Protect taxpayer data
Reduce exposure around tax returns, SSNs, W-2s, 1099s, banking records, payroll files, and client portals.
IRS WISP Compliance Consulting
IRS WISP compliance support for tax preparers, CPAs, and accounting firms.
OC Security Audit helps tax, accounting, bookkeeping, and payroll firms build a practical Written Information Security Plan, protect taxpayer data, align with IRS and FTC Safeguards expectations, and turn security gaps into an actionable roadmap.
PlanWISPWritten security plan aligned to actual systems, users, vendors, workflows, and risk.
DataTaxpayerReview how client tax records, SSNs, payroll data, portals, and files are protected.
ControlsMFA + EmailAssess Microsoft 365, Google Workspace, phishing, forwarding, access, and identity risk.
OutcomeRoadmapPractical remediation priorities, evidence needs, and annual review guidance.
What IRS WISP Means
Start with a written security plan that reflects how your firm actually works.
IRS WISP means Written Information Security Plan. For a tax or accounting firm, it should explain how taxpayer and client data is protected through governance, risk assessment, access control, employee training, vendor oversight, incident response, backup, monitoring, and annual review.
A template can be useful, but it is not enough by itself. A strong WISP should match your real environment, including Microsoft 365, tax software, endpoints, laptops, remote access, client portals, email, backups, and third-party vendors.
Why WISP Matters
Protect sensitive taxpayer data before tax-season pressure exposes weak controls.
Tax firms often store and transmit the exact information attackers want: Social Security numbers, tax returns, banking records, payroll files, identity documents, signatures, and financial statements. WISP readiness helps leadership document responsibility, reduce risk, and prove that security controls are being managed.
Reduce phishing and ransomware risk
Strengthen email, identity, endpoint, backup, and incident response controls before a filing-season disruption becomes a crisis.
Improve Microsoft 365 security
Review MFA, mailbox forwarding, conditional access, admin roles, external sharing, audit logs, and phishing defense.
Prepare for data theft incidents
Document roles, reporting steps, escalation paths, containment actions, and recovery plans before an incident occurs.
Support FTC Safeguards readiness
Connect risk assessment, service provider oversight, security controls, monitoring, and evidence to practical compliance work.
Build trust and evidence
Create proof of security ownership, annual review, training, vendor management, and control improvement efforts.
Who Needs A WISP
Taxpayer data security applies to more than large accounting firms.
Organizations that handle taxpayer or client financial information should evaluate whether they need a documented WISP and supporting cybersecurity controls.
Tax preparersCPA firmsAccounting firmsBookkeepersPayroll providersEnrolled agentsSmall tax officesFinancial service providers
What A Practical WISP Includes
Document the controls your firm actually uses.
A useful WISP connects written policy to real systems, workflows, and security controls. It should explain who is responsible, where taxpayer data lives, how access is controlled, how vendors are managed, and what happens when something goes wrong.
- Security owner or responsible person
- Taxpayer data inventory and business profile
- Risk assessment and remediation tracking
- Access control, MFA, passwords, and account management
- Microsoft 365, Google Workspace, email, and client portal security
- Endpoint, laptop, encryption, backup, and ransomware resilience
- Vendor and service provider review
- Employee training, incident response, monitoring, testing, and annual review
OC Security Audit Assessment Scope
A WISP readiness review built around documentation and technical reality.
OC Security Audit helps firms identify gaps between the written plan and the systems that actually protect taxpayer data every day.
WISP readiness assessment
Review documentation, assigned responsibility, annual review practices, control ownership, and evidence tracking maturity.
Taxpayer data security review
Identify where taxpayer data lives across laptops, workstations, file shares, tax applications, cloud storage, and portals.
Microsoft 365 and email review
Assess MFA, conditional access, mailbox protection, forwarding controls, impersonation defense, and audit visibility.
Endpoint and remote access review
Evaluate encryption, patching, endpoint protection, remote work controls, VPN or remote access, and device administration.
Backup and ransomware resilience
Validate backup isolation, restore testing, recovery priorities, and resilience during peak filing periods.
Vendor and tax software review
Review service provider access, client portal controls, outsourced functions, tax software settings, and third-party data handling.
Incident response readiness
Document what happens if taxpayer data is stolen, systems are encrypted, or email accounts are compromised.
IRS and FTC gap assessment
Translate published expectations into a prioritized readiness view for your specific firm environment.
Roadmap and documentation support
Get practical next steps, WISP improvement guidance, and an annual review checklist management can use.
Technical Areas Reviewed
WISP readiness depends on security controls that work in production.
The review connects documentation to real-world controls across email, endpoints, cloud platforms, vendors, backups, and incident response.
Microsoft 365 or Google Workspace
Email, collaboration, external sharing, identity controls, MFA, tenant security settings, audit logs, and admin access.
Phishing and business email compromise
Mailbox rules, impersonation defense, user awareness, attachment protection, DMARC readiness, and reporting workflow.
MFA and conditional access
Access protection for email, portals, admin accounts, remote tools, tax applications, and vendor support access.
Endpoint protection and EDR
Workstations, laptops, ransomware controls, encryption, patching, asset accountability, and endpoint monitoring.
Backup and disaster recovery
Recovery time expectations, restore testing, ransomware-safe backups, and continuity during tax season.
Firewall, Wi-Fi, and remote access
Network boundaries, guest access, VPN, secure remote administration, and office or home-office risk.
Secure file sharing and portals
Reduce risky email attachments and improve controlled data exchange with clients, staff, and vendors.
Tax software and vendor access
Security settings, permissions, support access, service provider oversight, and third-party risk evidence.
Logging and monitoring
Visibility into account misuse, suspicious sign-ins, policy changes, mailbox activity, and annual review evidence.
Assessment Process
Four steps from WISP uncertainty to a practical improvement plan.
Review Current State
Collect existing WISP documents, policies, system information, data flows, vendor lists, and security evidence.
Assess Controls
Review Microsoft 365, endpoints, remote access, backups, tax software, vendors, incident response, and monitoring.
Identify Gaps
Document missing controls, weak evidence, outdated procedures, unclear ownership, and high-risk technical issues.
Build Roadmap
Prioritize remediation, WISP updates, annual review tasks, evidence improvements, and management next steps.
Free Self-assessment Tool
Start with the free IRS WISP readiness assessment.
Not sure where your tax or accounting firm stands? The free IRS WISP Compliance Readiness Assessment gives you a simple starting score and highlights common gaps across governance, taxpayer data inventory, MFA, email security, endpoint protection, backup, vendors, and incident response.
The tool is for initial guidance only. It does not replace a professional cybersecurity audit, compliance assessment, penetration test, technical validation, legal review, or tax compliance review.
Official Guidance References
Useful IRS and FTC resources for WISP planning.
OC Security Audit can help interpret these resources as cybersecurity readiness and documentation work, but legal, tax, or final regulatory interpretation should come from qualified counsel or tax professionals.
After The WISP Assessment
From WISP findings to secure IT operations.
OC Security Audit identifies WISP, compliance, risk, and evidence gaps. When remediation requires implementation or ongoing IT operations, IT Perfection can support related technical controls, managed IT, Microsoft 365, endpoint, backup, and infrastructure support.
Microsoft 365 support
For mailbox security, MFA rollout, admin cleanup, conditional access, audit logging, and collaboration controls.
Endpoint and device support
For laptop hardening, patching, encryption, endpoint protection, EDR, and user device management.
Backup and resilience
For secure backups, restore testing, disaster recovery planning, and tax-season continuity support.
Managed IT follow-through
For help desk, monitoring, patching, vendor coordination, network support, and recurring maintenance.
WISP Guidance From A CISO
Work with Ali Hassani, CISO.
Ali Hassani brings 25+ years of IT, cybersecurity, compliance, Microsoft 365, firewall, backup, network security, and risk assessment experience to IRS WISP readiness work. His practical background helps tax and accounting firms connect written documentation with actual configurations, user workflows, vendor access, backup design, and incident response expectations.
CPA And Tax Firm Security Pathways
Connect The WISP To The Controls That Protect Taxpayer Data.
A Written Information Security Plan is stronger when it maps to real Microsoft 365, endpoint, backup, firewall, ransomware, vendor, and incident response controls. These pages help tax and accounting firms connect WISP documentation with practical security evidence.
CPA / Tax Firm Security
Cybersecurity Audit for CPA Firms & Tax Preparers
Use this service page when the firm needs a professional review of taxpayer-data risks, Microsoft 365, backups, ransomware, WISP evidence, and remediation priorities.
CPA / Tax Firm Security
Accounting Firm Cybersecurity Hub
Start with the broad CPA, accounting, and tax-preparer cybersecurity roadmap before drilling into WISP, Microsoft 365, ransomware, and response planning.
CPA / Tax Firm Security
FTC Safeguards Rule for Accounting Firms
Review GLBA/Safeguards Rule concepts such as risk assessment, access control, MFA, encryption, monitoring, vendor oversight, and evidence.
CPA / Tax Firm Security
Microsoft 365 Security Audit for Accounting Firms
Review identity, email, SharePoint, OneDrive, Teams, admin roles, logging, and device access for firms handling tax and client files.
CPA / Tax Firm Security
CPA Firm Cybersecurity Checklist
Organize the control review across WISP, MFA, email, endpoints, backups, firewall, vendors, tax software, and audit evidence.
CPA / Tax Firm Security
Tax Season Ransomware Readiness
Validate backup recovery, endpoint protection, remote access, Microsoft 365 security, continuity, and tax-season response readiness.
CPA / Tax Firm Security
Accounting Firm Incident Response Plan
Prepare for ransomware, mailbox compromise, lost devices, taxpayer data exposure, cyber insurance coordination, and client communication decisions.
When WISP or audit findings require implementation support, IT Perfection can help with related Microsoft 365 administration, endpoint security support, and backup and disaster recovery.
Related Compliance Resources
Continue the compliance and risk readiness path.
Compliance consulting
Explore broader compliance readiness services for organizations managing security, evidence, and audit pressure.
Cyber insurance readiness
Review controls insurers often ask about, including MFA, backup, EDR, incident response, and vendor risk.
NIST CSF
Use a recognized cybersecurity framework to organize identify, protect, detect, respond, and recover activities.
SOC 2 and vendor requests
Prepare for customer security reviews, vendor questionnaires, SOC 2 readiness, and evidence collection.
IRS WISP FAQ
Common questions from tax preparers, CPAs, and accounting firms.
What is IRS WISP?
IRS WISP stands for Written Information Security Plan. It is a written plan that explains how a tax or accounting firm protects taxpayer and client information through administrative, technical, and physical safeguards.
Who needs a Written Information Security Plan?
Tax preparers, CPA firms, accounting firms, bookkeepers, payroll providers, enrolled agents, and other organizations that handle taxpayer information should evaluate whether they need a documented WISP and related supporting controls.
Is a WISP only a document?
No. A WISP should reflect real security ownership, risk assessment, access control, training, vendor oversight, backup, incident response, and review practices. A document without working controls is not enough.
Can I use a template?
A template can help you get started, but it should be customized to your actual systems, software, staff workflows, vendors, data handling, and security responsibilities.
What systems should be reviewed?
Common review areas include Microsoft 365 or Google Workspace, tax software, client portals, laptops, workstations, remote access, backup systems, firewalls, Wi-Fi, vendor access, and secure file sharing practices.
How often should a WISP be updated?
At minimum, it should be reviewed regularly and updated when there are material changes in systems, staff, workflows, vendors, risks, or business operations. Annual review is a practical baseline for many firms.
Does OC Security Audit provide legal advice?
No. OC Security Audit provides cybersecurity, risk, and compliance readiness support. Legal advice, tax advice, and final regulatory interpretations should come from qualified legal or tax professionals.
Can OC Security Audit help improve Microsoft 365 and email security for tax firms?
Yes. OC Security Audit can help identify gaps in MFA, email protection, forwarding controls, conditional access, endpoint security, backup resilience, and broader cybersecurity readiness that support a stronger WISP program.
Need Help Preparing Your IRS WISP?
Build a practical Written Information Security Plan and taxpayer data security roadmap.
OC Security Audit can help your tax, CPA, accounting, bookkeeping, or payroll firm assess cybersecurity gaps, document a practical WISP, and create a prioritized remediation plan.