Free for tax preparers
Get a free one-page checklist with 15 quick checks. It's based on IRS Publication 5708 and the FTC Safeguards Rule. It takes about 10 minutes.
Why it matters
Paper Form W-12 (Rev. October 2025), line 11, "Data Security Responsibilities," reads:
"I am aware that paid tax return preparers are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information." IRS Form W-12 (Rev. October 2025), line 11
Under the FTC Safeguards Rule, tax preparation firms count as financial institutions. IRS Publication 5708 says this applies regardless of size. The checklist shows where your office stands today.
Read the guide: PTIN renewal and what Form W-12 line 11 says
What's on the checklist
Your written plan, your Qualified Individual, staff training and the yearly report.
A written risk assessment, vendor oversight and how long you keep client data.
Encryption, multi-factor sign-in and the IRS "Security Six."
Monitoring, EFIN checks, your incident plan and who to call after data theft.
The checklist also marks the items that offices with fewer than 5,000 consumers are exempt from.
Who made it
I'm Ken. I've spent 25 years in IT and 12 of them working only with accounting firms. I set up the systems, write the security plans and help offices pass reviews. Now I turn that work into simple templates for small tax offices.
Small offices need good plans, forms and checklists. Most don't have time to build them. This checklist shows you where to start.
The Data Security Plan (WISP) Starter Kit helps you close the gaps in one afternoon. You get a fill-in Word plan, a 14-tab workbook, 3 fillable forms, 3 letters and a finished example.
Questions
Yes. Enter your email and we'll send it. There's nothing to buy.
No. It's a quick self-check. It is not legal, tax or cybersecurity advice. Checking every box does not make your office compliant with any law.
No. Each item is a plain yes or no question. If you aren't sure, leave the box empty and ask your IT provider.
We use it to send the checklist and a few short tips. We never sell it. Every email has a one-click unsubscribe link. See the privacy notice.