollment report.
- Write the retention schedule that goes in Attachment A.
- Draft Attachment C with real phone numbers and the name of whoever makes the calls.
- Run a training session and collect signed acknowledgments for Attachment D.
- Put the annual review on the calendar before you close the file.
Owners skip the last half of step 4. A plan is words. Evidence is what you hand over when a regulator, an insurer or a client asks. An MFA enrollment report, a quarterly access review and a backup restore that someone actually tested take an afternoon each, and between them they answer most of what a security questionnaire will ask. They make the document believable.
Who to Call When Client Data Walks Out
Attachment C of the template is a notification list. It’s the page you’ll want most on a bad day. Keep a printed copy. It names who to tell if client information is stolen or lost.
- Your IRS Stakeholder Liaison
- The Texas Attorney General’s office
- State tax agencies
- The FBI’s Internet Crime Complaint Center, if it’s electronic theft
- The Federal Trade Commission
- Local law enforcement
- Your tax software vendor
- Your liability insurance carrier
- Legal counsel
- Affected clients, to the extent the law and good practice require
FTC reporting runs on a hard clock, added by an amendment that took effect in May 2024. A security event affecting at least 500 consumers has to be reported through the FTC’s online form as soon as possible and no later than 30 days after discovery. Discovery counts from the day anyone at the firm other than the person who caused it knows. Fill in who files the report and who decides when the 30 days began. Decide that now. A small firm can burn a week arguing about both.
One more step comes from the template. If you suspect stolen client data, check the EFIN activity report in IRS e-Services for returns you didn’t file. Put that in the plan by name.
When You Can Write It Yourself
We sell managed IT, so you’d expect us to say every firm needs help with this. Not so. A sole practitioner on a cloud-based tax stack, with MFA turned on everywhere, can fill in Publication 5708 over a weekend and be in decent shape. The IRS built it for that person. Know which firm you are.
Help starts to pay off when the firm has more than one office, hires seasonal preparers, runs a hosted tax desktop, or answers client security questionnaires, and at that point the plan stops being a document and becomes a set of controls somebody has to prove. Our Dallas CPA firm IT cost guide shows what that support runs, and our GLBA compliance cost guide prices the testing and reporting the rule adds.
To see how this plays out for a real client, read our FTC Safeguards Rule compliance case study, and see our overview of cybersecurity for CPAs and financial firms. If your clients include investment advisers or lenders, our Dallas financial firm cybersecurity requirements page covers the extra clocks. Our IT services for CPA and accounting firms page lists what we support, and you can contact us any time.
Already have a draft plan? Send it over with your user count and the tax software you run. We’ll mark where it falls short of the Safeguards Rule and tell you which fixes matter before the next filing season.
Review My Firm's WISPQuestions Dallas Partners Ask About the Plan
Does a small Dallas CPA firm really need a WISP?
Yes. IRS Publication 5708 says tax and accounting professionals are financial institutions regardless of size, and the Safeguards Rule requires a written plan. A sole practitioner can use a shorter plan, but not skip it.
Is filling in IRS Publication 5708 enough to comply?
Not by itself. The IRS calls the template a starting point, not a substitute for your own plan, and it leaves out a testing schedule, risk-rating criteria, a full incident response plan and an annual report, which the rule asks for unless you’re under the 5,000-consumer exemption.
Who should be our Qualified Individual?
Someone with real authority. The rule lets it be an employee, an affiliate or a service provider. If it’s an outside party, you stay responsible and a senior person at the firm has to oversee them.
How often do we update the plan?
At least once a year. The template says to review it annually and whenever the business changes in a way that affects client data. A new office, a new tax platform or a seasonal hiring push all count.
Do seasonal preparers have to sign the plan?
Yes, if they can reach client data. The template asks for a signed acknowledgment from every employee and contractor, including temporary and contract staff. Collect it early. Pull access when the season ends.
What happens if we have a breach and no written plan?
The reporting duty doesn’t change. A breach affecting 500 or more consumers still has to reach the FTC within 30 days of discovery. A written plan decides whether you can meet that clock calmly or scramble to find phone numbers.
Can Uprite write our WISP?
Yes, alongside you. We can help you draft it and keep the evidence behind it, such as MFA reports, access reviews and backup restore tests, as part of managed IT. Our lightest plan starts at $91 per user per month, and we’ll tell you if you don’t need us.
