Assurbyte Book a free call
Menu

IRS Publication 5709 vs 5708: Which WISP Guide Should You Use?

· Assurbyte

A stack of printed documents on a wooden table, beside the headline: Pub 5709 vs 5708: which one to use?

Short answer: IRS Publication 5709 is a one-page overview, and Publication 5708 is the full 29-page guide with the sample template inside. Read 5709 first to understand what a WISP (written information security plan) is for. Then use 5708 to actually build yours. You don't have to pick one. They're two sizes of the same advice, and the small one even says so: Pub 5709 calls itself "an overview of IRS Publication 5708."

So why does this confuse people? Because the IRS lists both of them, side by side, on the Form W-12 instructions next to line 11, the WISP box on your PTIN renewal. Two publication numbers, one digit apart, no explanation. It's a bit like a restaurant handing you the menu and the cookbook at the same time.

What is IRS Publication 5709?

IRS Publication 5709, How to Create a Written Information Security Plan for Data Safety, is a single page. Think of it as the trailer, not the movie. In plain words, it tells you:

  • Why you need a WISP. It says federal law, enforced by the FTC (the Federal Trade Commission), "requires professional tax preparers to create and maintain a written data security plan."
  • Why it helps you. A WISP gives you "a blueprint of action" if there's a security incident, and it can help with other disruptions too, like fire, flood or theft.
  • What a good plan focuses on. Three areas: employee management and training, information systems, and detecting and managing system failures.
  • What the FTC expects in the plan. Name someone to coordinate security, look at your risks, put safeguards in place and test them, pick vendors who protect data, and adjust the plan as your office changes.
  • How to keep it alive. It calls a WISP an "evergreen document," meaning you review and update it, not file it and forget it.

That's the whole thing. You can read it in the time it takes your printer to warm up.

What is IRS Publication 5708?

IRS Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice, is the full guide. It was written by the Security Summit, a partnership of the IRS, state tax agencies and the private-sector tax industry. Inside you'll find:

  • A short section on the legal requirements behind a WISP
  • A "Getting Started" page and a WISP outline
  • A sample template with blanks to fill in
  • Extra detail on each part: naming who's responsible, assessing risks, listing your hardware, documenting your safety measures
  • Six sample attachments (A through F), from a record retention policy to a breach procedure to a list of who can access client data
  • A glossary of terms

If 5709 is the trailer, 5708 is the movie, the director's commentary and the "making of" extras. We walk through filling it in, section by section, in our guide to the IRS WISP template in Pub 5708.

Pub 5709 vs 5708: what's actually different?

Publication 5709Publication 5708
Length1 page29 pages
JobExplains what a WISP is and why it mattersHelps you write one
Template included?NoYes, plus sample attachments A to F
Best forA quick read, or briefing your staffSitting down to draft your plan

One small quirk: the two describe the "three areas" a plan should focus on a little differently. Pub 5709 says employee training, information systems, and handling system failures. Pub 5708 says physical, technical and administrative safeguards. Don't let that throw you. It's the same ground, sliced two ways. Locks and paper files, computers and networks, and people and training all belong in your plan either way.

Comparison of IRS Publication 5709 and 5708: 5709 is 1 page that explains what a WISP is and why it matters, with no template, best for a quick read; 5708 is 29 pages that help you write one, with a template and sample attachments A to F, best for drafting your plan.

Which IRS WISP publication should a small tax office read first?

Here's a calm order that works for most small offices:

  1. Read Pub 5709 (5 minutes). Get the big picture. Notice it says a plan should fit your size and how sensitive your data is.
  2. Skim Pub 5708's outline (15 minutes). See what sections you'll need to fill in.
  3. Fill in the 5708 template, one section at a time. Use your real office, not the sample's examples.
  4. Keep IRS Publication 4557, Safeguarding Taxpayer Data nearby. Pub 5708 lists it as a good resource to review before you start.

There's also IRS Publication 5417, Basic Security Plan Considerations for Tax Professionals, a short checklist-style page that the W-12 instructions list right alongside 5708 and 5709. It's handy as a reminder list, not as a plan.

And yes, size matters in a helpful way. Pub 5708 says "a sole practitioner can use a more abbreviated and simplified plan than a 10-partner accounting firm." A one-person seasonal office doesn't need a 40-page binder.

Is the IRS sample WISP enough by itself?

It's a strong start, but it's a sample, and it says so. Pub 5708 states it isn't meant "to replace your own research" or "serve as a substitute for developing your own plan based upon the specific needs and requirements of your business." It also encourages tax pros to talk with technical experts about security.

The bigger point isn't paperwork. It's the bad day. If a stolen email password or a phishing click (a fake email that tricks you into handing over a login) lets someone into client files, your plan is what tells you who to call and what to shut off first. Pub 5709 recommends a data theft response plan that includes contacting your IRS Stakeholder Liaison. Cyber insurers may also ask about things like MFA (multi-factor authentication, the second check such as a code on your phone), backups and whether you have a written security plan. A sample with blanks still in it won't answer those questions.

How Assurbyte can help

Let's be honest about the do-it-yourself route. Reading 5709 is quick. Turning 5708 into a plan that matches your office means listing every device that touches client data, figuring out who can get into what, checking your vendors, writing a breach procedure and getting staff to sign off. Most busy owners start in a quiet week and then tax season shows up and eats the draft.

Our done-for-you Safeguards Readiness Package handles that work for you:

  • A custom WISP written around how your office actually runs, using the same structure the IRS guides describe
  • A gap list that shows, in plain words, what's already in place and what still needs attention
  • Sized to your office, so a small shop isn't handed a plan built for a big firm
  • Time back for client work, with a plan in place before tax season gets loud
  • Answers ready when an insurer asks about your security plan, and a clear first-hour plan if something goes wrong

If you'd like help with the fixes on the gap list, that's available too.

FAQ

Is IRS Publication 5709 the same as Publication 5708?

No. Pub 5709 is a one-page overview of Pub 5708. Pub 5708 is the full guide with the sample WISP template and attachments.

Which publication has the IRS WISP template?

Publication 5708. Pub 5709 explains what a WISP is for but doesn't include a template.

Do I have to use the IRS template to have a WISP?

The IRS offers the template as a sample to help you build your own plan. Pub 5708 says it isn't a substitute for developing a plan based on your own business. What matters is that your plan is written down and fits how your office really works.

Why does my PTIN renewal mention these publications?

The Form W-12 instructions list Pubs 5708, 5709, 4557 and 5417 as resources for line 11, where you acknowledge that paid preparers are required by law to create and maintain a WISP. Checking that box is an acknowledgement, and these publications help you act on it. See our post on the W-12 line 11 WISP question and whether your tax office needs a WISP.

Next step

Not sure how close your office already is? Start with the free Small Office Security Checkup. It shows where you stand in a few minutes. If you'd rather hand off the writing, see the Safeguards Readiness Package.

This post is general information, not legal advice. For advice about your specific situation, talk with a qualified professional.

Sources