Assurbyte Book a free call
Menu

PTIN Renewal and Your WISP: What W-12 Line 11 Means

· Assurbyte

An open monthly planner on a wooden desk, beside the headline: W-12 line 11 and your WISP.

Somewhere between the coffee and the "please verify your identity" screen, your PTIN renewal asks you a question about a WISP. Here's the plain answer: Form W-12 line 11 asks you to confirm you're aware that paid tax preparers are required by law to have a written information security plan (a WISP). It's a box you check yourself, not an IRS inspection. But the law it points to is real, so the best time to make sure your WISP exists is before you click "Yes."

Let's walk through what line 11 actually says, what it doesn't say, and how to have your plan ready before the January rush.

What is a PTIN, and why are you renewing it now?

Your PTIN (Preparer Tax Identification Number) is the ID number you put on every return you're paid to prepare. Think of it like a parking pass that expires every December 31. The IRS issues PTINs by calendar year, and the Form W-12 instructions say it "must be renewed annually." Enrolled agents need one too.

The IRS is now processing renewals for 2027, and its PTIN requirements page says you need a valid 2027 PTIN before you prepare returns next year. Online renewal takes about 15 minutes, which is less time than most of us spend looking for the stapler in February.

What does Form W-12 line 11 say about a WISP?

Line 11 sits under the heading "Data Security Responsibilities." On Form W-12 (Rev. October 2026), it reads:

"I am aware that paid tax return preparers are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information."

You must check Yes or No. The form then points you to IRS Publications 5708 and 4557 "for more information about your responsibilities."

Notice the word aware. The instructions describe line 11 as a box to "acknowledge awareness" of the requirement. You're not uploading your plan, and nobody from the IRS is showing up to read it. You're confirming you know the rule exists.

Do you need a WISP for PTIN renewal?

This is the question people actually type into Google, so let's be precise. Line 11 is an acknowledgement. The form asks whether you're aware of the WISP requirement. It doesn't ask you to send in a plan.

The WISP requirement itself comes from somewhere else. Tax and accounting firms are covered by the FTC Safeguards Rule (16 CFR Part 314), the Federal Trade Commission's rule for protecting customer data. It says covered businesses must have an information security program that is "written in one or more readily accessible parts." IRS Publication 5708 adds that tax and accounting professionals count as financial institutions under that rule "regardless of size." And an IRS Security Summit news release puts it plainly: tax professionals "are legally required to have a written, accessible plan."

So the honest version is this: the checkbox doesn't create the rule. It reminds you the rule is there, once a year, right when you're thinking about next season. Kind of thoughtful, really. Slightly nosy, but thoughtful.

Want the longer answer on who needs one? See Does my tax office need a WISP?

Why does your WISP matter more than the checkbox?

The checkbox takes one second. A bad day takes a lot longer.

Picture a staff member clicking a fake "your e-file session expired" email in March. Or a laptop with client returns on it disappearing from a car. Suddenly you need answers fast: Who's in charge? What data was on that laptop? Who do we call first? Someone could file fake returns in your clients' names, or misuse your EFIN (your e-file ID number) or PTIN.

A WISP is the page you wrote on a calm day so you don't have to think from scratch on that one. It also helps with cyber insurance. Insurers may ask about things like MFA (multi-factor authentication, a second lock on the door, like a code on your phone), backups, and whether you have a written security plan. If you have a WISP that matches how your office really works, those answers are a lot easier, and a lot more honest.

What should be in your WISP before you check line 11?

You don't need a 60-page binder. Pub 5708 even says "a sole practitioner can use a more abbreviated and simplified plan than a 10-partner accounting firm." But a real WISP covers the basics, in your office's own words:

  1. Who's in charge. The person who runs your security program. The FTC Safeguards Rule calls this your "Qualified Individual." No special degree needed.
  2. What data you have and where it lives. Tax software, email, cloud storage, laptops, phones, and yes, the filing cabinet.
  3. What could go wrong. A short list of realistic risks, like phishing, lost devices, or a former employee who still has a login.
  4. How you protect it. Who can log in to what, MFA, encryption (scrambling data so only the right people can read it), backups, updates, and shredding.
  5. Your people. Training, plus what happens when someone joins or leaves.
  6. Your vendors. Which outside companies touch client data, and how you keep tabs on them.
  7. What you'll do if something goes wrong. Who to call, in what order, with phone numbers.
  8. When you'll review it. At least once a year, and after big changes.

We break each of these down in What should a WISP include?, and if MFA is the piece you're unsure about, start with Do tax preparers need MFA?

What if you don't have a WISP yet?

Don't panic, and don't download a random template and change the name at the top. A WISP with blanks, or someone else's office in it, doesn't describe your office.

Here's a calm way to start this week:

  • Today: Pick your Qualified Individual and write their name down. Congratulations, page one exists.
  • Tomorrow: List every place client data lives. Include the client who emails you their Social Security number "just to be safe." That inbox counts.
  • This weekend (or a quiet evening): Check that MFA is on for your tax software, email, and cloud storage.
  • Next week: Open IRS Pub 5708 and fill in the sections you already know.

Then renew your PTIN and check line 11 knowing your plan is real, not "I'll get to it after April."

Four steps if you don't have a WISP yet: today pick your Qualified Individual, tomorrow list every place client data lives, this weekend check MFA on tax software, email and cloud storage, next week fill in what you know in IRS Pub 5708.

FAQ

Does Form W-12 line 11 mean the IRS will check my WISP?

No. Line 11 asks you to acknowledge that you're aware paid preparers are required by law to create and maintain a written information security plan. You don't submit the plan with your renewal.

Is a WISP required for a PTIN?

Line 11 is an acknowledgement, not a document upload. The WISP requirement itself comes from the FTC Safeguards Rule (16 CFR Part 314), which covers tax and accounting firms of any size, as IRS Publication 5708 explains.

When does my PTIN expire?

PTINs are issued by calendar year and must be renewed every year. A PTIN for the current year is valid until December 31, according to the Form W-12 instructions.

Which IRS publications explain the WISP requirement?

Form W-12 points to Publications 5708 and 4557. The W-12 instructions also list Publication 5709, Publication 5417, and the FTC's 16 CFR Part 314.

How Assurbyte can help

Writing a WISP yourself is doable. It's also a real project. You have to list every login, device and vendor, check MFA account by account, match your plan to 16 CFR 314 and IRS Pubs 4557 and 5708, and then keep it true as your office changes. That's hours of careful work, and January is the worst possible month to start.

Our done-for-you Safeguards Readiness Package takes that off your desk:

  • A custom WISP written for your office, not a template with blanks in it.
  • A plain-English gap list, in priority order, so you know exactly what to fix first.
  • Sized to your office, so a small shop isn't handed a plan built for a big firm.
  • Optional help with the fixes on your gap list, if you want it.

What you get back: your time, a plan that's ready before tax season, solid answers when your insurer asks about MFA, backups or a written plan, and a breach-response page you can grab in a hurry. And if you don't need us, we'll tell you.

Ready to check that box with confidence?

Take our free Small Office Security Checkup to see where your office has gaps. Then get your Safeguards Readiness Package, and we'll write the plan and the fix list for you.

This is general information, not legal advice. For legal questions, talk with your own counsel. Assurbyte helps offices get ready; we don't give legal sign-off.

Sources