Periodically, the IRS will remind tax professionals of the critical need to safeguard client information. And most recently, on August 9th, it was announced that Publication 5708, “Creating a Written Information Security Plan for your Tax & Accounting Practice” had been updated. That document provides a template for a Written Information Security Plan (bearing the unfortunate acronym WISP) that is designed to help tax professionals, particularly smaller practices, in minding their responsibilities. Publication 5708 is produced by the Security Summit, a partnership of the Internal Revenue Service, state tax agencies, private-sector tax groups as well as tax professionals. Not surprisingly, the update is intended to respond to increasing levels of identity theft and data breaches.
Since 1999, with the enactment of the Gramm-Leach-Bliley Act, tax and accounting professionals have been statutorily obligated to protect client data. In its implementation of this law, the Federal Trade Commission issued measures required to keep customer data safe, and one requirement is implementing a WISP. Despite the decades, many practitioners remain blissfully unaware of the requirement to develop a written plan that describes how their firm is prepared to protect clients’ nonpublic Personally Identifiable Information (PII), including Social Security numbers, dates of birth, employment data, driver’s license number, income data, asset ownership data, Investment data, financial account numbers, personal identification numbers or passwords, email addresses, and non-listed phone numbers.
The update includes best practices for implementing multi-factor authentication for any individual accessing any information system. Further, it is recommended the WISP include a data theft response strategy, which includes alerting of the Federal Trade Commission and the IRS Stakeholder Liaison after a security incident involving the theft or loss of PII affecting 500 or more people.
While the official pronouncements express hope of making the process of developing a WISP easier, no one should be deceived into thinking it will be a simple cut-and-paste affair. The template is twenty-eight pages of rather detailed requirements. It will take more than a Friday afternoon.
