Known Good ITSecurity plan self-check · En español

Free security plan generator for tax offices

Paid tax preparers need a written information security plan. The FTC Safeguards Rule calls for it, and the IRS calls it a WISP. This page asks eight plain questions and builds a draft you can download, edit and print. The draft follows the structure of the IRS sample plan in Publication 5708.

The PTIN application (Form W-12, line 11) asks preparers to confirm they know paid preparers must have a written plan. PTIN renewals for 2027 are open now, and a paid preparer needs a valid 2027 PTIN before preparing returns.

Nothing you type leaves this page. The draft is built inside your browser. There is no form to send, nothing is saved, and the page loads no outside scripts, fonts or analytics. Close the tab and your answers are gone.

Known Good IT provides a technical service. This generator is not legal or tax advice and it is not a substitute for the advice of an attorney. Using the draft does not by itself make an office compliant with any law, and no outcome is promised. You decide what applies to your firm, and your firm stays responsible for its own security and for any law that applies to it. The template was drafted with the help of an AI tool and checked against the text of IRS Publication 5708 and 16 CFR Part 314. No attorney has reviewed it.

Your answers

Skip anything you are unsure about. It stays in the draft as a highlighted blank for you to fill in. Leave out passwords, client names and Social Security numbers.

1. Your office
2. How many people work in the office, including you?
3. Who runs security day to day?

The FTC calls this person the Qualified Individual. The plan calls them the Data Security Coordinator. You pick the person.

4. Where do you keep client files?

Check all that apply.

5. Which email do you use for work?
6. Does anyone work away from the office?

At home, on a phone or tablet, or on a laptop.

7. How are client files backed up?
8. If something goes wrong, who do staff tell?

A lost laptop, a strange email, a locked computer. Leave the name blank to use the person from question 3.