PTIN renewal and the security plan you sign for

What Line 11 actually says

Form W-12 carries a section headed Data Security Responsibilities, and it asks you to check Yes or No against one sentence.

The sentence, quoted from Form W-12 (Rev. October 2025), is: "I am aware that paid tax return preparers are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information."

You must check one box. There is no field to attach anything, no plan reference number, and no step where the IRS looks at what you wrote. That surprises people, and it is worth being clear about, because a lot of marketing in this space implies the opposite.

What you are signing is an acknowledgment of awareness. It is short, it is annual, and more than 800,000 paid preparers sign some version of it every year. That is what makes it the most widely signed statement about information security in American small business, and also the least acted upon.

Where the requirement actually comes from

Not from the PTIN form. The duty sits in the FTC Safeguards Rule, issued under the Gramm-Leach-Bliley Act, and the W-12 simply makes you acknowledge it once a year.

16 CFR 314.3(a) requires a covered financial institution to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The FTC treats paid tax preparation as a covered activity, which is why the IRS puts the acknowledgment on the PTIN form in the first place.

This matters for one practical reason. If you are hoping that skipping the PTIN box or checking No removes the obligation, it does not. The obligation exists in the regulation whether or not you acknowledge it. The form is a reminder, not the source.

It also means the standard you are held to is the regulation's, not the form's. 16 CFR 314.4 lists what the program has to do: name a qualified individual, run a risk assessment, implement specific safeguards including access controls and multi-factor authentication, dispose of information you no longer need, train your people, assess your service providers, and keep the whole thing current.

What being small does and does not change

16 CFR 314.6 lifts four written obligations from firms holding information on fewer than 5,000 consumers. It does not lift the requirement to have a written program.

This is the single most misunderstood provision in the rule, in both directions. Some firms believe being small exempts them entirely, which is wrong and would be an expensive belief to hold during an examination. Others buy penetration tests and formal board reporting they do not owe, because a vendor did not tell them about 314.6.

The four duties that lift are specific and they are listed in the table below. Everything else in 314.4 applies to a one-person practice exactly as it applies to a fifty-person firm, scaled to the size and complexity of what you actually run.

Count consumers honestly when you work out which side of the line you are on. The count includes people whose information you still hold from prior years, not just this season's clients, and it includes information held on your behalf by a service provider.

What happens if you check Yes without a plan

Nothing at renewal. The risk is entirely downstream, and it is real enough to be worth stating plainly rather than dramatising.

There is no audit triggered by checking the box, no cross-reference, and no list of preparers whose plans the IRS intends to inspect. Anyone telling you otherwise is guessing or selling.

What the box does is close a door. Once you have signed an annual federal statement saying you are aware of the requirement, the defence that nobody told you is gone. That matters in three situations that do happen to small firms: an FTC enquiry after a breach, a cyber insurance claim where the application asked whether you had a written plan, and a client whose data was exposed asking what safeguards you had in place.

The proportionate response is not panic. It is to spend an evening producing a plan that is true, and to keep a dated record of the things you have not done yet rather than claiming you have done them.

What a plan has to contain to be worth having

Specificity. A plan that could belong to any firm belongs to no firm, and that is visible immediately to anyone reading it for a reason.

A serious plan names your systems, not categories of system. It says which tax software you use, where client files actually sit, who has access to each, which vendors can reach client data, and what happens when someone leaves. It names a Qualified Individual by name or role under 16 CFR 314.4(a), which for most small firms is the owner.

It also handles the parts you have not finished. If multi-factor authentication is on for email but not for your portal, the plan should say so, name who is fixing it, and give a date. An examiner, an underwriter, and an opposing lawyer all read a dated remediation step as a functioning program. They read an overstated claim as a misrepresentation, and on an insurance application that is a much larger problem than the gap itself.

Publication 5708 is a reasonable place to see the shape of one. It is a sample, the IRS says it is a sample, and the work it leaves you is the work that makes the document real.

Doing this before you renew

Renewal is a useful forcing date even though the two are not formally connected. A short sequence gets you there.

Work out your consumer count first, because it decides which duties you owe. Then write down what is actually true today: your systems, your vendors, who has access, whether MFA is on and where, whether your backups have ever been restored from. Resist the urge to improve the answers while you write them.

Turn each gap into an owner and a date. Then produce the document, keep the evidence with it, and diary a review for next year. The review is not ceremony: 16 CFR 314.4(g) requires you to evaluate and adjust the program in light of changes to your operations.

Renew online through your IRS Tax Professional account if you can. The paper route on Form W-12 takes roughly six weeks to process, which is a bad thing to discover in the last week of December.

FAQ