It can be. Publication 5708 is a solid template, and a small office that fills it in carefully, keeps it accurate and follows it can meet the requirement. It falls short when it's downloaded, left half-finished and filed away.
What Publication 5708 is
Its full title is Creating a Written Information Security Plan for Your Tax & Accounting Practice. It comes from the IRS and its Security Summit partners in the states and the tax industry. The IRS describes it as a template to help tax professionals, especially smaller practices, get a plan started.
It walks through the parts of a plan and includes sample language you can adapt: who is responsible, what information you hold, the risks to it, your safeguards, and what to do after a data theft.
What it does well
- It's free and official. You can trust that the structure reflects what the IRS expects to see.
- It's written for small practices, not for banks.
- It covers the required pieces: a responsible person, a risk review, safeguards, staff training, vendors and a response plan.
Where offices go wrong with it
A template is a starting point. The work is in making it true for your office. These are the gaps that show up most often:
| What happens | Why it matters |
|---|---|
| Blanks and sample wording are left in | A plan with placeholders shows it was never finished. |
| It describes safeguards the office doesn't use | Writing “all devices are encrypted” when they aren't is worse than saying nothing. |
| It never names the real software, devices or people | The rule expects a plan that fits your office, not a generic one. |
| Nobody lists what needs fixing | A template can't tell you that your backups sit next to the originals. |
| It's written once and never opened again | Plans are meant to be reviewed regularly and updated when the office changes. |
Doing it yourself: a short method
- Set aside a few hours outside of filing season.
- List where client information lives: tax software, portal, email, backups, paper files, phones and home computers.
- For each one, write down what's true today. Who can get in? Is there a second login step? Is it encrypted? Is it backed up somewhere else?
- Fill in the template from that list, and delete every sample line that doesn't apply.
- Write a separate list of what you found that needs fixing, with a date for each.
- Have staff read and sign it, and set a yearly review date.
IRS Publication 4557, Safeguarding Taxpayer Data, is a helpful companion for step 3.
When paying for a plan makes sense
Doing it yourself costs time and asks you to judge your own setup. Paying for a plan makes sense when:
- you don't have the hours, especially heading into filing season;
- you aren't sure how your own systems are set up, or what counts as a gap;
- you'd like a second set of eyes with a security background on the result.
That's the work TaxFort does. You answer a 10-minute questionnaire, and you receive a finished plan built around your office, plus a prioritized gap list. See pricing, or start with the free Self-Check.
Sources
- IRS Publication 5708, Creating a Written Information Security Plan for Your Tax & Accounting Practice (search “Publication 5708” on IRS.gov)
- IRS news release IR-2026-92, August 18, 2026
- IRS Publication 4557, Safeguarding Taxpayer Data
This page is general information, not legal advice.