IRS Reminder on Written Information Security Plan
Tax practitioners were reminded that they are required to maintain a written information security plan (WISP) to protect client information from identity theft and data breaches. IRS Publication 5708 provides a template and guidance.
By William R. Stromsem, CPA, J.D., George Washington University School of Business
On August 18, the IRS reminded tax practitioners that they are required to have and maintain a written information security plan (WISP). This requirement is intended to protect client information from identity theft and data breaches, and focuses on employee management and training, information systems, and detecting and managing system failures.
There aren’t many specific requirements for the plan other than that it be in writing. The IRS provides a template that can be the starting point for customizing the plan to your practice. As part of the security plan, practitioners are required to:
- Designate one or more employees to coordinate the information security program.
- Identify and assess risks to customer information in relevant areas of the company's operation and evaluate the effectiveness of safeguards.
- Create, implement and regularly monitor and test security safeguards.
- Select service providers that can maintain appropriate safeguards and ensure their contracts require compliance.
IRS Publication 5708, Creating a Written Information Security Plan for Your Tax & Accounting Practice, includes the template and complete details.
Topics:
