CPA & Tax Firm WISP Checklist

Who this checklist is for

CPA firms, tax preparers, and bookkeeping practices that hold taxpayer data. Paid preparers attest to having a WISP when they renew their PTIN, and the FTC Safeguards Rule applies to tax preparation firms.

What's inside

The checklist is a one-page PDF with ten controls. Each has a Pass / Gap box so you can mark it up in a team meeting:

1. Qualified Individual and a live WISP (16 CFR 314.4(a)). Name the person responsible for the program and keep the WISP current, not a one-time template.
2. MFA on tax and hosting portals (16 CFR 314.4(c)(5)). Require MFA, preferably phishing-resistant FIDO2/WebAuthn, on Microsoft 365, tax software, client portals, and remote access.
3. Fast patching of internet-facing systems. Patch VPNs, firewalls, and remote-desktop gateways quickly when vulnerabilities appear on CISA's Known Exploited Vulnerabilities (KEV) list.
4. 24/7 monitoring and endpoint isolation. Detect and contain compromised devices and sessions, especially during tax season.
5. FTC breach-notification readiness. Keep the logs you need to tell whether unencrypted customer information was taken. The FTC must be notified within 30 days of discovering an event involving 500 or more consumers.
6. Tax-season change freeze. Avoid disruptive maintenance during filing peaks while keeping emergency security fixes moving.
7. Immutable backups with tested restores. Keep backups that survive an admin-account compromise, and test restores on a schedule.
8. Immediate offboarding. Revoke access to tax portals, IRS e-Services, client portals, and Microsoft 365 as soon as staff or seasonal preparers leave.
9. Encryption in transit and at rest. Encrypt laptops and block unencrypted email of W-2s, K-1s, and returns.
10. Testing (16 CFR 314.4(d)(2)). Run an annual penetration test and vulnerability assessments at least every six months, or continuous monitoring.

How to read it

• CISA's KEV due dates under BOD 22-01 bind federal agencies. For private firms, KEV is a prioritization signal, and "within 24 hours" is Emry's recommended target, not a legal deadline.
• The checklist cites a maximum FTC civil penalty of $51,744 per violation. That was the 2024 figure, and the FTC adjusts it for inflation each year.
• IRS Publication 4557 and the IRS/Security Summit WISP template are free starting points for the written plan.

Download

Download the PDF checklist (1 page) →

Related resources

• IT security for CPA and accounting firms
• All resources