Paid tax preparers are required by law to keep a written information security plan, often called a WISP. We write one around how your office actually works, in plain English, and Dave Crawley reviews it before it reaches you.
From $495 · founding price $395 for the first 10 firms
Three official sources say the same thing. Every link goes to the government source.
The FTC's Safeguards Rule (16 CFR Part 314) covers tax preparation firms and requires a written information security program with a named person in charge, safeguards like multi-factor login and encryption, staff training, and vendor oversight.
16 CFR Part 314 (eCFR) · FTC business guideIRS Publication 5708 is the IRS and Security Summit template for creating a WISP, and Publication 4557 is the IRS guide to safeguarding taxpayer data. We build your plan from these.
Pub 5708 · Pub 5709 · Pub 4557Every preparer who applies for or renews a PTIN has to check Yes or No on line 11, Data Security Responsibilities. Checking the box acknowledges the law. Having the plan is what the law requires.
Form W-12 (PDF) · PTIN requirements“I am aware that paid tax return preparers are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information.”
Not a generic template with your name pasted in.
Built on IRS Publication 5708 and the elements of the FTC Safeguards Rule, filled in for your staff, devices, software, vendors, and how you handle client files.
Every plan is reviewed by Dave before delivery. Where something the rule expects isn't in place yet, such as multi-factor login on email, you'll get a plain list of what to fix.
A one-page summary your team can actually read, and a sign-off sheet showing each person received it.
The rule expects the plan to be reviewed and adjusted over time. We remind you when your annual review is due.
Take the free 2-minute self-check, or book a 30-minute call.
About 15 minutes on how your office works. No client tax data, ever.
Your plan is written for your firm and reviewed before it goes out.
Adopt the plan, share the training sheet, collect sign-offs, and keep it current.
One-time price for the first year. No monthly subscription required.
For the first 10 firms, any size up to 10 people.
For solo preparers and very small offices.
For growing tax, bookkeeping, and CPA offices.
Yearly review, an updated plan, a staff refresher, and new sign-off sheets.
Dave verifies that the safeguards in your plan, such as multi-factor login, backups, and encryption, are actually turned on.
More than 10 people? Book a call and we'll scope it. We don't install or manage your systems; implementation stays with your team or IT provider.
Dave brings more than 20 years in IT infrastructure and managed services, including environments supporting up to 13,000 users.
Central CTO is independent: no hardware or software to sell, and no incentive to recommend more than you need. Nashville roots, with clients wherever they are. You get a plan written by someone who understands how small offices actually run.
Talk with Dave ↗If you are paid to prepare tax returns, very likely yes. The FTC Safeguards Rule names tax preparation firms as financial institutions, and requires them to keep a written information security program. The IRS says the same in its guidance for tax professionals, and the PTIN application (Form W-12, line 11) asks every preparer to confirm they know about the requirement.
Sources: 16 CFR 314.1(b) and 314.2; FTC Safeguards Rule guide; Form W-12, line 11.
You can absolutely use it. IRS Publication 5708 is a good starting point, and we build from it. What most small firms don't have is the time to fill it in for how their own office actually works: who has access to what, which software and vendors hold client data, how backups are handled, and what happens if a laptop is stolen. That's the part we do for you.
Source: IRS Publication 5708.
No. The plan is required, but so is following it. The rule also calls for safeguards such as multi-factor authentication, encryption of client data, staff training, vendor oversight, and regular review. Your plan describes how your firm does those things. If some of them aren't in place yet, we'll point that out plainly, and the optional Safeguards check can confirm what's actually turned on.
Source: 16 CFR 314.4.
Firms that keep customer information on fewer than 5,000 consumers are exempt from a few parts of the rule: the written risk assessment, continuous monitoring or annual penetration testing, the written incident response plan, and the annual written report to leadership. You still need the written security program itself. We'll note which exemptions apply to your firm, and we still recommend a short written incident plan because the IRS asks preparers to report data theft promptly.
Sources: 16 CFR 314.6; IRS Publication 4557.
The IRS asks tax professionals to report client data theft to their local IRS Stakeholder Liaison right away. Separately, if a breach involves unencrypted information of 500 or more consumers, the FTC rule requires you to notify the FTC no later than 30 days after discovery. Your plan will include who to call and in what order.
Sources: IRS Publication 4557; 16 CFR 314.4(j).
About 15 minutes to answer a questionnaire about your office: staff, devices, software, vendors, backups, and how you handle client files. We never ask for client tax data or anyone's Social Security number.
No and no. Central CTO is a technology advisory firm, not a law firm. The plan is a working document your firm adopts and follows. We don't guarantee compliance with any law or regulation, or that a plan will prevent a breach. If you have legal questions about your obligations, talk to your attorney.
No. If you have an IT provider, we'll document what they handle and include them in the plan. Central CTO doesn't sell hardware, software, or managed services.
Start with the 2-minute self-check,
or book a 30-minute call with Dave.
