Are CPA firms, Enrolled Agents, and seasonal PTIN tax preparers required to have a Written Information Security Plan (WISP)?

Yes. Tax preparation and financial advisory practices of any size—even solo PTIN holders—are classified as financial institutions under the FTC Gramm-Leach-Bliley Act (GLBA) Safeguards Rule (16 CFR Part 314). When renewing a PTIN on IRS Form W-12, paid preparers must affirmatively attest that they are aware of their legal obligation to maintain a data security plan (detailed in IRS Publication 4557 and IRS Publication 5708).

Does the FTC GLBA <5,000-consumer small-firm exception exempt small tax firms from having a WISP or MFA?

No. Under 16 CFR §314.6, practices maintaining information on fewer than 5,000 consumers are exempt only from three specific administrative sub-clauses (certain written risk-assessment formalities, written incident-response plan formalities, and formal annual board reports). Every tax practice—regardless of size—must still maintain a Written Information Security Plan, designate a Qualified Individual (§314.4(a)), enforce multi-factor authentication (MFA), encrypt taxpayer data in transit and at rest, and train all staff.

What does IRC §7216 require for seasonal tax staff, cloud/AI tools, and offshore subcontractors?

IRC §7216 imposes criminal misdemeanor penalties (up to $1,000 fine and 1 year imprisonment per violation, plus IRC §6713 civil penalties) for unauthorized disclosure or use of tax return information. Any use outside permitted Treas. Reg. §301.7216-2 tax-preparation support—including cross-marketing wealth/mortgage services, uploading unmasked returns to consumer AI endpoints, or sending return data offshore—requires a standalone written taxpayer consent meeting strict Treas. Reg. §301.7216-3 formatting and SSN-redaction rules.

Written Information Security Plan (WISP)

Q: Does the FTC GLBA <5,000-consumer small-firm exception exempt small tax firms from having a WISP or MFA?

No. Under 16 CFR §314.6, practices maintaining information on fewer than 5,000 consumers are exempt only from three specific administrative sub-clauses (certain written risk-assessment formalities, written incident-response plan formalities, and formal annual board reports). Every tax practice—regardless of size—must still maintain a Written Information Security Plan, designate a Qualified Individual (§314.4(a)), enforce multi-factor authentication (MFA), encrypt taxpayer data in transit and at rest, and train all staff.

Q: What does IRC §7216 require for seasonal tax staff, cloud/AI tools, and offshore subcontractors?

IRC §7216 imposes criminal misdemeanor penalties (up to $1,000 fine and 1 year imprisonment per violation, plus IRC §6713 civil penalties) for unauthorized disclosure or use of tax return information. Any use outside permitted Treas. Reg. §301.7216-2 tax-preparation support—including cross-marketing wealth/mortgage services, uploading unmasked returns to consumer AI endpoints, or sending return data offshore—requires a standalone written taxpayer consent meeting strict Treas. Reg. §301.7216-3 formatting and SSN-redaction rules.

Practice / Legal Entity: Oakridge Tax & Advisory LLC Effective & Last Reviewed Date: 2026-11-14 Governing Authorities: IRS Publication 5708 · IRS Publication 4557 · FTC GLBA Safeguards Rule (16 CFR Part 314) · IRC §§7216 & 6713

1. Purpose, Scope & Designated Qualified Individual (16 CFR §314.4(a))

This Written Information Security Plan ("WISP") establishes mandatory administrative, technical, and physical safeguards to protect Nonpublic Personal Information ("NPI") and Federal Tax Return Information ("FTI") entrusted to Oakridge Tax & Advisory LLC across all partners, CPAs, Enrolled Agents, seasonal tax preparers, administrative intake staff, and authorized service providers.

WISP Governance Element	Firm Designation & Statutory Standard
Designated Qualified Individual (§314.4(a))	Managing Partner / Security Coordinator (`security@oakridgetax.example`)
Consumer Record Volume Tier	Fewer than 5,000 consumer records (16 CFR §314.6 small-institution scope noted; full MFA, encryption, WISP & IRS Pub. 5708 controls enforced)
Core Tax & Accounting Stack	Intuit ProConnect / Lacerte, QuickBooks Online Accountant, Microsoft 365
Encrypted Client Portal & DMS	TaxDome / SmartVault TLS 1.3 Encrypted Client Portal (Zero email SSN attachments)
Multi-Factor Authentication (§314.4(c)(5))	Microsoft Authenticator / FIDO2 Security Keys enforced across Tax Suite, M365, Portal & RMM

2. Risk Assessment, Asset Inventory & Technical Safeguards (16 CFR §314.4(b)–(c))

Complete Data & Endpoint Inventory: Maintain an up-to-date register of all workstations, seasonal/remote laptops, cloud portals, RMM agents, and backup repositories touching Form 1040/1065/1120/W-2/K-1 data.
Encryption At Rest & In Transit (§314.4(c)(3)): Enforce AES-256 full-disk encryption (BitLocker / FileVault) on every endpoint and TLS 1.2+/1.3 in transit. Sending unencrypted SSNs, W-2s, or K-1s via standard email is strictly prohibited.
Mandatory Multi-Factor Authentication (§314.4(c)(5)): Enforce MFA across all tax software, IRS e-Services / Tax Pro Account, email/M365/Google Workspace, client portals, and remote-access tools.
EFIN & CAF Anti-Hijacking Reconciliation: Reconcile weekly IRS e-Services accepted return counts against internal billing/engagement logs during filing season to detect unauthorized EFIN transmissions immediately.
Secure Disposal & Retention (§314.4(c)(6)): Securely purge/shred customer NPI no later than two (2) years after the last date the information is required for statutory IRS/state tax retention (IRC §6107(b)) or professional liability defense.

3. IRC §7216 Confidentiality, Seasonal Staff & Third-Party Vendor Controls

Criminal & Civil Confidentiality Notice: Every partner, employee, and seasonal admin acknowledges prior to system provisioning that unauthorized disclosure or use of tax return information carries criminal penalties under IRC §7216 and civil penalties under IRC §6713.
Offshore, Affiliate & AI Tool Boundary: Strictly 100% U.S. domestic tax preparation. Offshore transmission of taxpayer records is prohibited. Unmasked client NPI/tax returns may never be pasted into consumer LLM tools; only SOC 2 Type II enterprise Zero-Data-Retention (zero_data_retention: true) domestic tools under Treas. Reg. §301.7216-2 contracts are permitted.
Zero Standing Access After Tax Season: Revoke IdP/SSO, tax-software, client-portal, and API/RMM credentials for departing or post-April-15/October-15 seasonal staff within 4 hours of offboarding.

4. Mandatory Staff Security Awareness Training (16 CFR §314.4(e))

All partners, preparers, and seasonal intake personnel must complete Oakridge Tax & Advisory LLC's annual 2.0-Hour IRS WISP, FTC GLBA Safeguards & IRC §7216 Security Training (including spear-phishing/RMM trojan recognition and Form W-2/organizer verification) prior to accessing live taxpayer files, retaining serial-verified completion certificates in the firm compliance binder.

5. Security Incident & Data-Breach Response Playbook (IRS Pub. 4557 & 16 CFR §314.4(h)/(j))

If unauthorized access, ransomware, EFIN mismatch, or RMM compromise is suspected:

Hour 0–2 (Isolate Without Destroying Evidence): Disconnect affected endpoints from network/Wi-Fi immediately (do NOT wipe or reformat prior to forensic imaging), rotate IdP/tax-software/EFIN credentials, and notify Managing Partner / Security Coordinator (security@oakridgetax.example).
Hour 2–24 (Cyber Insurer & Legal Counsel): Contact cyber liability carrier / breach coach (AICPA / Coalition Cyber Incident 24/7 Hotline).
Within 24–72 Hours (IRS & Law Enforcement): Report taxpayer data exposure immediately to the local IRS Stakeholder Liaison (activating IRS Identity Protection blocks for affected client SSNs), IRS e-help Desk (if EFIN is affected), FBI IC3, and State Attorneys General / State Department of Revenue.
Within 30 Calendar Days (FTC Notification Event — 16 CFR §314.4(j)): If unencrypted customer information of 500 or more consumers was acquired without authorization, submit mandatory electronic notification via the FTC Safeguards Breach Portal within 30 days of discovery alongside state breach notices and IRS Form 14039 guidance for affected taxpayers.

6. Annual Partner & Qualified Individual Sign-Off

Qualified Individual Signature: ___________________________ Date: _____________
Managing Partner / Owner Signature: _______________________ Date: _____________

Template generated via VoraPrep Tax-Firm WISP Studio for compliance planning and professional education; review with firm legal/cyber counsel for state-specific breach notice addenda.

CPA, EA & Tax-Firm Written Information Security Plan (WISP) Builder & Annual Staff Cert

1. Customize Firm WISP Parameters

Written Information Security Plan (WISP)

1. Purpose, Scope & Designated Qualified Individual (16 CFR §314.4(a))

2. Risk Assessment, Asset Inventory & Technical Safeguards (16 CFR §314.4(b)–(c))

3. IRC §7216 Confidentiality, Seasonal Staff & Third-Party Vendor Controls

4. Mandatory Staff Security Awareness Training (16 CFR §314.4(e))

5. Security Incident & Data-Breach Response Playbook (IRS Pub. 4557 & 16 CFR §314.4(h)/(j))

6. Annual Partner & Qualified Individual Sign-Off

2.0-Hour IRS WISP, FTC GLBA Safeguards & IRC §7216 Staff Security Course

Individual Staff Certificate

Annual Firm WISP & Staff Pack

Vora Career Prime