Secure Team
WISP Employee Training for Accounting & Tax Firms
A Written Information Security Plan is broader than employee training. But accounting and tax firms still need a practical way to train employees, include seasonal staff, reinforce security awareness and keep training records organized.
Secure Team is being designed to help firms manage the employee security-awareness training and documentation portion of their broader information-security program.
Assign practical training, track completion, organize refreshers and maintain a clear employee training history without turning the process into another spreadsheet-heavy administrative task.
Built for CPA firms, tax preparers, bookkeeping firms and small professional teams.
A WISP Is More Than an Employee Training Program
A Written Information Security Plan describes how an organization protects sensitive information. Employee security awareness is one part of that broader program — not the entire program.
Depending on the organization and the requirements that apply to it, a broader information-security program may address risk assessment, access controls, information systems, service providers, incident response, data handling, physical safeguards, technical safeguards and program management.
Secure Team focuses specifically on the employee-awareness side: helping firms deliver relevant security training and keep the resulting training activity organized.
Secure Team does not replace a complete WISP. It helps organize the employee security-awareness training that supports one.
A BROADER SECURITY PROGRAM MAY ALSO ADDRESS
- risk assessment
- access controls
- information systems
- service-provider oversight
- incident response
- data handling
- physical safeguards
- technical safeguards
- program review and management
The Hard Part Isn’t Just Saying “Train Your Employees”
Your firm may already know employees need cybersecurity awareness. The harder part is deciding what they should receive, tracking who completed it and keeping the records organized.
What Should Employees Learn?
Firm owners may know security awareness matters but still need to decide which topics are relevant. Secure Team is being designed around practical accounting and tax workflows rather than abstract cybersecurity lectures.
Who Has Completed Training?
Training assignments become difficult to manage through email, spreadsheets or memory. A centralized view makes it easier to see which employees completed required training and which assignments remain outstanding.
When Was Training Completed?
Completion dates and training history help a firm understand when awareness activities occurred instead of relying on paper certificates or scattered email records.
What About New Employees?
New employees often receive access to email, portals, accounting systems and sensitive client information quickly. Security expectations should be introduced as part of onboarding.
What About Seasonal Staff?
Tax firms may rapidly add temporary employees before filing season. A seasonal preparer may only work for a few months while still handling highly sensitive taxpayer information.
When Should Training Be Refreshed?
Awareness should not disappear after onboarding. Firms need a manageable way to reinforce important topics throughout the year.
One Place for Employee Security-Awareness Training
Secure Team is being designed to make employee security-awareness administration easier for small accounting and tax firms.
Employee Assignments
Assign appropriate awareness lessons to employees without building a complicated training program from scratch.
Completion Tracking
See who completed assigned training and who still has outstanding work.
Training Topics
Maintain a record of the awareness subjects employees have received.
Completion Dates
Know when training occurred and make completion history easier to review.
Recurring Refreshers
Organize periodic reinforcement instead of treating awareness as a one-time event.
Employee Training History
Maintain an organized record of security-awareness activity over time.
Seasonal Employee Training
Include temporary and seasonal staff rather than treating them as an afterthought.
Downloadable Reports
Create straightforward training documentation for internal recordkeeping.
Practical Training for the Security Decisions Employees Make
WISP-related employee awareness should not mean giving staff long, technical cybersecurity lectures. Training is more useful when employees recognize the situations they actually encounter during accounting and tax work.
Phishing & Suspicious Email
Fake client attachments, document-sharing messages, unusual email requests and links that lead to fraudulent login pages.
Passwords, MFA & Account Security
Credential theft, fake password-reset messages, unexpected authentication prompts and account-takeover warning signs.
Client Data Handling
Taxpayer data, payroll records, financial information, confidential documents and everyday file-sharing decisions.
Payment & Payroll Fraud
Bank-account changes, direct-deposit requests, vendor instructions, refunds and unusual financial requests.
Impersonation & Social Engineering
Client, vendor, manager and executive impersonation that attempts to make an unusual request look routine.
AI & Voice Impersonation
Why a convincing voice or message may still require independent verification before sensitive action is taken.
Incident Reporting
What employees should do when they click something suspicious, receive an unusual request or notice unexpected account activity.
Recurring Refreshers
Short reinforcement throughout the year rather than relying only on one long annual presentation.
Explore the broader Security Awareness Training program for more detail on the employee training approach.
SEASONAL TAX STAFF
Your WISP Training Program Shouldn’t Forget Seasonal Employees
Tax firms may add preparers, administrative staff, temporary support, interns and seasonal customer-service personnel before filing season.
Those employees may quickly receive access to taxpayer data, tax software, email, client portals, financial records and other sensitive documents.
A seasonal worker may only be with the firm for several months, but during those months they may handle the same sensitive taxpayer information as permanent employees.
Secure Team is being designed to help firms include seasonal staff in the same organized awareness process rather than relying on informal reminders.
A Practical Seasonal Process
- assign onboarding awareness training
- track completion before peak filing activity
- identify employees with pending assignments
- provide short pre-tax-season refreshers
- keep seasonal training records organized
Know Who Was Trained, What They Completed and When
Training documentation should not depend on paper certificates, email chains, multiple spreadsheets or someone’s memory.
The goal is straightforward internal recordkeeping: a clear view of employee assignments, completion status and refresher history.
EXAMPLE WISP TRAINING DASHBOARD
| Employee | Training | Status | Completed | Next Refresher |
|---|---|---|---|---|
| Sarah M. | Phishing Awareness | Completed | January 12 | July |
| Michael R. | Client Data Handling | Completed | February 3 | August |
| David T. | Account Security | Pending | — | — |
Example data for illustration only. Training records alone do not establish legal or regulatory compliance.
Create a Clear Training History
A useful awareness program should be easier to review over time, not harder.
Employee Training History
Maintain a record of completed lessons so the firm can review security-awareness activity over time.
Topic History
See which subjects employees have covered instead of relying on memory or scattered certificates.
Completion Dates
Know when awareness activities occurred and when a future refresher may make sense.
Outstanding Assignments
Identify employees who still need to complete assigned training.
Refresher History
Track recurring awareness activity rather than treating training as a one-time event.
Annual Training Summary
Create a simple view of employee security-awareness activity during the year.
Turn Employee Awareness Into an Ongoing Program
A WISP-related awareness program can be easier to manage when important topics are reinforced throughout the year instead of compressed into one long annual session.
January — Tax-Season Phishing Refresher
Prepare employees for suspicious client, account and document messages before filing activity increases.
February — Fake Client Email Scenario
Practice recognizing attachments, links and requests that appear to come from clients.
April — Client Data Handling
Review how sensitive taxpayer and financial information should be handled during normal work.
June — Passwords, MFA & Account Protection
Refresh employees on protecting email, portals, tax software and cloud accounts.
August — Payroll and Payment Fraud
Review verification procedures for banking instructions, direct-deposit changes and other financial requests.
October — AI & Impersonation
Help employees recognize convincing owner, client and vendor impersonation attempts.
December — Annual Security Awareness Review
Reinforce the year’s most important lessons and prepare the next training cycle.
This is an example awareness framework, not a universal legal schedule. Each organization should adapt training frequency to its operations, employees, systems, risks and applicable requirements.
Make Security Awareness Part of Employee Onboarding
New employees often receive access to sensitive information quickly. Awareness training can be introduced before or alongside access to business email, client portals, accounting platforms, tax software, payroll systems and confidential records.
01
Phishing Basics
Introduce suspicious email, attachments, links and document-sharing requests before those messages appear in a real inbox.
02
Account Security
Set expectations around passwords, MFA, login requests and unusual account activity.
03
Sensitive Data Handling
Explain how the firm expects employees to handle taxpayer, payroll and financial information.
04
Payment Verification
Teach employees when banking, refund, payroll and payment changes require independent confirmation.
05
Incident Reporting
Make sure employees know who to contact and what to do when something suspicious occurs.
The objective is simple: employees should understand the firm’s basic security expectations before those expectations are tested by a real suspicious request.
How Employee Training Fits Into the Broader Security Program
Current official guidance supports treating employee awareness as one part of a broader information-security program. The following summaries are intentionally high level.
IRS Guidance
In August 2026, the IRS and Security Summit partners reminded tax professionals that federal law requires tax and accounting professionals to create and maintain a Written Information Security Plan to help protect client information. The same IRS guidance describes employee management and training as one of the three core areas a good WISP should focus on.
The IRS also emphasizes that a WISP should be appropriate to the firm’s size, scope, complexity and the sensitivity of the customer data it handles. Read the current IRS guidance →
FTC Safeguards Rule
FTC guidance lists tax preparation firms among the examples of financial institutions covered by the Safeguards Rule and explains that covered institutions must maintain a written information-security program with administrative, technical and physical safeguards.
The FTC’s guidance also says covered institutions should provide security-awareness training and schedule regular refreshers. Whether a particular business is covered, and which provisions apply, depends on the rule and the business’s circumstances. Read the FTC guidance →
Secure Team does not provide legal advice, determine whether a business is covered by a particular rule, or certify that a firm satisfies its legal or regulatory obligations.
Training Is One Part of a Complete Information-Security Program
Employee awareness matters, but a complete information-security program involves more than training.
| Secure Team Helps With | A Broader Security Program May Also Involve |
|---|---|
| Employee security-awareness training | Risk assessments |
| Onboarding awareness | MFA and access controls |
| Recurring refreshers | Endpoint protection and system configuration |
| Employee completion tracking | Backups and incident response |
| Training records and history | Vendor management and service-provider oversight |
| Seasonal employee inclusion | Physical safeguards, technical safeguards, policies and procedures |
Secure Team is designed to complement — not replace — the other safeguards in your information-security program.
Built for Firms Without a Dedicated Compliance or Security Team
A 10-person tax or accounting practice may not have a CISO, dedicated security trainer, compliance department or full internal IT team.
Training may instead be managed by an owner, partner, office manager, operations manager or outsourced IT provider.
Secure Team is being designed so these teams can operate a practical employee-awareness program without running an enterprise learning-management system.
Simple Assignments
Assign relevant employee training without building a complicated curriculum.
Clear Completion Status
See which employees have completed training and which assignments remain outstanding.
Practical Training
Use short scenarios connected to accounting and tax work.
Recurring Awareness
Reinforce important security behaviors throughout the year.
Straightforward Records
Keep employee awareness history organized for easier internal review.
FREE RESOURCE
Is the Employee-Training Portion of Your Security Program Organized?
Use the Secure Team WISP Employee Training Checklist for Accounting & Tax Firms to review the practical basics of your current awareness program.
Free educational resource. Not legal advice and not a compliance certification.
- Permanent staff receive awareness training
- New employees receive onboarding training
- Seasonal staff are included
- Phishing awareness is covered
- MFA and account-security awareness is covered
- Client-data procedures are explained
- Payment verification is covered
- Incident reporting is explained
- Recurring refreshers are scheduled
- Completion records are maintained
- Outstanding assignments can be identified
- Annual training activity can be reviewed
WISP Training Designed Around Accounting Workflows
Generic cybersecurity examples can be difficult to connect to everyday work. Secure Team focuses on situations that accounting and tax employees are more likely to recognize.
CPA Firms
Client documents, payment instructions, email security, portals and sensitive financial information. Explore accounting-firm training →
Tax Preparation Firms
Taxpayer information, filing-season phishing, tax software and seasonal employees. Explore tax-preparer training →
Bookkeeping Firms
Cloud accounting credentials, client banking information, invoice fraud and vendor payment changes.
Payroll Providers
Direct-deposit changes, employee impersonation, payroll information and account security.
From “We Should Train Employees” to an Organized Awareness Program
The problem is often not deciding whether training matters. It is turning that intention into a repeatable process.
| Manual / Ad-Hoc Approach | Secure Team |
|---|---|
| Decide training topics manually | Focused employee awareness program |
| Email employees links | Organized assignments |
| Maintain spreadsheets | Completion tracking and training history |
| Search for completion records | Straightforward documentation |
| Remember refresher dates | Recurring awareness and refresher history |
| Separately track seasonal staff | Seasonal employee inclusion |
| Use generic examples | Relevant accounting and tax scenarios |
Secure Team is designed to make awareness administration easier. Using the platform does not, by itself, establish legal or regulatory compliance.
Frequently Asked Questions
What is WISP employee training?
WISP employee training refers to the employee security-awareness and management activities that support a firm’s broader Written Information Security Plan. It may include onboarding awareness, phishing training, account-security training, sensitive-data handling, incident reporting and recurring refreshers.
Does a WISP include employee cybersecurity training?
Current IRS guidance for tax professionals identifies employee management and training as one of the core areas a good WISP should focus on. Employee training is only one component of the broader information-security program.
What cybersecurity training should tax and accounting employees receive?
Training should reflect the information and workflows employees actually handle. Common topics include phishing, passwords and MFA, client-data handling, payment fraud, impersonation, account security and incident reporting.
How should accounting firms document employee security training?
A practical record can include the employee’s name, training assigned, topics covered, completion status, completion date and refresher history. Secure Team is being designed to make these records easier to organize.
Should seasonal tax employees be included in WISP training?
Seasonal employees may receive access to taxpayer information, tax software, email and client portals. Firms should consider their role and access when planning employee awareness and onboarding.
How often should employees receive WISP cybersecurity training?
There is no single Secure Team schedule that applies to every organization. FTC guidance for covered financial institutions calls for security-awareness training and regular refreshers, while each firm should adapt its program to its operations, risks and applicable requirements.
What training records should a firm maintain?
Useful records may include assigned lessons, completion status, completion dates, topics covered, refresher history and outstanding assignments. Firms should determine their own recordkeeping obligations based on applicable requirements and professional guidance.
Does Secure Team create a complete WISP?
No. Secure Team is focused on employee security-awareness training, completion tracking and training documentation. It does not create or certify a complete Written Information Security Plan.
Does Secure Team make my firm compliant?
No. Secure Team does not guarantee legal or regulatory compliance. Employee awareness is one component of a broader information-security program, and organizations remain responsible for understanding and meeting their own obligations.
Does WISP employee training replace IT security?
No. Employee awareness does not replace MFA, endpoint protection, backups, access controls, secure system configuration, incident response, managed IT services or other technical and administrative safeguards.
Can Secure Team help track recurring training?
The platform is being designed to track assigned lessons, completion status, completion dates and recurring awareness activity so firms can maintain a clearer employee training history.
What is the difference between a WISP and security awareness training?
A WISP is a broader written information-security plan. Security awareness training is one part of the employee-management and security program that can support that broader plan.
Make Employee Security Training Easier to Manage
Your WISP may require a broader security program. Secure Team helps make one important part easier: training employees, reinforcing awareness and keeping training records organized.
Train your team. Track completion. Keep employee awareness organized.