{"id":8115,"date":"2026-09-07T06:23:00","date_gmt":"2026-09-07T10:23:00","guid":{"rendered":"https:\/\/verito.com\/blog\/?p=8115"},"modified":"2026-09-03T09:52:20","modified_gmt":"2026-09-03T13:52:20","slug":"ptin-renewal-wisp-requirement","status":"publish","type":"post","link":"https:\/\/verito.com\/blog\/ptin-renewal-wisp-requirement\/","title":{"rendered":"Does PTIN Renewal Require a Written Data Security Plan?"},"content":{"rendered":"\n<p><strong>Not exactly. When you renew your PTIN, <\/strong><a href=\"https:\/\/www.irs.gov\/pub\/irs-pdf\/fw12.pdf\" target=\"_blank\" rel=\"nofollow noopener\"><strong>Form W-12 Line 11<\/strong><\/a><strong> <\/strong><strong>asks you to check Yes or No on whether you\u2019re aware that paid preparers are legally required to maintain a written information security plan. It doesn\u2019t ask whether you actually have one. Renewal season opens mid-October for the following filing year, and your PTIN expires December 31. The awareness box is easy. Actually having a <a class=\"wpil_keyword_link\" href=\"http:\/\/verito.com\/written-information-security-plan\" target=\"_blank\" rel=\"dofollow noopener\" title=\"WISP\" data-wpil-keyword-link=\"linked\" data-wpil-monitor-id=\"1383\">WISP<\/a> that would hold up if the IRS asked to see it is the part worth taking seriously.<\/strong><\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>Key takeaways<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>PTIN renewal opens mid-October each year, and your PTIN expires December 31.<\/li>\n\n\n\n<li>Form W-12 Line 11 only asks you to confirm awareness of the WISP requirement, not that you currently have a compliant plan.<\/li>\n\n\n\n<li>IRS Publication 4557 lays out what your WISP has to include: a named coordinator, an identified set of risks, evaluated safeguards, and a documented, implemented program.<\/li>\n\n\n\n<li>A false answer anywhere on Form W-12, not just Line 11, can mean PTIN suspension or revocation. Separately, the underlying WISP obligation carries its own exposure under IRC 7216 and the FTC Safeguards Rule.<\/li>\n\n\n\n<li>Your WISP needs an annual review to stay current, not a one-time draft filed away and forgotten.<\/li>\n<\/ul>\n<\/blockquote>\n\n\n\n<div class=\"wp-block-rank-math-toc-block\" id=\"rank-math-toc\"><h2 id=\"table-of-contents\">Table of Contents<\/h2><nav><ul><li><a href=\"#what-does-form-w-12-line-11-actually-ask\">What does Form W-12 Line 11 actually ask?<\/a><\/li><li><a href=\"#what-does-publication-4557-require-in-a-wisp\">What does Publication 4557 require in a WISP?<\/a><\/li><li><a href=\"#whats-the-real-exposure-if-you-dont-have-one\">What\u2019s the real exposure if you don\u2019t have one?<\/a><\/li><li><a href=\"#why-does-a-wisp-need-an-annual-review\">Why does a WISP need an annual review?<\/a><\/li><li><a href=\"#where-does-verit-shield-wisp-fit-in\">Where does VeritShield WISP fit in?<\/a><\/li><\/ul><\/nav><\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-does-form-w-12-line-11-actually-ask\"><strong>What does Form W-12 Line 11 actually ask?<\/strong><\/h2>\n\n\n\n<p><strong>Line 11 confirms one thing: you know a written information security plan is legally required. It\u2019s an awareness statement, not a compliance certification, and you can check Yes or No.<\/strong><\/p>\n\n\n\n<p>The form points you to <a href=\"https:\/\/verito.com\/irs-pub-4557\/\" target=\"_blank\" rel=\"dofollow\">Publication 4557<\/a> for what a compliant plan actually requires. If you\u2019d rather start from something you can fill in today, Verito also publishes a <a href=\"https:\/\/verito.com\/free-wisp-template\" target=\"_blank\" rel=\"dofollow\">free WISP template<\/a> built to that same baseline. Renewal season opens mid-October for the following filing year, and online renewal usually takes under fifteen minutes. Line 11 is a small, quick part of that process. The obligation it points to isn\u2019t small or quick, and it exists independent of anything you check on this form.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>PTIN renewal, at a glance<\/th><th>Detail<\/th><\/tr><\/thead><tbody><tr><td>Renewal season opens<\/td><td>Mid-October, for the following filing year<\/td><\/tr><tr><td>PTIN expiration<\/td><td>December 31 each year<\/td><\/tr><tr><td>Form<\/td><td>Form W-12, online or paper<\/td><\/tr><tr><td>What Line 11 asks<\/td><td>Whether you\u2019re aware a WISP is legally required<\/td><\/tr><tr><td>What Line 11 certifies<\/td><td>Awareness of the requirement, not current possession of a compliant plan<\/td><\/tr><tr><td>Where to start on the plan itself<\/td><td>Publication 4557, or Verito\u2019s free WISP template<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-does-publication-4557-require-in-a-wisp\"><strong>What does Publication 4557 require in a WISP?<\/strong><\/h2>\n\n\n\n<p><strong>Publication 4557 sets out four core elements your plan needs: designate one or more employees to coordinate your information security program, identify reasonably foreseeable risks to client data, evaluate how well your current safeguards address those risks, and design, implement, and monitor a safeguards program.<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/ptin-renewal-wisp-requirement-safeguards-1024x576.jpg\" alt=\"Security coordinator evaluating firm safeguards cinematic visual | Verito\" class=\"wp-image-8131\" srcset=\"https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/ptin-renewal-wisp-requirement-safeguards-1024x576.jpg 1024w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/ptin-renewal-wisp-requirement-safeguards-300x169.jpg 300w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/ptin-renewal-wisp-requirement-safeguards-768x432.jpg 768w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/ptin-renewal-wisp-requirement-safeguards-1536x864.jpg 1536w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/ptin-renewal-wisp-requirement-safeguards-380x214.jpg 380w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/ptin-renewal-wisp-requirement-safeguards-800x450.jpg 800w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/ptin-renewal-wisp-requirement-safeguards-1160x653.jpg 1160w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/ptin-renewal-wisp-requirement-safeguards-150x84.jpg 150w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/ptin-renewal-wisp-requirement-safeguards.jpg 1920w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>None of that is satisfied by a generic IT policy or a template you pull off the internet and never open again. Your plan has to describe your firm as it actually operates: which software holds your client data, who on your team has access to which systems, and what your response looks like if something goes wrong. Verito\u2019s <a href=\"https:\/\/verito.com\/blog\/irs-publication-4557-explained\/\" target=\"_blank\" rel=\"dofollow\">breakdown of Publication 4557<\/a> covers the full baseline in more depth, including the IRS Security Six that most safeguards programs build from.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"whats-the-real-exposure-if-you-dont-have-one\"><strong>What\u2019s the real exposure if you don\u2019t have one?<\/strong><\/h2>\n\n\n\n<p><strong>That doesn\u2019t mean the form has no teeth. Form W-12\u2019s signature line is direct about the stakes: false or misleading information anywhere on the application can mean losing the PTIN itself, on top of possible criminal penalties. No PTIN means no preparing returns for compensation.<\/strong><\/p>\n\n\n\n<p>Separate from the form itself, the underlying WISP obligation carries its own exposure. <a href=\"https:\/\/verito.com\/irs-pub-4557\/\" target=\"_blank\" rel=\"dofollow\">Verito\u2019s guide to Publication 4557<\/a> states directly that noncompliance can lead to EFIN revocation, fines, and liability if client data is exposed. That\u2019s not a hypothetical: if a breach or stolen credentials lead to fraudulent returns filed under your number, the IRS can suspend your EFIN while it investigates, and <a href=\"https:\/\/verito.com\/blog\/efin-protection-monitoring-tax-professionals\/\" target=\"_blank\" rel=\"dofollow\">monitoring your EFIN for misuse<\/a> is its own weekly habit worth building alongside your WISP review. A WISP gap rarely surfaces in a quiet month. It tends to surface after a breach, an audit, or a client\u2019s own security questionnaire, which is the worst possible time to start building a plan from nothing. The <a href=\"https:\/\/verito.com\/security-best-practices\" target=\"_blank\" rel=\"dofollow\">FTC Safeguards Rule<\/a> applies to nearly every tax and accounting firm on top of all this, regardless of what any IRS form asks, and it carries its own separate enforcement path.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"why-does-a-wisp-need-an-annual-review\"><strong>Why does a WISP need an annual review?<\/strong><\/h2>\n\n\n\n<p><strong>The IRS expects you to review and update your WISP at least once a year, along with any time you change software, staff, or systems. A plan you drafted a couple of years ago, before new tools or a seasonal hire, describes a practice that no longer exists.<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/ptin-renewal-wisp-requirement-annual-review-1024x576.jpg\" alt=\"Annual written security plan review cinematic visual | Verito\" class=\"wp-image-8132\" srcset=\"https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/ptin-renewal-wisp-requirement-annual-review-1024x576.jpg 1024w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/ptin-renewal-wisp-requirement-annual-review-300x169.jpg 300w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/ptin-renewal-wisp-requirement-annual-review-768x432.jpg 768w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/ptin-renewal-wisp-requirement-annual-review-1536x864.jpg 1536w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/ptin-renewal-wisp-requirement-annual-review-380x214.jpg 380w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/ptin-renewal-wisp-requirement-annual-review-800x450.jpg 800w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/ptin-renewal-wisp-requirement-annual-review-1160x653.jpg 1160w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/ptin-renewal-wisp-requirement-annual-review-150x84.jpg 150w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/ptin-renewal-wisp-requirement-annual-review.jpg 1920w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>If you put WISP review on the same clock as PTIN renewal, you tend to stay current on both. That same annual habit is also what the FTC Safeguards Rule expects, since it asks for the same kind of documented, living plan the IRS does, just enforced by a different agency.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"where-does-verit-shield-wisp-fit-in\"><span id=\"where-does-veritshield-wisp-fit-in\"><strong>Where does VeritShield WISP fit in?<\/strong><\/span><\/h2>\n\n\n\n<p><strong>VeritShield WISP is a custom written information security plan built for your firm on a 30-minute scoping call with a Verito engineer, delivered within five business days, with unlimited revisions included all year as your firm changes.<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>The task<\/th><th>Building it yourself<\/th><th>Covered in VeritShield WISP<\/th><\/tr><\/thead><tbody><tr><td>Drafting a plan that matches Publication 4557<\/td><td>Research the requirements, adapt a template, hope it fits<\/td><td>Delivered in five business days, built around your firm<\/td><\/tr><tr><td>Updating it as your firm changes<\/td><td>Manual rewrite, easy to postpone<\/td><td>Unlimited revisions included, all year, no change fees<\/td><\/tr><tr><td>Keeping it current as staff, software, or offices change<\/td><td>Another from-scratch review each time<\/td><td>Send the change, they update the plan<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>VeritShield WISP is sold as an annual plan, per firm, and it\u2019s available whether or not your firm hosts with Verito.<\/p>\n\n\n\n<p><a href=\"https:\/\/verito.com\/buy-wisp\/\" target=\"_blank\" rel=\"dofollow\"><strong>Get your WISP audit-ready before PTIN renewal \u2192<\/strong><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"Not exactly. When you renew your PTIN, Form W-12 Line 11 asks you to check Yes or No&hellip;\n","protected":false},"author":12,"featured_media":8130,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":{"0":"post-8115","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-knowledge-base"},"acf":[],"_links":{"self":[{"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/posts\/8115","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/comments?post=8115"}],"version-history":[{"count":3,"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/posts\/8115\/revisions"}],"predecessor-version":[{"id":8175,"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/posts\/8115\/revisions\/8175"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/media\/8130"}],"wp:attachment":[{"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/media?parent=8115"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/categories?post=8115"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/tags?post=8115"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}