Your PTIN renewal asks about your WISP. Is your answer true?

What does the PTIN application ask about data security?

It asks you to acknowledge, in writing, that the law requires a written information security plan. Line 11 of Form W-12 (Rev. October 2025) reads: "I am aware that paid tax return preparers are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information." You must check Yes or No, and the line points to IRS Publications 5708 and 4557.

Renewal season makes this question hard to skip. PTINs expire on December 31 of the year they are issued, and the IRS announced the 2026 renewal period in a news release on October 27, 2025. The 2026 fee was $18.75, online renewal takes under 15 minutes, and a paper Form W-12 can take about six weeks to process. The current Form W-12 carries line 11, so expect the same acknowledgment when your preparers renew for 2027.

Is checking Yes a promise that you have a plan?

Read literally, it is an acknowledgment that you know the requirement exists. That distinction does not help much. Once a preparer has stated in writing that they know the law requires a written plan, "we didn't know" is no longer available if a breach, an FTC inquiry, or an Office of Professional Responsibility referral asks whether the firm had one. The checkbox turns a plan you meant to write into a plan you knew you owed.

For a managing partner, the useful question is simple: if a client's return data were stolen next spring, could the firm produce a current, written plan that matches how the office actually works?

Why are tax preparers covered by the FTC Safeguards Rule?

Because the rule defines them as financial institutions. The definition in 16 CFR 314.2(h)(2)(viii) lists "an accountant or other tax preparation service that is in the business of completing income tax returns" as an example. That brings CPA firms and tax practices under the Gramm-Leach-Bliley Act safeguards requirements enforced by the FTC.

The IRS ties its own programs to the same rule. Publication 1345, the handbook for Authorized IRS e-file Providers, states that "Protecting taxpayer data is required by law," requires multi-factor authentication for anyone accessing taxpayer information, and warns that violations may subject a provider to sanctions, including suspension or expulsion from IRS e-file. It also notes that failures leading to unauthorized disclosure may bring penalties under Internal Revenue Code sections 7216 and 6713.

What does a WISP have to contain?

The program elements in 16 CFR 314.4. A WISP that only restates good intentions will not cover them. The rule's core requirements include:

• A Qualified Individual who oversees and enforces the program.
• A written risk assessment of the risks to customer information.
• Safeguards for those risks, including access controls, encryption of customer information in transit and at rest, and multi-factor authentication "for any individual accessing any information system."
• Regular testing or monitoring, and, absent continuous monitoring, annual penetration testing and vulnerability assessments at least every six months.
• Security awareness training for staff.
• Oversight of service providers, with safeguards required by contract.
• A written incident response plan.
• A written report from the Qualified Individual to the firm's governing body at least annually.
• Notice to the FTC no later than 30 days after discovering a notification event involving the information of at least 500 consumers, a requirement in effect since May 13, 2024.

Smaller practices get some relief. Under 16 CFR 314.6, firms that maintain customer information on fewer than 5,000 consumers are exempt from the written risk assessment, the penetration and vulnerability testing, the written incident response plan, and the annual report. The other elements, including MFA, encryption, and the Qualified Individual, still apply.

Does Circular 230 add anything?

It adds professional exposure. In a 2023 practitioner article, the IRS Office of Professional Responsibility tied data security to Circular 230's competence standard in section 10.35 and to section 10.36, which requires those with principal authority over a firm's practice to have adequate procedures for compliance by everyone working there. OPR warned that willful failures can lead to Circular 230 discipline, on top of liability under the Safeguards Rule and malpractice coverage questions.

What should a firm check before this year's renewals?

Make the plan match the office, then renew. A practical sequence for the weeks before busy season:

• Confirm who your Qualified Individual is, by name, and that they have actually reviewed the plan this year.
• Compare the plan to reality. If the WISP still describes a server closet you retired or a portal you replaced, update it.
• Verify MFA on every system that touches client data: email, the tax software, the client portal, remote access, and cloud storage.
• Check encryption on laptops and on any backup that leaves the office.
• List your service providers (software vendors, IT support, e-signature, payroll) and confirm the contracts address safeguarding.
• Write down who calls whom if return data is exposed, including the FTC notice threshold.
• Refresh staff phishing training before filing season begins.

The IRS publishes a starting template in Publication 5708 and broader guidance in Publication 4557. Neither replaces a plan written around your own systems.

How does s90 help?

s90 supports CPA firms and tax practices across Los Angeles and Orange County. We help firms write a WISP that reflects their real environment, then keep the controls in it running: MFA, encryption, backups, monitoring, and the vendor and training records the FTC or your insurer may ask for. If you would like a quiet review of your plan before your preparers renew, we are happy to take a look.