Introduction – What is Publication 5708?
IRS Publication 5708, titled “Creating a Written Information Security Plan for your Tax & Accounting Practice,” is an official government guide designed to help tax professionals safeguard client data. It provides an actionable roadmap and a customizable template for creating a Written Information Security Plan, commonly known as a WISP. The document helps tax professionals comply with federal data protection laws while guarding against identity theft and ransomware attacks.
The IRS and its Security Summit partners renewed national focus on Publication 5708 throughout 2026. Official guidance released in June 2026 (IRS Tax Tip 2026-49) and July 2026 (Office of Professional Responsibility Bulletin 2026-22) emphasized that cybersecurity compliance is a strict professional responsibility. Most recently, on August 18, 2026, the IRS issued News Release IR-2026-92, reminding all tax preparers that maintaining an active WISP is a mandatory federal requirement, not an optional suggestion.
Under the active Publication 5708 guidelines reaffirmed across 2026, tax professionals must implement firm-wide multi-factor authentication and maintain rigorous incident response procedures. Firms must also report any cybersecurity breach affecting 500 or more clients to the Federal Trade Commission within 30 days. This publication translates complex federal security rules into manageable steps for everyday tax businesses.
Who Should Read This Publication
Publication 5708 is written primarily for anyone engaged in the business of preparing tax returns or offering accounting services. This includes Certified Public Accountants (CPAs), Enrolled Agents (EAs), licensed attorneys, registered tax return preparers, and bookkeeping staff. Even independent bookkeepers who gather client tax documents fall under its guidance.
Solo practitioners and small seasonal offices especially need to read this publication. Many small tax firms mistakenly believe cybersecurity rules only apply to large accounting firms or national banking institutions. In reality, independent preparers are prime targets for cyber criminals and must follow the exact same federal security benchmarks.
General taxpayers and curious students will also benefit from understanding Publication 5708. Reading through the guide helps clients understand what security protocols legitimate preparers should have in place before handing over sensitive personal and financial details.
Key Topics Covered
Publication 5708 covers all essential ingredients required to design, deploy, and maintain an effective data defense policy. The guide is structured around the standards set by the Federal Trade Commission (FTC) Safeguards Rule under the Gramm-Leach-Bliley Act.
- Program Coordination: Appointing a designated manager or qualified individual to take ownership of security.
- Risk Assessment: Identifying internal and external vulnerabilities where taxpayer data could be leaked or stolen.
- Safeguard Design: Establishing technical, physical, and administrative barriers to stop unauthorized access.
- Service Provider Oversight: Ensuring third-party vendors and cloud providers maintain matching security standards.
- Incident Response & Notification: Outlining the exact steps to take if a security incident or data breach occurs.
- Plan Maintenance: Regularly evaluating, testing, and adjusting security controls as firm technology evolves.
Detailed Breakdown of Main Concepts
Administrative Safeguards
Administrative safeguards represent the human policies that govern your business. Publication 5708 requires a practice to designate a Data Security Coordinator to manage office policies. This individual ensures that employees receive cybersecurity awareness training on phishing, password management, and safe browsing habits.
These safeguards also require limiting employee access to taxpayer data based strictly on job duties. When an employee leaves the company, their system credentials and physical access must be revoked immediately. Routine audits ensure that team members follow established privacy rules.
Technical Safeguards
Technical safeguards involve the hardware and software systems used to run a tax office. Under Publication 5708, every person accessing tax software or client records must authenticate their identity using multi-factor authentication (MFA). MFA requires at least two verification factors, such as a master password paired with an authenticator app code.
Other essential technical rules include encrypting client files both when stored on hard drives and when sent over the internet. Preparers must install reputable anti-malware software, activate hardware firewalls, and install operating system security patches promptly. Routine data backups should be encrypted and stored offline to defend against ransomware attacks.
Physical Safeguards
Physical security protects paper files, computer screens, and business offices from unauthorized eyes. Publication 5708 advises practitioners to lock physical file cabinets, maintain a clean-desk policy, and position computer monitors away from waiting room windows.
Firms must also control physical visitor access using sign-in sheets or designated reception areas. When disposing of old paper tax folders or broken computer hard drives, practices must use cross-cut shredders or professional physical destruction services to prevent data salvage.
| Security Area | Required Core Action | Primary Objective |
|---|---|---|
| Administrative | Appoint a Data Security Coordinator | Provide clear accountability and staff training. |
| Technical | Deploy Multi-Factor Authentication (MFA) | Block unauthorized logins even if passwords are stolen. |
| Physical | Lock client files and restrict office access | Prevent physical theft or snooping of private tax files. |
| Operational | Maintain an Incident Response Plan | Ensure swift recovery and statutory breach reporting. |
Practical Examples or Scenarios
Scenario 1: The Home-Based Solo Preparer
Maria runs a solo tax practice from a dedicated home office. Because she works alone, she names herself the Data Security Coordinator in her WISP. She secures her home Wi-Fi with a complex WPA3 password, separates client work onto a password-protected business laptop, and uses cloud tax software with mandatory MFA.
When family members visit, Maria locks her office door and ensures her computer screen automatically locks after two minutes of inactivity. By adapting the Publication 5708 template to her small workspace, Maria maintains full compliance without buying unnecessary enterprise hardware.
Scenario 2: Managing a Phishing Email at a Mid-Sized Firm
An administrative assistant at a five-person accounting firm clicks a suspicious link inside an email posing as the state tax agency. Because the firm adopted a WISP based on Publication 5708, the assistant immediately alerts the firm’s Data Security Coordinator rather than hiding the mistake.
The coordinator disconnects the computer from the local network, runs a deep malware scan, and forces a password reset across all company accounts. Thanks to their documented response protocol, the firm stops a potential network intrusion before any taxpayer information is extracted.
How This Publication Relates to Specific Forms
Publication 5708 directly impacts the annual licensing and registration requirements of tax professionals. When tax preparers apply for or renew their Preparer Tax Identification Number (PTIN) using Form W-12, they face a specific compliance question regarding data security. Preparers must check a box affirming under penalty of perjury that they have a written data security plan in place.
The publication also connects to IRS e-Services account management and Form 8633 (Application to Participate in the IRS e-file Program). Electronic Return Originators (EROs) must follow the safeguarding guidelines of Publication 1345, which directly mirrors the baseline principles outlined in Publication 5708. Without an active WISP, an Electronic Filing Identification Number (EFIN) can be suspended or revoked.
In the event of an unavoidable data breach, Publication 5708 guides preparers on how to contact IRS Stakeholder Liaisons and notify the Federal Trade Commission. It also provides the framework needed to comply with Internal Revenue Code Section 7216, which imposes criminal penalties for the unauthorized disclosure of tax return information.
Common Misunderstandings Clarified
The most common misconception is that a WISP is a form you fill out and mail to the IRS. In reality, Publication 5708 provides a guide and template for your internal business records. You do not send your completed WISP to the IRS; you keep it securely in your office and produce it if audited or investigated by regulators.
Another dangerous myth is that relying on commercial anti-virus software or cloud tax software satisfies the legal requirements. While cloud tools handle their own server security, you remain legally responsible for the endpoint computers, passwords, and paper folders in your office. Software alone cannot replace a comprehensive written policy.
Finally, many preparers assume a WISP can be drafted once and filed away forever. The IRS and FTC require that security plans remain living documents. You must review and revise your plan annually, or whenever you change software vendors, move offices, or alter administrative procedures.
Why This Publication Matters for Taxpayers
Taxpayers share their most confidential information with tax professionals, including Social Security numbers, dates of birth, bank account details, and annual income figures. If this information falls into criminal hands, thieves can file fraudulent refund claims, open credit cards, or drain investment accounts.
Publication 5708 provides taxpayers with confidence that their tax preparer takes privacy seriously. When tax offices implement the safeguards detailed in this publication, they shield clients from identity theft and devastating financial disruption. Choosing a preparer who understands and enforces Publication 5708 ensures your private data receives the professional defense it deserves.
Frequently Asked Questions
Is having a Written Information Security Plan legally required?
Yes. Under the federal Gramm-Leach-Bliley Act and the FTC Safeguards Rule, tax preparers are classified as financial institutions. Creating, maintaining, and updating a written security plan is a strict federal requirement for all PTIN holders.
Do I need to hire an expensive cybersecurity consultant to create a WISP?
No. Publication 5708 includes a clear 28-page framework and sample template specifically designed for smaller practices. Solo preparers and small firms can customize this template to fit their specific office environment without spending thousands of dollars.
What should I do if my tax practice suffers a data breach?
You should immediately report the breach to your local IRS Stakeholder Liaison, state tax authorities, and the FTC. If the breach compromises customer information belonging to 500 or more consumers, federal regulations require reporting to the FTC within 30 days of discovery.
Can I keep my WISP purely as a digital file?
Yes, you can keep your WISP as a digital document such as a PDF or Word file. However, you should store both an encrypted digital backup and a printed physical copy in a secure location so it remains accessible during a computer failure or power outage.
Conclusion
IRS Publication 5708 provides an indispensable blueprint for protecting client records in an increasingly complex digital landscape. By breaking down federal cybersecurity regulations into clear administrative, technical, and physical safeguards, the IRS gives tax professionals the exact tools they need to stay compliant.
Whether you manage a multi-state accounting practice or file tax returns from a home office, having an updated security plan is both good business and federal law. Review Publication 5708 today, customize your plan, and ensure your practice remains safe against evolving cyber threats.
