How to Fill In the IRS WISP Template for a Small Firm

The sample template in Publication 5708 starts with a cover page that carries the date you last reviewed the plan. It then asks you to name a Data Security Coordinator, who runs the plan, and a Public Information Officer, who handles outside communication if there is an incident. In a one- or two-person firm these can be the same person.

The middle sections cover risks inside the firm (what client information you collect and keep, who is accountable for it, when it may be shared, and what counts as a reportable event) and outside it (your network, who can log in to what, how you send client files, and Wi-Fi). It ends with sign-offs and short policies on remote access, connected devices and staff training.

Use real names, real tools and real habits. "Client files are stored in our practice software and our business cloud drive; staff log in with their own accounts and a second sign-in step" is useful. "We follow industry best practices" is not, and it will not help you when a client or insurer asks a pointed question.

Where you do not do something yet, write it down with a date: "multi-factor sign-in on the email account by the end of the month". A plan that names its own gaps is more useful to you than one that pretends there are none.

The sample template has no section for AI tools, and most firms now use at least one, often inside software they already pay for. Add a short section: which AI tools are in use, which accounts they run on (firm or personal), whether client tax or payroll data may go into them, and who approves a new tool.

This is the same list a client AI questionnaire asks for, so writing it once covers both. The free AI tool list below takes about 10 minutes and gives you a first draft of that section.

The template asks for a review at least once a year. Review it sooner when you add a tool, a staff member or a new way of sending client files. Put the next review date on the cover page so it is not forgotten.

The IRS also reminds firms that a security event affecting 500 or more people is generally reported to the FTC within 30 days of discovery. Your incident steps should say who makes that call.

This guide explains how to use the IRS template. It is not legal advice. Whether a particular rule applies to your practice, and whether your plan is enough for it, are questions for your attorney or a qualified professional.