IRS, Security Summit stress data security plan requirement for tax professionals

Traders Union
All News
Financial News
IRS data security plan

Highlights

Tax and accounting professionals must create and maintain a Written Information Security Plan (WISP) to comply with IRS and Gramm-Leach-Bliley Act requirements.
Firms must designate coordinators, assess risks, monitor safeguards, require secure service providers, and review WISP regularly per Federal Trade Commission directives.
Financial institutions must report security events affecting 500 or more individuals to the FTC generally within 30 days, increasing compliance burdens for the sector.

Federal requirement and compliance steps

As reported by the Internal Revenue Service, tax and accounting professionals must create and maintain a Written Information Security Plan, or WISP, to help shield client records from identity theft and data breaches. The agency says it provides publications and other resources to help firms develop, test and update those plans.

The reminder forms part of the third release in a five-part summer series on tax professional security under the “Protect Your Clients; Protect Yourself” campaign. The IRS and its Security Summit partners say the campaign is designed to give firms timely guidance for protecting sensitive taxpayer data and business operations.

Under the Gramm-Leach-Bliley Act, tax and accounting professionals are treated as financial institutions and must implement a data security plan. The Federal Trade Commission requires firms to assign employees to coordinate the program, assess risks to customer information, monitor and test safeguards, and use service providers whose contracts require appropriate protections.

Industry focus as forum tour continues

A WISP should cover employee management and training, information systems, and the detection and handling of system failures. Firms are legally required to keep the plan in written and accessible form, and should review and update it regularly based on operational changes and security testing results.

The IRS also recommends that firms prepare a response plan for data theft incidents, including contacting an IRS Stakeholder Liaison after a security event. Tax professionals can also notify the appropriate state tax agency through the Federation of Tax Administrators’ data breach reporting page.

Security reporting duties under the FTC’s Safeguards Rule are also part of the broader compliance burden for the sector. Covered financial institutions must report certain security events affecting 500 or more people to the FTC, generally within 30 days of discovery.

Our earlier coverage of the IRS “no tax on overtime” deduction explained how updated guidance for the 2026 tax year is meant to simplify filing by shifting key reporting to employers through W-2 forms. We also outlined who qualifies, the deduction limits and phaseouts, and how the benefit applies only to the overtime premium portion under the Fair Labor Standards Act.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.