1. Introduction – What is Publication 5709?
IRS Publication 5709, titled “How to Create a Written Information Security Plan for Data Safety,” is an official guide designed to help tax professionals protect sensitive taxpayer data from identity thieves and cyber threats. A Written Information Security Plan, commonly called a WISP, is a formal written document that outlines the administrative, technical, and physical safeguards a tax office uses to keep customer information safe.
In 2026, the IRS and its Security Summit partners reaffirmed the critical need for data protection across the tax community. Following major updates highlighted in IRS Tax Tip 2026-49 released on June 16, 2026, and the Security Summit bulletin IR-2026-92 on August 18, 2026, the IRS published renewed guidance with official webpage reviews finalized in October 2026. These 2026 updates emphasize stricter compliance with the Federal Trade Commission (FTC) Safeguards Rule, including mandatory notification protocols for data breaches affecting 500 or more individuals.
Having a WISP is not an optional best practice; it is a federal legal requirement for anyone handling client tax records. Publication 5709 distills complex cybersecurity mandates into straightforward action steps, making data protection accessible for solo practitioners and large accounting firms alike.
2. Who Should Read This Publication
Publication 5709 is essential reading for anyone who prepares taxes or manages financial data for clients. Under federal law, independent tax preparers, enrolled agents, certified public accountants (CPAs), and bookkeeping firms are classified as financial institutions.
You should review and implement Publication 5709 if you belong to any of the following groups:
- Solo tax preparers and seasonal preparers operating home-based or storefront practices.
- Small to mid-sized accounting and bookkeeping firms.
- Software developers, electronic return originators (EROs), and tax service providers.
- Office managers and designated security coordinators responsible for firm technology and compliance.
- Accounting students and aspiring tax professionals preparing to establish an independent practice.
3. Key Topics Covered
Publication 5709 provides a concise roadmap for building and maintaining an effective data defense system. It focuses on practical measures that can be tailored to the size and complexity of any tax business.
The primary topics covered within the publication include:
- Legal Mandates: Understanding federal requirements established by the Gramm-Leach-Bliley Act (GLBA) and the FTC Safeguards Rule.
- Core Security Pillars: Managing employee security practices, securing electronic information systems, and handling unexpected system failures.
- Program Coordination: Designating a responsible individual to oversee firm-wide information security.
- Risk Assessment: Identifying potential internal and external vulnerabilities that could expose client records.
- Incident Response: Crafting a step-by-step emergency plan in the event of data theft, hacking, or natural disasters.
4. Detailed Breakdown of Main Concepts
To implement Publication 5709 successfully, tax preparers need to understand three core operational areas: employee management, information systems, and system failure detection.
Employee Management and Training
Human error remains one of the largest sources of data breaches. Publication 5709 requires firms to designate at least one qualified employee or coordinator to manage security policies. All staff members, including seasonal receptionists, must receive regular training on identifying phishing scams, recognizing suspicious emails, and handling customer files securely.
Information Systems Security
Information systems refer to the hardware, software, networks, and storage devices used in day-to-day operations. Publication 5709 outlines specific technical controls to protect these tools:
| Security Area | Required Safeguard | Purpose |
|---|---|---|
| Access Controls | Multi-Factor Authentication (MFA) & Strong Passwords | Prevents unauthorized access even if login credentials are stolen. |
| Data Storage | Drive and File Encryption | Renders taxpayer records unreadable if a laptop or drive is lost or stolen. |
| Network Defense | Firewalls & Antivirus Software | Blocks malicious network traffic and detects malware infections in real time. |
| Vendor Oversight | Service Provider Contracts | Ensures third-party cloud providers meet strict data security standards. |
Detecting and Managing System Failures
Even robust systems can experience disruptions from ransomware attacks, hardware breakdowns, or natural disasters like floods and fires. Publication 5709 instructs professionals to maintain encrypted, offsite data backups and test them regularly. It also stresses having a clear incident response procedure so staff members know exactly who to call when unusual activity occurs.
5. Practical Examples or Scenarios
Applying the guidelines in Publication 5709 is easier when viewed through everyday workplace situations.
Scenario 1: The Phishing Email at a Solo Practice
Jane runs a solo tax practice and receives an email appearing to come from her tax software provider asking her to update her account credentials. Because Jane established a WISP based on Publication 5709, she checks her firm policy before taking action. Instead of clicking the link, she logs in directly through the provider’s official portal, discovers no such request exists, and avoids falling victim to a credential-harvesting scam.
Scenario 2: The Stolen Work Laptop
An employee at a local bookkeeping firm has their laptop stolen from a vehicle while visiting a client. Under the firm’s Publication 5709-compliant plan, all company laptops are configured with full-disk encryption and remote wiping capabilities. The firm immediately initiates a remote wipe and verifies that unauthorized individuals cannot access taxpayer files, preventing a reportable client data breach.
6. How This Publication Relates to Specific Forms
While Publication 5709 itself is an informational guide rather than a tax return, it directly connects to several vital IRS applications and reporting forms.
Form W-12 (IRS PTIN Application and Renewal)
When tax preparers apply for or renew their Preparer Tax Identification Number (PTIN) using Form W-12, they must confirm under penalty of perjury that they are aware of their legal responsibility to have a data security plan in place. Publication 5709 provides the exact guidelines needed to meet this certification truthfully.
Form 8633 (Application to Participate in IRS e-file)
Firms applying for an Electronic Filing Identification Number (EFIN) via Form 8633 must adhere to IRS security requirements. Failure to protect e-file credentials or maintain a WISP can lead to suspension or revocation of an EFIN, effectively shutting down a firm’s ability to transmit returns electronically.
Form 14039 (Identity Theft Affidavit)
When a client’s tax data is compromised, tax professionals often help them file Form 14039 to alert the IRS of potential identity theft. Having a documented WISP reduces the risk of reaching this stage and outlines emergency procedures if client information is inadvertently compromised.
7. Common Misunderstandings Clarified
Many tax preparers delay writing their data security plan because of persistent myths. Here are the facts behind common misconceptions:
- Misunderstanding: “My firm is too small; WISPs are only for big accounting corporations.”
Fact: Federal regulations apply equally to solo operators, home-based tax preparers, and large multi-partner practices. - Misunderstanding: “A WISP is just a template you download, sign, and file away in a drawer.”
Fact: A WISP is an active, living document that must reflect your actual office software, hardware, vendors, and procedures. - Misunderstanding: “Antivirus software on my computer is enough to keep me compliant.”
Fact: Antivirus software is only one technical component; a WISP also requires employee rules, physical office locks, vendor screening, and disaster recovery plans.
8. Why This Publication Matters for Taxpayers
For individual taxpayers, Publication 5709 is the invisible shield protecting their most confidential personal details. Tax returns contain names, Social Security numbers, dates of birth, home addresses, bank account numbers, and complete income histories.
When tax professionals implement the recommendations in Publication 5709, they minimize the threat of fraudulent tax refunds, stolen identities, and financial account takeovers. Knowing that a tax preparer actively maintains a written security plan gives clients confidence that their sensitive family information is handled with the highest level of care.
9. Frequently Asked Questions
Is creating a WISP legally required?
Yes. Under the Gramm-Leach-Bliley Act and the FTC Safeguards Rule, all professional tax preparers and accountants are legally required to maintain a written information security plan.
How often should a firm update its security plan?
A WISP should be reviewed and updated at least once every calendar year. Additionally, you must update the plan whenever you make significant operational changes, such as adopting new software, moving office locations, or hiring new staff.
What is the difference between Publication 5708 and Publication 5709?
Publication 5709 provides an overview and educational guidance on what a WISP is and why it matters. In contrast, Publication 5708 serves as an extensive, 28-page practical template that firms can fill out and customize to build their written plan.
What must a tax pro do if a data breach occurs?
If client data is compromised, tax professionals must immediately contact their local IRS Stakeholder Liaison, notify state tax agencies, and inform affected clients. Under updated 2026 FTC rules, breaches impacting 500 or more consumers must also be reported directly to the FTC within 30 days of discovery.
10. Conclusion
IRS Publication 5709 serves as an indispensable roadmap for modern tax practices operating in an increasingly digital world. With federal scrutiny increasing and cybersecurity threats growing more sophisticated through 2026, maintaining an active Written Information Security Plan is no longer just good business—it is a legal necessity.
By reviewing Publication 5709, designating a security lead, training staff, and regularly updating technical safeguards, tax professionals can fulfill their professional duties and ensure their clients’ financial data remains thoroughly protected.
