The Written Security Plan Tax Preparers Must Have
Last verified: October 2026
If you prepare tax returns for pay, the IRS expects you to keep a written data security plan — a WISP — and you certify it on your PTIN renewal. Here's what that means and how to get it done. Rather have a hand with the tech? My number is (330) 200-8042.
The Tax-Preparer WISP, at a Glance
Every professional tax preparer — every PTIN holder — is expected to keep a written data security plan, often called a WISP. The duty flows from federal law (GLBA) and the FTC Safeguards Rule, because preparers handle sensitive financial data. The IRS makes it manageable: Publication 4557 explains what to protect, and Publication 5708 is a sample WISP template you customize to your own practice. Since the 2024 cycle, Form W-12 includes a data-security certification checkbox — you confirm, under penalty of perjury, that you maintain a WISP. Name responsible people, inventory your data and systems, list your safeguards, train staff, plan for incidents, and review it at least annually. Always use the current-year forms and pubs. There's a printable 29-page version up top — general information, not legal advice.
Common Questions
1 Do I really need a WISP if I'm a solo, seasonal preparer?
Yes. The requirement applies to professional tax preparers generally — it flows from federal law (GLBA and the FTC Safeguards Rule). Your plan can be short and scaled to a solo practice, but it still needs to exist, be customized, and be current.
2 Where do I get a template, and is signing it enough?
The IRS offers a sample WISP in Publication 5708, created with the Security Summit. It's a great start — but you must customize it to your real practice. Signing the generic template unchanged isn't truly your plan. Use the current-year version from IRS.gov.
3 What's the checkbox on the PTIN renewal about?
Since the 2024 cycle, Form W-12 includes a data-security certification checkbox, around Line 11. Checking it confirms, under penalty of perjury, that you maintain a written security plan. Make sure your WISP is real and current first, and confirm the current line and wording.
4 Do I file my WISP with the IRS?
No. You keep and maintain it — nobody approves or certifies it. You certify on your PTIN renewal that it exists, follow it, review it at least annually, and produce it if asked. No product makes you permanently 'compliant.'
5 What's the single most important safeguard?
Multi-factor authentication on your email and your tax software. Those logins guard a season's worth of client identities, and turning on MFA is the highest-value, lowest-cost thing you can do. Our sign-in guides show you how.
6 Which IRS publications explain this?
Publication 4557 (Safeguarding Taxpayer Data) explains what to protect and your responsibilities, and Publication 5708 is the sample WISP template. Always pull the current-year versions from IRS.gov, since numbers and wording can change.
Would You Rather I Just Help?
I'm a tech helper, not a lawyer or an enrolled agent — but the WISP's safeguards are exactly my wheelhouse. I'll turn on MFA for your email and tax software, encrypt your laptops, test a real backup, and show you the proof, so the plan you certify is honestly true. $99 flat for a visit, 30-day come-back-free. For the legal wording I'll help you line up the right advisor.
Would you rather I just do this for you?
No shame in it — plenty of folks would rather hand it off, and that's what I'm here for. I'll come to your home, set it up right, and make sure it's working before I leave. Flat $99 per visit — no jargon, no upsell, and every visit is 30-day come-back-free.
Not a hardware job? I can often fix it remotely for $49 — a secure screen-share, up to 2 hours, that you watch the whole time and can end whenever (included free for $39/mo Support Plan members, and it counts toward the $99 if it turns out I need to come out).