What the security-plan question on your PTIN renewal means

When you renew your PTIN, Form W-12 asks you to acknowledge that paid preparers are required by law to create and maintain a written information security plan. Most preparers tick the box in a few seconds. Fewer could hand that plan to someone who asked for it.

The requirement comes from the Federal Trade Commission's Safeguards Rule, which treats tax preparers as financial institutions. The rule lists nine elements a security program must include. In plain terms, they are these.

1. Name one person who is responsible for security.
2. Identify the risks to client information.
3. Put safeguards in place, including access limits, encryption, and multi-factor sign-in.
4. Test or monitor those safeguards.
5. Train everyone who handles client data.
6. Choose and oversee vendors that hold your data.
7. Update the program when your practice changes.
8. Keep a written incident response plan.
9. Report to the owners in writing each year.

The small-firm exemption is narrower than people think

Firms that hold information on fewer than 5,000 consumers are excused from four items. Those are the written risk assessment, the formal testing schedule, the written incident response plan, and the annual written report. Past clients count toward the 5,000 if you still keep their records.

Everything else still applies to a one-person practice. You still need a named responsible person, encryption, multi-factor sign-in, staff training, and vendor oversight. The IRS also expects the plan itself to be in writing and easy for staff to find.

One duty that applies if the worst happens

Since May 2024, a firm must notify the FTC within 30 days when unencrypted information on 500 or more clients is taken. The IRS separately asks preparers to report client data theft to their Stakeholder Liaison. Both steps belong in your plan so nobody has to look them up during a bad week.

How to finish yours before December 31

The IRS publishes a free sample plan in Publication 5708, or start from my editable template. A small practice can complete it in an afternoon with four lists in hand.

• Every device that touches client data
• Every software product and cloud service you use
• Everyone with access, and what each person can reach
• Every vendor that stores or sends client information

Fill in the template from those lists, turn on multi-factor sign-in wherever it is offered, and set a calendar reminder to review the plan each October. Then the renewal question takes a few seconds for the right reason.