Renewing your PTIN? Federal law requires a WISP to protect client information.
Renewing your PTIN? Federal law requires a WISP.
Paid tax preparers must create and maintain a Written Information Security Plan under federal law. Get the free tax-practice template now and make it your own before renewal.
Download first. Customize the plan for your practice next.
Start your WISP before your next renewal. The template is free.
Why PTIN renewal brings up your WISP
The renewal form calls attention to a requirement that applies throughout the year.
A written plan is required
The FTC Safeguards Rule requires covered tax preparation practices to create and maintain a written information security program. Your plan must reflect how your practice actually protects taxpayer data.
Your PTIN renewal calls it out
Form W-12, Line 11 asks you to acknowledge that paid tax return preparers are required by law to create and maintain a WISP. It does not ask you to certify that your plan is already complete.
A template is a starting point
Download the free template, then tailor it to your systems, staff, service providers, and response process. A file left uncustomized does not protect client information.
What the law actually requires
IRS Publication 4557
IRS guidance explains the administrative, technical, and physical safeguards tax professionals should use to protect taxpayer information.
FTC Safeguards Rule
Covered practices must designate a qualified individual, assess risks, and implement safeguards suited to the business. The written plan records the security program.
Form W-12, Line 11
Line 11 asks you to acknowledge awareness of the legal duty to create and maintain a written information security plan.
Your practice
The free template gives you a structure. Complete it with your actual people, devices, vendors, safeguards, and incident procedures.
What is in the free WISP template
Get a practical starting point for documenting how your practice protects taxpayer data, with places to add your own people, systems, and procedures. Free, no credit card.
Get my free WISP template →- 1Purpose, scope and plan objectives
- 2Responsible individuals and your Data Security Coordinator
- 3Risk assessment
- 4Hardware and software inventory
- 5Data safeguards and access controls
- 6Employee training and management
- 7Incident response and breach notification
- 8Service provider oversight
- 9Annual review and updates
Three moments that matter
Right now
Download the free template and start documenting the safeguards your practice actually uses.
December 31, 2026
Current-year PTINs expire. Form W-12, Line 11 reminds preparers of the WISP requirement during renewal.
Throughout the year
Review and update your WISP as your people, technology, vendors, and risks change.
Common questions from tax professionals
Is a WISP really required by federal law?
Yes. The FTC Safeguards Rule requires covered tax preparation practices to have a written information security program. Form W-12, Line 11 asks preparers to acknowledge awareness of the requirement.
Does downloading the template make my practice compliant?
No. The template is a starting point. You need to document your practice-specific risks and safeguards, put the plan into use, and keep it current.
Does Bellator renew my PTIN?
No. You renew through your IRS PTIN account or Form W-12. Bellator provides the WISP template and optional help with your security plan.
How is this different from a generic template?
It is organized for tax practices around IRS Publication 5708 and core FTC Safeguards Rule topics, with places to fill in your actual procedures.
I am a solo practitioner. Do I still need this?
A solo tax practice handling taxpayer information still needs a written security plan. The specific safeguards should fit the size and complexity of your practice.
Your WISP starts here.
Download the free tax-practice template, then make it reflect your real safeguards. If you want a custom plan, our team can write it with you.
Bellator Cyber Guard is an independent provider, not the IRS. We provide WISP templates and services; each practice is responsible for implementing its own security program.