The WISP cost for a small tax practice is mostly staff time, plus the tools the plan says the firm runs, such as multi-factor authentication, encrypted email and file sharing, backups, anti-malware and activity logs. A WISP, or written information security plan, is the written security program the FTC Safeguards Rule (16 CFR Part 314) requires of tax preparers, and IRS Publication 5708 is the IRS guide to creating one.
Firms that hold customer information on fewer than 5,000 consumers are exempt from four of the rule’s requirements under 16 CFR 314.6. This post sets out what each component involves, what the firm still owns and what a single tool can include, without quoting prices.
What goes into the WISP cost of writing the plan?
Writing a WISP takes the firm’s time more than outside spending. The work is naming a Qualified Individual, the person responsible for the security program, then describing systems and data, assessing risks and writing down the controls. How long that takes depends on how many people, systems and vendors the plan has to cover.
Some firms ask an outside IT provider or consultant to draft or review the plan, which is a choice rather than a requirement. What the FTC Safeguards Rule requires is a program with safeguards “appropriate to your size and complexity” (16 CFR 314.3(a)) that covers the elements in 314.4. A plan that describes safeguards the firm does not actually run creates problems later, in findings or incidents, that an accurate short plan avoids.
Which Safeguards Rule items does a small practice avoid?
16 CFR 314.6 exempts firms that maintain customer information on fewer than 5,000 consumers from four items: the written risk assessment criteria (314.4(b)(1)), continuous monitoring or annual penetration testing (314.4(d)(2)), the written incident response plan (314.4(h)) and the annual report to the board (314.4(i)).
Penetration testing and continuous monitoring are the items a small practice is most likely to need an outside provider for, so the exemption matters. The rest of 314.4 still applies, including encryption, multi-factor authentication (MFA), logging, training and vendor oversight. IRS Publication 5708 still includes breach procedures as an attachment, and IRS Publication 1345 (Rev. 12-2025) still requires e-file providers to report incidents by the next business day.
What recurring work does a WISP commit a practice to?
A WISP commits a practice to the staff time and tools behind each required element of 16 CFR 314.4, from the Qualified Individual’s oversight to encryption, access management, MFA, logging, testing, training and vendor review. The table lists each component, its citation, whether it applies below 5,000 consumers and where PreVeil fits.
Items marked firm responsibility are work the practice owns whatever tools it buys.
How does tool choice change the WISP cost?
Tool choice changes how much of a WISP one vendor covers and how much the firm has to document and review. A tool that handles encryption, access controls and activity logs in one place means one vendor to review, one section of the WISP to write and one place to look during an incident.
A single PreVeil Business license includes:
- one platform for encrypted email and file sharing, rather than a client portal plus a separate email tool
- free recipients, with no per-recipient fees
- 10TB of storage per organization, with more available, and no file size limit on PreVeil Drive
- encryption inside the Outlook and Gmail the firm already uses
- deployment in hours, with no IT project
- the admin console and activity logs the plan can point to
That is why PreVeil fits a small practice’s budget and workflow. With PreVeil, clients read and reply for free from their browser after a one-time sign-up, and their replies stay encrypted. Encrypted replies cut the rework of resending documents and chasing plain-email replies that fall outside the plan.
What does a solo preparer’s WISP need to cover?
A solo preparer covers the same categories on a smaller scale: time to write and review the plan, MFA on every system with client data, encrypted client exchange, backups, anti-malware and a way to show activity. PreVeil sells the Business plan as a single license, so a solo practice gets the admin console and activity logs without buying seats it does not need.
On Form W-12 (Rev. October 2025) line 11, the preparer acknowledges at every preparer tax identification number (PTIN) application and renewal, under penalties of perjury, the legal duty to create and maintain a WISP. The PTIN renewal cycle is therefore a natural point for the annual review.
What does it cost to get the WISP wrong?
The cost of a WISP gap is harder to plan for than the cost of the program. IRS Publication 1345 makes safeguarding taxpayer data an obligation of every Authorized IRS e-file Provider, and under 16 CFR 314.4(j), a notification event involving 500 or more consumers must be reported to the FTC within 30 days of discovery.
Encryption changes a firm’s exposure under the rule. Under 16 CFR 314.2(m), a notification event involves unencrypted customer information, and data counts as unencrypted if the key was accessed by an unauthorized person. PreVeil cannot access or decrypt customer data, because the encryption keys stay on users’ devices.
The IRS Publication 4557 guide covers the plan itself. For each Safeguards Rule requirement by section, see FTC Safeguards Rule for tax and accounting firms.
Frequently asked questions
How much does a WISP cost?
Writing a WISP mostly costs staff time, and IRS Publication 5708 is the IRS guide to creating one. The ongoing cost is the tools and time behind each safeguard the plan describes.
Does a small tax practice need penetration testing?
Not if the practice maintains customer information on fewer than 5,000 consumers. 16 CFR 314.6 exempts those firms from 314.4(d)(2), along with three other items.
Is encrypted email required for a WISP?
16 CFR 314.4(c)(3) requires encryption of customer information in transit and at rest, and IRS Publication 4557 advises preparers to encrypt sensitive files and emails. Alternative controls are allowed only if encryption is infeasible and the Qualified Individual approves them.
What does a PreVeil Business license include for a solo preparer?
One PreVeil Business license covers encrypted email and file sharing on one platform, free recipients with no per-recipient fees, 10TB of storage per organization and the admin console and activity logs. PreVeil works inside Outlook and Gmail and deploys in hours.
Can PreVeil read client data?
No. PreVeil cannot access or decrypt customer data, because the encryption keys stay on users’ devices.
Request a demo
A demo shows what a single PreVeil Business license covers in a small practice’s WISP, from encrypted client email to activity logs. Request a demo
