--- title: PTIN Renewal Security Check | Watch Cloud Cyber Security description: Your PTIN renewal asks you to acknowledge a data security requirement defined by seven IRS and FTC references. See what they actually require, get your gaps scored, and keep the written plan. --- ![Watch Cloud Cyber Security](https://go.taxcybersecurity.com/hubfs/Watch%20Cloud%20Logo%20(500%20%C3%97%20300%20px).png) FTC Safeguards Rule  ·  IRS Publication 4557 PTIN Renewal  ·  TY2026 # The box is one click. The requirement is seven publications. Your PTIN renewal asks you to acknowledge a requirement, then hands you a reading list defining it. Most preparers check the box and never open the list. PTIN renewal  ·  Data security responsibilities "Paid tax return preparers are required by law to create and maintain a written information security plan **that provides data and system security protections for all taxpayer information**." Yes, I am aware of this requirement. Read that sentence again. The requirement is not a document. It is a plan *that provides protections*. You are then pointed to seven references, and the first one is a federal regulation with nine categories of controls in it. - See exactly what those seven references ask of you - Get your security posture scored and your gaps named - Leave with a written information security plan you keep ## Run your PTIN Renewal Security Check Eight short sections of plain-English questions, about six minutes, no account required. You get a scored gap analysis and a written plan built from your answers. No cost and no obligation. We do not sell your information. What you acknowledged ## The screen, and the seven references on it If you have renewed a PTIN, you have seen this. Every link below is live, so you can check any of it yourself rather than taking our word for it. ![The data security responsibilities screen shown during PTIN renewal. It states that paid tax return preparers are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information, lists seven references, and presents a checkbox reading 'Yes, I am aware of this requirement.'](https://go.taxcybersecurity.com/hubfs/ptin-data-security-screen.png) The data security responsibilities step in the PTIN renewal application. Reproduced for reference; the text is a public record. Watch Cloud Cyber Security is not affiliated with, endorsed by, sponsored by, or associated with the Internal Revenue Service or the U.S. Department of the Treasury. 01 [FTC 16 CFR Part 314 Standard for Safeguarding Customer Information](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314) The binding one. A federal regulation, not guidance. Requires a designated Qualified Individual, a risk assessment, and nine categories of safeguards including encryption of customer information in transit and at rest, multi-factor authentication, access controls, monitoring and logging of user activity, secure disposal, ongoing training, and oversight of your service providers. 02 [Publication 5708 Creating a Written Information Security Plan for Your Tax & Accounting Practice](https://www.irs.gov/pub/irs-pdf/p5708.pdf) The template and worksheet approach. Useful for structure and for documenting decisions, but it describes what to write down, not what to run. 03 [Publication 5709 How to Create a Written Information Security Plan for Data Safety](https://www.irs.gov/pub/irs-pdf/p5709.pdf) The condensed how-to companion. Walks through the drafting process at a practice level. 04 [Publication 4557 Safeguarding Taxpayer Data](https://www.irs.gov/pub/irs-pdf/p4557.pdf) The checklist most preparers have heard of. Covers safeguards, e-Services responsibilities, and what to do when data is lost or stolen. 05 [Publication 5417 Basic Security Plan Considerations for Tax Professionals](https://www.irs.gov/pub/irs-pdf/p5417.pdf) The short-form considerations sheet. A starting point, explicitly not a complete program. 06 [IRS.gov/IdentityTheft](https://www.irs.gov/identity-theft-central) Your obligations when client identities are compromised, including how and when to report a data loss to your Stakeholder Liaison. 07 [Protect Your Clients; Protect Yourself](https://www.irs.gov/tax-professionals/protect-your-clients-protect-yourself) The Security Summit campaign hub. Ongoing threat alerts and the current-season guidance practitioners are expected to be following. **The point of the list is that five of these seven are about writing, and the first one is about doing.** You can satisfy Publications 5708, 5709, 4557 and 5417 with a well-drafted document. You cannot satisfy 16 CFR Part 314 with a document, because it asks for encryption, authentication, logging and testing that either run in your practice or do not. Where templates stop ## A free WISP template covers the left column only This is the split that matters, and it is why "I downloaded a WISP" and "I meet the requirement" are different statements. ### What a document can satisfy Paperwork elements - Naming a Qualified Individual to own the program - Recording your risk assessment and its criteria - Written policies for access, retention and disposal - A written incident response plan - Documenting your annual program review A good template genuinely helps here. This part is real work and it is worth doing. ### What only a running system can satisfy Technical safeguards, 16 CFR 314.4(c)–(f) - Encryption of customer information in transit and at rest - Multi-factor authentication for system access - Monitoring and logging of authorized user activity - Regularly testing the effectiveness of your safeguards - Detecting and stopping an intrusion while it is happening - Ongoing security awareness training for everyone with access - Verifying your service providers actually safeguard the data No document performs any of these. They are either operating in your practice or they are a gap. **If you are a small practice, the exemptions cut the other way.** Under [16 CFR 314.6](https://www.law.cornell.edu/cfr/text/16/314.6), a firm holding information on fewer than 5,000 consumers is excused from four requirements: the written risk assessment specifics, the penetration-testing and continuous-monitoring mandate, the written incident response plan, and the annual written report. Every one of those is paperwork. Nothing in that exemption touches encryption, multi-factor authentication, access logging, safeguard testing, training, or vendor oversight. So the smaller your practice, the more of what remains is technical, and the less a template does for you. This page summarizes published IRS and FTC material for general information. It is not legal advice, and it is not a determination of your practice's compliance status. Applicability depends on your specific facts. How the Check works ## Eight sections, then an honest answer Step 1 ### Answer the questions Plain-English questions about your devices, your staff, your software, and how client data actually moves through your practice. No technical knowledge needed. Step 2 ### See your gap analysis The Gap Analyzer scores your security posture and names the gaps specific to your firm, measured against Publication 4557 and the FTC Safeguards Rule. Step 3 ### Keep the plan A written information security plan built from your answers, downloadable immediately or sent by email. Yours whether or not you ever become a client. Why it matters ## The acknowledgement becomes part of the record Tax preparers, CPAs, and enrolled agents fall under both the FTC Safeguards Rule and IRS Publication 4557. Bookkeepers who handle client financial data fall under the Safeguards Rule as well, whether or not they ever file a return. $53,088 Maximum civil penalty per violation under the FTC Act, as adjusted for 2025.Federal Trade Commission 800,000+ Paid preparers renewing a PTIN, each acknowledging this requirement.Internal Revenue Service Dec 31 Every current PTIN expires. Renewal typically opens in late October.Internal Revenue Service If you find a gap ## Closing it costs less than most practices assume The technical column is what we run for you. Annual billing is eleven months for twelve. No contracts, no setup fees, cancel any time. | Plan | Built for | First device | Each additional | | --- | --- | --- | --- | | Cyber Shield | Done with you. Solo practitioners and small offices that want the security stack running and the documents in their own hands. | $45/mo | $25/mo | | Practice Defender | Done for you, and the plan most firms choose. Adds a professionally written WISP, a dedicated account manager, phishing training built for tax and finance threats, and dark web monitoring of your firm domain. | $75/mo | $50/mo | | Firm Elite | Multi-preparer firms. Priority SOC response with senior analysts, custom WISP drafting with annual review, and hands-on incident response support. | $625/mo 5 devices included | $125/mo | Why Watch Cloud ## Built for practices like yours, not scaled down to them - A real 24/7 security operations center staffed by human analysts - Demonstrated same-day incident response - Specialists in the tax and accounting vertical, not generalists - Enterprise security stack priced for a one-person firm - Done-for-you posture, so this does not land on your desk in February - Live in under an hour on self-serve onboarding ## Find out before you check the box You are going to acknowledge the requirement either way. Six minutes now tells you whether the acknowledgement is accurate. [Run your security check](https://go.taxcybersecurity.com/ptin-security-check#top) Watch Cloud Cyber Security LLC  ·  12361 Hagen Ranch Rd, STE 503 #1102, Boynton Beach, FL 33437 (561) 570-1573  ·  [sales@taxcybersecurity.com](mailto:sales@taxcybersecurity.com)  ·  [taxcybersecurity.com](https://taxcybersecurity.com) Watch Cloud Cyber Security LLC is a private company. It is not affiliated with, endorsed by, sponsored by, or associated with the Internal Revenue Service, the U.S. Department of the Treasury, or the Federal Trade Commission. References to IRS and FTC publications are provided for informational purposes and do not imply any government approval of our services. Nothing on this page is legal advice.