Your PTIN renewal asks if you have a security plan.
IRS Publication 4557 and the FTC Safeguards Rule require every paid preparer to have one. Most don't. Two minutes tells you where you stand. Free. Instant grade. Written gap report by email.
★ AS OF 2023 ─ EVERY PTIN RENEWAL REQUIRES THIS ATTESTATION
YOUR PRACTICE WEBSITE OR EMAIL DOMAIN
─ NO LOGIN. NO INSTALL. NOTHING TOUCHES YOUR TAX SOFTWARE.
The IRS
is checking.
Since 2023 every paid tax preparer with a PTIN must attest to having a written WISP. The FTC Safeguards Rule (revised 2023) puts tax practices under the same bar as banks. Penalties for non-compliance start at $50K per violation and scale into the millions.
FTC penalty per violation
$50K
Penalty cap per category
$10M
Renewal requires attestation
PTIN
WISP control areas
9
Every IRS Pub 4557
control area.
Written security plan
Documented WISP that names a Designated Security Coordinator.
Risk assessment
Annual evaluation of internal + external threats to taxpayer data.
Safeguards in place
Encryption at rest + in transit, MFA, secure deletion.
Service-provider oversight
Vendor agreements with required security clauses.
Plan adjustment
Plan reviewed + updated when systems / staff / threats change.
Employee training
Annual security training for everyone touching taxpayer data.
Incident response plan
Written + tested response plan for data security events.
Physical security
Locked file storage, secure shred, badge / key controls.
Domain protection
SPF + DMARC so your taxpayers can't be phished as you.