Yes. The requirement applies to every tax professional who files 11 or more federal returns per year — regardless of firm size, the number of employees, whether you work from home, or whether you are a seasonal preparer. There are no size exemptions. The IRS has made WISP attestation a part of PTIN renewal on Form W-12, Line 11. Falsely certifying compliance is perjury on a federal form and can result in criminal prosecution, PTIN revocation, and FTC enforcement action.

IRS Form W-12, Line 11 asks you to certify that you have a written security plan in place. Without one, your PTIN renewal can be jeopardized — and without an active PTIN, you cannot legally prepare federal tax returns for compensation. Additionally, the FTC can impose fines of up to $50,120 per violation and up to $43,792 per day for ongoing violations. The IRS can also suspend or revoke your EFIN. In the event of a data breach without a documented WISP, you face civil liability with no security record to defend yourself.

A generic template is a starting point — but the IRS and FTC expect your WISP to reflect your firm’s actual security practices, not a generic document. A free template that doesn’t describe your specific systems, staff responsibilities, and security controls is unlikely to satisfy an audit or an incident investigation. Apex Tech 4 Tax Pros provides fully customized WISPs tailored to your specific firm — covering your actual processes, your team structure, and your technology environment. This is what “compliant” actually means.

The Virtual PC is a secure, cloud-hosted computer that you access through your browser or a lightweight app. You run your tax software, store files, and handle all client data on this virtual machine — not on your personal computer. This means your client data is never stored locally on a personal device, is protected even if your computer is lost or stolen, is backed up automatically, and is accessible from any device. It’s one of the most effective security upgrades a tax office can make.