WISP template

IRS pub 5708 has a plan you can use

Adding to Terry's answer, since this comes up every PTIN season. Pub 5708 ("Creating a Written Information Security Plan for your Tax & Accounting Practice") is the one most people start from. Search the publication number on irs.gov. Small caveat on "IRS-approved": the pub is a sample the IRS and Security Summit put out, and it says itself that it isn't a substitute for developing your own plan. So treat it as a starting draft, not a finished form.

What made it go faster for me:

• Start with the sample attachments at the back. They cover record retention, rules of behavior, breach procedures, employee/contractor acknowledgement, a hardware inventory and a list of who can access PII. Filling those in forces you to write down what you actually do, and the main plan text then mostly writes itself.
• Name one person as responsible. For a solo practice that's you. The FTC Safeguards Rule (16 CFR 314.4) calls this the Qualified Individual.
• Turn on MFA everywhere client data lives: tax software, email, cloud storage, remote access. The Safeguards Rule calls for it on any system with customer information, unless the responsible person approves an equivalent control in writing.
• Keep a short list of vendors that touch client data, and note how you checked they protect it.
• Write down what you'd do in a breach, including who you'd call. Pub 4557 has a checklist and the steps for reporting data theft to the IRS.
• Put a date on it and review it at least once a year. Pub 5708's template says the same. Also train any staff before they get access to client data.

One small thing: if you have fewer than 5,000 consumers' information, the rule drops a few specific requirements (for example, the written risk assessment and the annual report to leadership). It doesn't exempt you from having the plan itself.