WISP Resources · Article
Form W-12 Line 11: what you attested, and how to back it up
Every PTIN renewal asks you to check one box about data security. Here is what the October 2026 form now says, where the requirement comes from, and the proof your firm should have on file.
By Bryan D. Wall · October 24, 2026
What Line 11 says now
The current Form W-12, revised October 2026, asks every paid preparer to check yes or no to this statement:
"I am aware that paid tax return preparers are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information."
The form points to IRS Publications 5708 and 4557 for details (IRS Form W-12 (Rev. October 2026)). Line 11 first appeared in October 2019 with softer wording about a "data security plan." The 2026 version names the written information security plan, or WISP, directly and says it is required by law.
Where the requirement comes from
Tax and accounting firms are financial institutions under the Gramm-Leach-Bliley Act. That puts them under the FTC Safeguards Rule, which requires a written information security program with specific parts (FTC Safeguards Rule, 16 CFR 314 (summary by Bradley)). The IRS repeated the point in August 2026: federal law requires tax and accounting professionals to create and maintain a WISP, keep it accessible, and review, test and update it regularly (IRS IR-2026-92, August 18, 2026).
IRS Publication 5708 is the IRS template for building one. It is a good starting point, but a downloaded template that nobody customized is not a plan.
Why it matters this season
PTIN renewal opens in mid-October and current PTINs expire December 31 (Verito: PTIN renewal and the WISP requirement). The 2027 fee shown on the form is $18.75 (IRS Form W-12 (Rev. October 2026)). Checking the box takes a second. Backing it up is what counts when client data is stolen, an insurer reviews a claim, or a client asks how you protect their information.
The stakes are rising. IRS data reported in October shows tax firms hit by data breaches more than doubled, from 277 in 2025 to 571 in 2026 (CPA Practice Advisor, October 21, 2026).
What backing it up looks like
If someone asked to see your WISP tomorrow, these are the pieces that show it is real:
- A plan written for your firm. It names your systems, your vendors, where client data lives, and who does what.
- A Qualified Individual. One named person is responsible for the program. In a small firm that is often an owner, supported by an outside advisor.
- Multifactor authentication everywhere client data lives. The Safeguards Rule requires it for anyone accessing systems with customer information.
- Encryption and tested backups. Data is encrypted on devices and in transit, and you have actually restored a backup.
- Training records. Staff were trained this year, and you can show it.
- An incident response contact list. Your IRS Stakeholder Liaison, state tax agencies, insurer and attorney, ready before you need them.
- An annual review. A dated note that the plan was checked and updated in the last 12 months.
What small firms can skip, and what they cannot
Firms that hold information on fewer than 5,000 consumers are exempt from four parts of the Safeguards Rule: the written risk assessment, the written incident response plan, the annual written report to leadership, and the scheduled testing requirement (16 CFR 314.6, small institution exceptions). The written plan itself, the Qualified Individual, MFA, encryption, training and vendor oversight still apply. Every firm also needs to know the breach notice rule: a breach of unencrypted information on 500 or more consumers must be reported to the FTC within 30 days of discovery (FTC breach notice requirement (summary by Venable)).
A quick way to check yourself
Our free WISP readiness checklist turns these requirements into 28 yes or no questions with an instant score. If you would rather have someone review it with you, the WISP and Security Six Diagnostic is a fixed-price review of your plan and your controls.
Sources
- IRS Form W-12 (Rev. October 2026)
- IRS IR-2026-92, August 18, 2026
- FTC Safeguards Rule, 16 CFR 314 (summary by Bradley)
- 16 CFR 314.6, small institution exceptions
- FTC breach notice requirement (summary by Venable)
- Verito: PTIN renewal and the WISP requirement
- CPA Practice Advisor, October 21, 2026
This page is general information, not legal advice. Sunesis Services is not a law firm or a CPA firm. Confirm specific obligations with your attorney.