When you renew your PTIN on Form W-12, Line 11, Line 11 asks you to confirm you are aware that paid preparers must maintain a written information security plan — the IRS calls it a WISP (Publication 5708) — and the whole form is signed under penalties of perjury. Separately, the FTC Safeguards Rule (16 CFR 314; main provisions effective June 9, 2023, with the 314.4(j) notification rule effective May 13, 2024) classifies every tax-prep firm as a "financial institution" and requires specific, named security controls. If you acknowledged Line 11 but do not have the controls behind it, this checklist shows where to start. Tick each box you can honestly say yes to — score 1 point each.
A written document maps where client tax data (NPI) lives and how it's protectedIdentifies where NPI lives, how it could be exposed, and what you do about each risk. A plan in your head doesn't count.
MFA is on for tax software/portal, email, remote access, and cloud storageIf even one is a password alone, that's a direct Safeguards Rule violation.
A written, tested plan covers who you call, how you contain it, and how you notifyIf breached tomorrow: clients and the IRS notified within required timelines.
What's at stake — put it on the ledger. This isn't about a fine.
- Cyber-insurance exposure — some cyber-insurance applications ask whether you have a written security plan, and your answers can matter if you file a claim.
- Exposure on a form you signed — the whole of Form W-12 is signed under penalties of perjury.
MFA on everything?
Yes / No
Date completed
___________
- 8 / 8Rare. Your records look complete. Keep the annual review log current and you're done.
- 5–7Partially covered — but the gaps are exactly the ones that can matter on a cyber-insurance claim and that an examiner may flag first.
- 2–4Typical. Your WISP is, candidly, exposed. Fixable — but not by Friday; it needs a real plan.
- 0–1High risk. If a client's data is lost right now, you may have little on file to show. Priority.
Closing the gaps without becoming an IT expert. Items 1, 3, 4, 6, 7 and 8 are exactly what a device and paperwork manager delivers as a package — the controls
and the paperwork behind them — a fixed
$155/computer a month plus $75/month for the documented WISP (about
$540/month for a 3-person firm: 3 x $155 + $75; the $75 FTC pack requires MSP Advanced), against the cost of an unprotected client-data breach. Only need the paperwork? The
Safeguards Written Plan Package is $750 one-time (WISP, risk assessment and incident response plan, no IT contract). Scored below 8?
Book a 15-minute intake call — no system access; we work from your answers.