In this Intaxion scenario, July sits between filing-season pressure and the extension-season document requests, notice follow-up, and remote handoffs that pick up again. That's often when vendor logins, shared inboxes, cloud folders, and old staff access go unreviewed. The GLBA/FTC Safeguards Rule requires tax and accounting firms to maintain a written information security plan (WISP) with a qualified individual, risk assessment, documented safeguards, and service-provider oversight, per IRS Publication 5708 (irs.gov/pub/irs-pdf/p5708.pdf). Publication 4557 recommends need-to-know access, MFA, audit trails, encryption, backups, and withdrawal of obsolete authorizations (irs.gov/pub/irs-pdf/p4557.pdf). This is operations guidance, not legal or tax advice; the worked example below is an Intaxion editorial model, not an IRS benchmark — recheck sources before reusing after September 15, 2026.
What the WISP actually requires for vendor access
Publication 5708 treats vendor access as core: firms must identify a responsible individual, assess risk, document safeguards, select service providers that can maintain appropriate safeguards, require those safeguards by contract, and adjust the program as circumstances change (irs.gov/pub/irs-pdf/p5708.pdf). Publication 4557 recommends MFA, need-to-know access, audit trails, encryption, backups, and withdrawal of obsolete authorizations (irs.gov/pub/irs-pdf/p4557.pdf). FTC small-business guidance adds the same posture: train staff, control who can log in, and have an incident response plan ready (ftc.gov/business-guidance/small-businesses/cybersecurity).
As an Intaxion editorial checklist — not an official IRS or FTC framework — ask: which outside tools touch taxpayer data, which staff (including seasonal) still have access, which logins lack MFA or are shared, which vendors can export files, which remote-access tools remain on from peak season, which former-staff system access is still open, which client power-of-attorney or tax-information authorizations are outdated or no longer needed, and what you'd cut first if a workstation or inbox were compromised.
The math: 18 access points, one afternoon
This Intaxion worked example is illustrative, not a source-backed benchmark. A small office with 5 preparers, 1 owner, 2 document staff, 2 seasonal hires, 4 vendor systems, and 2 remote paths could reach 18 access points to review. At an estimated 12 minutes per point, that's roughly 216 minutes; add 45 minutes to update the WISP and vendor roster, and the full review runs about 4 hours 21 minutes — one focused afternoon instead of scattered fixes later.
A review you can finish in two days
This two-day sequence is an Intaxion editorial example, not a mandated timeline. Day one: inventory every system touching taxpayer data, then rate each green (named owner, MFA, current need), yellow (under-documented), or red (former staff, no MFA) — themes from Publication 4557 (irs.gov/pub/irs-pdf/p4557.pdf). Day two: remove former-staff access, replace shared credentials, disable unused remote paths, confirm vendor access levels, update incident-response steps, and close with a one-page summary. Publication 5708 says the program must be evaluated and adjusted as circumstances change (irs.gov/pub/irs-pdf/p5708.pdf); we recommend revisiting this at least once a year.
When the review finds a weak spot
Turn findings into same-week fixes. Can't replace a shared account today? Document its owner, narrow permissions, force a reset, and enable MFA if supported. Former-staff account still live? Disable it now and check the audit log. Publication 4557 directs firms to report data theft or loss to the appropriate IRS Stakeholder Liaison (irs.gov/pub/irs-pdf/p4557.pdf); the FTC's breach guide says to begin by securing operations and containing the incident before addressing communications (ftc.gov/business-guidance/resources/data-breach-response-guide-business).
In this Intaxion scenario, the practical July standard is visibility: can a small office see, on one page, which vendors touch taxpayer data, who owns each login, and what's still open before extension-season requests, notice follow-up, and remote handoffs pick up again?
For a related Intaxion resource, see the WISP Generator: intaxion.com/tools/wisp-generator
Source packet
- IRS Publication 5708 (Rev. 8-2024): https://www.irs.gov/pub/irs-pdf/p5708.pdf
- IRS Publication 4557: https://www.irs.gov/pub/irs-pdf/p4557.pdf
- FTC Cybersecurity for Small Business: https://www.ftc.gov/business-guidance/small-businesses/cybersecurity
- FTC Data Breach Response: A Guide for Business: https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business
Claim boundaries
- This is operational guidance for tax offices, not legal or tax advice, and not a substitute for firm-specific counsel. The WISP requirement originates in the GLBA/FTC Safeguards Rule, which IRS Publication 5708 explains for tax and accounting firms.
- Former-client power-of-attorney or tax-information authorizations are distinct from vendor and staff system access; both should be reviewed, but neither substitutes for the other.
- The review questions, 18-access-point example, and two-day sequence are Intaxion editorial examples, not official IRS or FTC steps.
Metadata
- Excerpt: In this Intaxion scenario, a July WISP access review can help reduce risky vendor access before extension-season document requests pick up again.
- Slug: july-wisp-vendor-access-review-tax-offices
- CTA URL: https://www.intaxion.com/tools/wisp-generator
- Shelf-life: Verify before reposting after 2026-09-15.
- Unresolved: This stage did not perform a native-speaker or human content review of either language version; that review remains required before owner approval.
Get our free Tax Preparer Compliance Checklist
A practical checklist to ensure you're meeting all IRS due diligence requirements. Download instantly.
We respect your privacy. Unsubscribe at any time.