Blog
What Happens If Your Firm Doesn't Have a WISP?
September 20, 2026
Most firms that don't have a Written Information Security Plan aren't ignoring the rule on purpose — they've just never run into a moment where the gap became visible. That moment usually arrives without much warning, and by the time it does, there's no time left to build a real plan. Here's what actually happens, in the order firms tend to run into it.
The First Wall: PTIN Renewal
As of the 2026 filing season, the IRS ties PTIN renewal directly to WISP attestation. This is the most common place a firm without a plan first feels the consequence — not a lawsuit or a breach, just an inability to renew the credential that lets them prepare returns at all. Firms that treat "we'll get to it eventually" as an option often discover eventually arrived at the worst possible time, mid-renewal-window, with clients waiting.
The Second Wall: Vendors and Partners Asking First
Increasingly, the next place firms get caught is earlier than a breach — during onboarding with a bank, a software vendor, or even a referral partner who now asks directly whether a documented security program exists. A firm that has to say "not yet" in that conversation loses credibility it didn't need to lose, and sometimes loses the relationship outright. This is happening more as GLBA-driven vendor due diligence spreads beyond just the largest institutions.
The Real Cost Shows Up If There's Ever an Incident
If a firm without a WISP ever has an actual data incident — a phished email account, a lost laptop, a compromised vendor — the absence of a plan becomes the central fact of the aftermath. Regulators and courts don't just ask "was there a breach," they ask "did this firm take reasonable, documented steps to prevent it." A firm with a followed WISP has an answer. A firm without one has nothing to show except that the requirement existed and wasn't met — which turns an incident from "we had a security failure" into "we had no security program," a materially worse position under FTC enforcement and most state breach laws.
Insurance Doesn't Cover What You Can't Document
Cyber insurance is supposed to be the backstop, but it depends on accurate answers at application time. Firms are increasingly asked outright whether a WISP is in place. Answering that incorrectly — or not having anything to point to when a claim is filed — can void coverage at the exact moment it matters most. A missing WISP doesn't just remove a compliance checkbox; it can quietly remove the safety net a firm assumed it had.
Why "We'll Build One Eventually" Doesn't Work
Every one of these consequences shares the same root cause: a WISP built reactively, after a wall is already hit, is worse in every way than one built proactively. It's rushed, it's generic, and it's assembled under pressure instead of matched to how the firm's specific tools and workflows actually handle client data — which is the part that actually determines whether it holds up. This is exactly why we don't hand every client the same security template; a plan only protects a firm if it reflects that firm's real vendors, access controls, and document flow, not a boilerplate document filled in after the fact.
For what actually belongs in the plan itself, see our WISP checklist for small firms and the legal background in the FTC Safeguards Rule. This is also part of our complete guide to AI for accountants.
Frequently Asked Questions
What's the actual first consequence of not having a WISP, before any breach happens?
It's usually not a fine — it's the IRS PTIN renewal itself. Every tax preparer now has to attest to WISP compliance to renew, so a firm without one can hit a wall before any client data is ever compromised. A software vendor or bank asking for proof of a security plan during onboarding is the second most common place firms get caught without one.
Does a data breach without a WISP cost more than one with a WISP?
Often significantly more. Under most state breach notification laws and FTC enforcement history, having a documented, followed security plan is treated as a mitigating factor — it can reduce penalties and shows a court or regulator the firm took reasonable precautions. Without one, a breach investigation has nothing to point to except the absence of a plan, which regulators read as negligence rather than bad luck.
Can my firm still get cyber insurance without a WISP?
Increasingly, no — or only at a much higher premium. Cyber insurance applications for firms handling financial data are starting to ask directly whether a WISP is in place, and a false or missing answer can void a claim entirely at the exact moment you need coverage.
If nothing bad has happened yet, is it really urgent?
The FTC doesn't wait for a breach to enforce the Safeguards Rule — the requirement is to have the plan in place, not to wait until something goes wrong to write one. Firms that treat this as low-urgency almost always end up building it retroactively, under worse conditions, after an incident or audit forces the issue.
Is a generic downloaded WISP template enough to avoid these consequences?
Not fully. A template can satisfy the letter of 'having a document,' but if it doesn't reflect your firm's actual vendors, access controls, and data flow, it won't hold up under real scrutiny — from an insurer, a regulator, or an actual incident. See our full checklist for what a plan needs to cover to be more than paperwork.
We build every automation and security workflow around your firm's actual tools and data flow — never a generic template.
Book a Free Consultation