What Is WISP Compliance and Why Does It Matter in 2025?

Written Information Security Plans (WISP) are now mandatory, not optional, for US financial institutions, tax preparers, CPAs, accounting firms, and financial advisors. Driven by the latest FTC Safeguards Rule, IRS mandates, and stricter state laws, robust information security is legally non-negotiable.

Failing a WISP audit can mean lost revenue, steep fines, and reputational harm. Our 2025 WISP compliance guide will help you meet every requirement, pass audits, and confidently serve clients.

‍

Who Must Comply with WISP?

If your organization handles nonpublic personal financial information, you likely fall under the WISP mandate. This includes:

• Professional tax preparers
• CPA and accounting firms
• Financial advisors and planners
• Mortgage lenders/brokers, credit counselors
• Auto dealerships offering financing/leasing
• Retailers with regular credit offerings
• Any company subject to federal or state financial data laws

Important: Activity defines the need for compliance, not just your official industry label.

‍

Core WISP Requirements for Financial Professionals

1. Appoint a Qualified Individual (QI)

• Designate a single leader responsible for your security program.
• QI reports annually to the board/senior management.

2. Enable Multi-Factor Authentication (MFA)

• MFA is mandatory for all system access. No exceptions unless formally justified.

3. Encrypt All Client Data

• All customer data must be encrypted, in transit and at rest.

4. Conduct Regular Security Testing

• Either continuous monitoring OR annual penetration tests plus semiannual vulnerability scans.

5. Limit Data Retention

• Default: Securely dispose of client data after two years, unless legally required otherwise.

6. Manage Vendor Risk

• Enforce security clauses in contracts, monitor third parties, conduct risk-based reviews.

7. Incident Response & Breach Notification

• Report breaches of 500+ consumers to the FTC within 30 days.
• Faster and stricter state notification timelines may also apply.

‍

Key IRS and State-Specific WISP Mandates

• IRS: All tax preparers must maintain a written data security plan per IRS Publications 4557 & 5708.
• Massachusetts: 201 CMR 17.00 requires device and transmission encryption, a dedicated security coordinator, and annual security reviews.
• Rhode Island/Oregon: Additional sector and state rules may trigger stricter controls.

‍

Mandatory Controls Checklist

Governance & Personnel

• Appoint Qualified Individual (QI)
• Board-level reporting (annually)
• Documented, regularly updated WISP
• Staff security awareness training and background checks

Technical Safeguards

• Unique user IDs and strong password policy
• MFA enforced for all systems
• Encryption for databases, laptops, backups, and transmissions
• Asset inventory and data classification
• Role-based access control (RBAC) and least privilege enforcement
• Logging and monitoring of user activity
• Change management with security reviews and documentation
• Secure development practices for in-house/third-party software

Physical Security

• Restricted facility access with logs
• Clean desk and secure storage policies
• Workstation endpoint protection and device encryption

Data Management

• Retention schedule (two-year maximum unless legally required longer)
• Secure data disposal (shredding, wiping, certified destruction)
• Documentation of exceptions and policies

Vendor & Incident Response

• Vendor risk assessment, security clauses, and monitoring
• Written incident response plan with roles, escalation, and post-breach review
• FTC and state breach notifications as required

‍

Small Business Exemptions

If you serve fewer than 5,000 customers, you may be exempt from some written documentation requirements. But, MFA, encryption, breach response, and most technical controls still apply. Always document any exemption claims for your own protection.

‍

How to Implement WISP Compliance. A 90-Day Roadmap

First 30 Days:

• Appoint QI, review MFA/encryption, secure devices, update passwords
• Days 31-60:
• Conduct risk assessment, draft WISP, incident response plan, set retention schedule
• Days 61-90:
• Staff training, vendor management, vulnerability scans, finalize documentation

‍

WISP Compliance Checklist for 2025

Download PDF