Line 11 asks you to confirm that you know paid tax return preparers are required by law to create and maintain a written information security plan, often called a WISP. Answering it doesn't create the plan. You still need to have one.
What Line 11 says
Form W-12 is the IRS application and renewal form for a Preparer Tax Identification Number (PTIN). On the current form (Rev. October 2026), Line 11 is titled Data Security Responsibilities. It is a yes-or-no box. By answering yes, you confirm you are aware of the legal requirement to have a written information security plan that protects taxpayer data.
The online renewal in your IRS PTIN account asks the same question.
Where the requirement comes from
The form's instructions point to the Federal Trade Commission's Standards for Safeguarding Customer Information, known as the FTC Safeguards Rule (16 CFR Part 314). Under the Gramm-Leach-Bliley Act, tax preparers are treated as financial institutions, so the rule applies to them. That includes solo and seasonal preparers.
The IRS said it plainly in an August 2026 news release: “Federal law requires tax and accounting professionals to create and maintain a Written Information Security Plan.”
The instructions also list two IRS publications for help: Publication 4557, Safeguarding Taxpayer Data, and Publication 5708, Creating a Written Information Security Plan for Your Tax & Accounting Practice.
Does answering “yes” mean I'm compliant?
No. Line 11 confirms that you know about the requirement. It doesn't ask you to attach a plan, and the IRS doesn't review one when you renew.
What it does change is your position if something goes wrong. After a data theft, the questions come from your clients, your insurer, state agencies and possibly the IRS or the FTC. Having confirmed every year that you knew a plan was required, it is hard to explain not having one.
What a written plan has to cover
The IRS and the FTC describe the same core pieces:
- A named person who is responsible for the security program.
- A risk review: where client information lives in your office and what could go wrong.
- Safeguards for those risks, such as individual logins, multi-factor authentication, encryption and backups, checked regularly.
- Staff rules and training, including seasonal staff.
- Vendor oversight: the software and service providers that touch client data.
- A response plan for data theft, including reporting to your IRS Stakeholder Liaison.
- Regular review. The plan is updated when your office changes.
The rule lets the plan fit the size and complexity of the office. A two-person practice needs a much shorter plan than a regional firm, but it still has to be written down.
What to do before you renew
- Find your current plan, if you have one, and check the date. If it still names software you no longer use or staff who have left, it needs an update.
- If you have nothing, start with IRS Publication 5708. It includes a sample plan you can adapt.
- Make it match your office. A plan that describes safeguards you don't actually use can hurt you more than it helps.
- Have your staff read and sign it.
- Put a review date on the calendar, at least once a year.
If you'd like to see where you stand first, the free Self-Check takes about two minutes.
Sources
- IRS Form W-12 (Rev. October 2026) and its instructions
- IRS news release IR-2026-92, August 18, 2026
- FTC Standards for Safeguarding Customer Information, 16 CFR Part 314
This page is general information, not legal advice.