For US paid tax preparers · PTIN renewals close Dec 31
The security plan the law requires of every tax preparer — finished in 15 minutes.
Federal law requires a written information security plan (WISP), and your PTIN renewal asks you to confirm you know it. Answer plain-English questions about your office and get a complete WISP built on IRS Publication 5708 — with your risk assessment, dated action items and all six attachments.
Sample from a plan · V. Risk Assessment
| Risk | Safeguard | Risk |
|---|---|---|
| Phishing email steals a password | MFA on business email — action item | High |
| Laptop lost or stolen | Full-disk encryption — in place | Low |
| Tax software account takeover | Event log review — action item | Medium |
XII. Action Items
- ☐ Turn on MFA for every business email account — target in 30 days
- ☐ Enable event logging and a 90-day review — target in 60 days
Why every paid preparer needs a WISP
Not a nice-to-have. Here is what the IRS and FTC say — with sources.
It's federal law — whatever your size
Under the Gramm-Leach-Bliley Act and the FTC Safeguards Rule, tax and accounting professionals are treated as financial institutions regardless of size, and must implement and maintain a written information security plan.[1]
Your PTIN renewal asks you about it
Form W-12, line 11 asks you to confirm you know paid preparers are required by law to create and maintain a WISP. You must check a box to file the renewal — so have your plan in place before you do.[2]
Your EFIN depends on it
The IRS may treat a Safeguards Rule violation as a violation of the rules for Authorized e-file Providers. E-file sanctions range from a written reprimand to suspension or expulsion from IRS e-file.[3]
Tax offices are prime targets
Tax professionals reported nearly 300 data breaches to the IRS in the first half of 2025 alone, affecting as many as 250,000 clients. A plan is how you prevent one — and know exactly what to do if it happens.[4]
If a breach happens, the plan is your playbook: who contains it, when to call your IRS Stakeholder Liaison and state agencies, and the FTC's 30-day notice when 500 or more people are affected.[1]
Built for small US tax offices
A great fit if you are
- A solo preparer or a small office of up to about 25 people
- An EA, AFSP participant, CPA or non-credentialed preparer with a PTIN
- A seasonal storefront or home office that e-files with an EFIN
- A bookkeeper or payroll service that also prepares returns
- Renewing your PTIN and never wrote a plan — or wrote one years ago
Probably not for you if
- You're a large firm with an in-house security or compliance team
- You need a formal audit, penetration test or legal review — talk to a professional
- You're outside the US — this plan follows US (IRS/FTC) requirements
1. Answer questions
Your software, devices, staff and the safeguards you have today. About 15 minutes.
2. See your risks — free
A rated risk assessment and dated action items for anything missing.
3. Download your plan
The full WISP as an editable Word file and a print-ready PDF. Update it any time.
Your options
| Blank IRS template | PlanReady | IT / compliance vendor | |
|---|---|---|---|
| Time to a finished plan | Hours to days of writing | About 15 minutes | Days to weeks, often a call |
| Written about your office | Only if you write it | Yes — your software, devices, staff | Yes |
| Rated risk assessment | You do it | Included | Usually |
| Action items with dates | No | Included | Varies |
| Editable Word + PDF | Word / PDF template | Yes | Yes |
| Price | Free | $49 one-time | Typically $249–$999, or part of a monthly IT plan |
What's in your plan
- Objective, purpose and scope
- Qualified Individual and authorized users
- Written risk assessment, rated for your practice
- Safeguards for access, MFA, encryption, Wi-Fi, backups and remote work
- Incident response plan with IRS, state and FTC notification steps
- Training, annual review and implementation clause
- Dated action items for anything you don't have yet
- Attachments A–F: retention, rules of behavior, incident contacts, staff acknowledgment, hardware inventory, vendors
Questions
- I'm a one-person office. Does this really apply to me?
- Yes. The requirement applies to paid preparers regardless of size. The IRS does say a sole practitioner can use a shorter, simpler plan than a large firm — that's what PlanReady writes for a solo office.
- The IRS has a free template. Why pay?
- Publication 5708 is a good outline, and you can fill it in yourself. PlanReady does that work: it asks about your software, devices, staff and habits, writes the plan in your firm's words, adds the Safeguards Rule elements, rates your risks, and turns gaps into dated action items.
- What if I don't have MFA or encryption yet?
- Say so. The plan never claims a safeguard you don't have. It lists the gap as an action item with a target date, so the plan is honest and your next steps are clear.
- Is this legal advice?
- No. PlanReady produces a template-based document from your answers. You are responsible for its accuracy, for carrying it out, and for meeting your legal obligations. For complex situations, talk to a security professional or attorney.
- Can I see it before I pay?
- Yes. Answer the questions and you'll see your personalized risk assessment and action items for free. No account needed.
- What if it isn't useful?
- Ask within 14 days of purchase and we'll refund you in full.
Sources
- [1] IRS Publication 5708, Creating a WISP for your Tax & Accounting Practice (Rev. 8-2024)
- [2] IRS Form W-12 (Rev. 10-2026), line 11, and its instructions
- [3] IRS Publication 3112, IRS e-File Application & Participation; IRS Security Summit guidance
- [4] IRS Security Summit release on the 2025 summer series