I'm Robert Jacal. I set up and secure computers for Houston offices, and I do the work myself. Here is what the rules say about written security plans, straight from the sources.
The short answer
Yes. The IRS puts it plainly in Tax Tip 2024-93:
"Tax professionals are required by law to have a WISP in place to protect customer data."
WISP stands for written information security plan. The rule behind it is the FTC's Safeguards Rule, under the Gramm-Leach-Bliley Act, and it counts tax preparation firms as financial institutions.
You may have already said you know
When you renew your PTIN, Form W-12 line 11 asks you to check Yes or No to this:
"I am aware that paid tax return preparers are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information."
That box is an awareness statement. It doesn't ask you to prove you have a plan. But once you check it, nobody can say you weren't told.
What the rule asks for
The Safeguards Rule is 16 CFR Part 314. In plain words, among other things, it asks you to:
- Name one person who is in charge of security. It can be you, or someone outside the office. You still answer for it.
- Look at what could go wrong with your clients' information, and write it down.
- Limit who can see client files to the people who need them.
- Encrypt client information, both stored on your computers and sent over the internet.
- Turn on multi-factor login for anyone who signs in to your systems.
- Train your staff.
- Pick outside companies that can protect your data, require it in their contracts, and check on them.
- Securely get rid of client data you no longer need.
- Regularly test or monitor that your safeguards work.
- Have a written plan for what you do if something goes wrong.
- Report in writing to the owner or board at least once a year.
- Tell the FTC as soon as possible, and no later than 30 days after you find out, if someone gets the unencrypted information of 500 or more people without permission.
If your office is small
Section 314.6 gives some relief to offices that keep information on fewer than 5,000 people. They don't have to do the written risk assessment, the continuous monitoring (or the yearly penetration test and twice-yearly vulnerability scans), the written incident response plan, or the yearly written report to the owner or board.
Everything else still applies, including the person in charge, looking at your risks, encryption, multi-factor login, training, watching your vendors and the FTC breach notice. And the IRS doesn't skip small offices. It says a plan works best when "tailored to the size, scope, complexity and sensitivity of the customer data it handles." A two-person office gets a short plan. It still gets a plan.
Free help from the IRS
You don't have to buy anything to start. The IRS gives you a fill-in template in Publication 5708, and the security steps behind it in Publication 4557.
Checklist: is your office covered?
- One person is named as in charge of security.
- The plan is written down, not just in someone's head.
- Every account that touches client data uses multi-factor login: email, tax software, cloud storage.
- Every computer and laptop has disk encryption turned on.
- Client files are sent encrypted, never as plain email attachments.
- Each person has their own login. No shared passwords.
- Backups run on a schedule, are encrypted, and one copy is kept off the network (an unplugged drive or cloud storage).
- Wi-Fi uses WPA3, the router's admin password is changed, and guests have their own network.
- Software and security updates install on their own.
- Staff have been trained on phishing and on handling client data.
- You know which outside companies can reach your data, and their contracts require them to protect it.
- You know who to call, and what to do, if there is a breach, including the FTC notice if 500 or more people are affected.
Next step
If you'd like a second pair of eyes, I do a free 30-minute checkup. I'll look at your setup and tell you exactly what's missing.
Email me for a free checkupNot legal advice. This is a plain-English summary of the IRS and FTC sources linked above; for your specific situation, read the source or ask your attorney.