Written security plans for tax offices

You check the box on your PTIN renewal. Can you produce the plan?

Federal law requires every paid tax preparer to keep a Written Information Security Plan (WISP). TaxFort writes yours around your actual software, devices and staff. A certified security professional reviews it, and you have it in 5 business days.

Get your plan · $597 Take the free 2-minute Self-Check

No client data needed
10-minute questionnaire
Yours to keep

Illustration. Line 11 is paraphrased from Form W-12.

Federal law requires tax and accounting professionals to create and maintain a Written Information Security Plan. Internal Revenue Service, news release IR-2026-92, August 2026

Why a template falls short

A downloaded template describes someone else's office.

Most small firms have either nothing or a fill-in-the-blank template that doesn't match how they really work. After a breach, that's the document your insurer, your clients and the IRS will ask to see.

Required, not optional

The FTC Safeguards Rule covers tax preparers of every size, and you confirm you know it each time you renew your PTIN.

Tax offices are targets

Social Security numbers, bank details and prior-year returns are exactly what identity thieves are after.

Sized to your firm

Firms with fewer than 5,000 clients get a leaner plan, as the rule allows. Larger firms get a fuller one.

What you get

A plan that names your software, your devices and your people.

Your written planCovers the FTC Safeguards Rule elements and follows IRS Publications 4557 and 5708.
A prioritized gap listWhat to fix, in what order, with a target date for each item.
Breach response stepsWhat to do in the first hour, and who to notify: the IRS, state agencies, clients and the FTC.
Staff acknowledgment formsReady to print and sign, including for seasonal staff.
An AI tools policyRules for using AI with client information, including Section 7216 consent.

Example · fictional firmConfidential

5. Technical Safeguards

Multi-factor authentication shall be enabled for every person on Drake Tax, the SmartVault client portal and Microsoft 365 email. The two front-desk computers and the owner's laptop shall use full-disk encryption…

Gap list
No.	Gap	Severity	Fix within
GAP-1	No second login step on email	High	30 days
GAP-2	Backups kept next to the originals	Medium	90 days
GAP-3	No offboarding checklist for seasonal staff	Low	180 days

Your plan is built from your own answers. This sample is invented.

How it works

Ten minutes from you. Five business days from us.

Answer a short questionnaire
About your office, software, backups and who has access. Never your clients' information. “Not sure” is a fine answer.
We build and review your plan
Your plan is drafted from your answers, then reviewed line by line by a certified security professional.
Receive it in 5 business days
A Word document you can edit and sign, with your gap list and staff forms.

Pricing

One price for the plan. Optional help keeping it current.

Most small tax offices need one thing: the plan. Concierge is there if you'd like it kept up for you.

WISP Kit

For firms with fewer than 5,000 clients.

$597one time

Plan tailored to your office
Gap list with fixes and target dates
Breach reporting steps
Staff acknowledgment forms
Policy for using AI tools with client information

Get your plan

The plan is yours to keep. Review it at least once a year and whenever your office changes.

Safeguards Concierge

We keep your plan and your staff current.

$79per month

Plan updates as rules and your office change
Quarterly policy review
Annual risk reassessment
Monthly phishing-awareness emails for your staff
Help when something goes wrong

Add Concierge

Optional. Cancel any time.

5,000 clients or more? Larger firms need a fuller plan, with a written risk assessment and a complete incident response plan. Plans start at $1,297.

Email for a quote:
support@taxfortsecurity.com

Secure checkout through Stripe. TaxFort never sees your card number.

Who builds your plan

Jason Breining, founder

I write and maintain information security policy for a living, for systems where the standards are strict and every control gets audited. TaxFort brings that same discipline to small tax and accounting offices, in plain English and at a price that makes sense.

I read every plan before it goes out. If something in your answers doesn't add up, you'll hear from me, not from a form letter.

MS, Information Security Operations Graduate degree
CompTIA Security+ Certification
ISC2 Certified in Cybersecurity Certification
ITIL 4 Certification

More about TaxFort and how plans are made

Questions

What tax pros ask before they buy

The IRS has a free sample plan. Why pay for one?

IRS Publication 5708 is a good starting point, and it's a template: you still have to work out what applies to your office and write it yourself. TaxFort does that work, checks it against your real setup and hands you a list of what to fix.

Do you need access to my client data?

No. We only ask how your office is set up: software, devices, backups and who has access. We never see taxpayer information.

Is this legal advice?

No. Your plan is a security compliance document that helps you meet your obligations. It isn't legal advice and doesn't guarantee any regulatory outcome.

I'm a solo or seasonal preparer. Do I really need this?

Yes. The requirement applies to paid preparers of every size. Smaller firms get a shorter plan, but it still has to be written down.

My tax software vendor has a SOC 2 report. Isn't that enough?

No. That report covers the vendor's systems. Your plan covers your office: your computers, your email, your paper files and your people.

What if I'm not sure how my office is set up?

“Not sure” is a fine answer. We'll follow up, and anything unclear becomes an item on your gap list instead of a guess in your plan.

What happens if I never update the plan?

It goes stale. A plan should be reviewed at least once a year and whenever your software, staff or vendors change. You can do that yourself, or Concierge does it for you.

Resources