An IRS 4557 checklist comes down to two things: put the “Security Six” controls in place, and back them with a written information security plan, known as a WISP. IRS Publication 4557, “Safeguarding Taxpayer Data,” is the IRS’s guidance for anyone who prepares returns for pay, and it is no longer optional reading. When you renew your PTIN, Form W-12 asks you to confirm under penalty of perjury that a WISP is in place, so the checklist below is not busywork, it is what stands behind that signature. Here it is in plain English. It applies to solo preparers and large firms alike, since the requirement follows the PTIN, not the size of the practice.
The Security Six: your technical checklist
The Security Six are the baseline technical safeguards the IRS Security Summit expects every preparer to have running. Work through them one by one.
If you cannot honestly tick all six, that is your starting to-do list. None of them is exotic or expensive, and each one closes a gap an attacker would otherwise use.
Your WISP: the written plan behind it
The Security Six are the tools. The WISP is the written plan that ties them together, and it is what the IRS expects you to produce on request. At a minimum, your plan should:
- Name a Data Security Coordinator, the person accountable for the program.
- Inventory your data: where taxpayer information lives and who can access it.
- Include a written risk assessment of how that data could be exposed.
- Document your safeguards, the Security Six plus access controls.
- Oversee service providers that touch client data.
- Keep an incident response plan, including how to report data theft to your IRS Stakeholder Liaison.
- Get reviewed and updated at least once a year.
You do not have to start from a blank page. The IRS publishes a sample WISP framework in Publication 5708 built for small and mid-size practices. And because tax firms are also financial institutions under the FTC Safeguards Rule, a solid WISP does double duty: meeting the IRS guidance generally covers much of what the Safeguards Rule asks for too. Skipping the plan is a real risk, not a paperwork nicety: firms without a documented WISP have seen cyber-insurance claims denied and their PTIN put at risk, and enforcement has only tightened heading into the 2026 season.
Where hosting fits, and where it doesn’t
Hosting your tax and accounting software can check several of the Security Six boxes at once. A hosted environment provides multi-factor authentication, encryption, managed backups, and firewall and anti-virus protection at the server, and secure remote access that reduces your reliance on a patchy VPN setup. It also gives you a service provider you can name and document for the oversight requirement. What it does not do is write your WISP, name your Data Security Coordinator, run your risk assessment, or train your staff. Those stay with your firm. Treat hosting as a strong technical foundation for the checklist, not a substitute for the plan. For a solo preparer or a small office without dedicated IT, that alone can move you from a scramble to a defensible position on several boxes. You can see how the security is built on our QuickBooks Desktop hosting page, and common questions are covered in our hosting FAQ.
This article is general information, not legal or compliance advice. Confirm your obligations against the current IRS Publication 4557 and Publication 5708 and a qualified advisor.
Common 4557 and WISP questions
Do I really need a WISP as a small tax preparer?
Yes. The IRS expects every paid preparer with a PTIN to have a written information security plan, regardless of firm size. It is not tied to a headcount, and your PTIN renewal asks you to attest that you have one.
What are the IRS Security Six?
Anti-virus software, firewalls, multi-factor authentication, backup software or services, drive encryption, and a VPN. They are the baseline technical controls the IRS Security Summit recommends for anyone handling taxpayer data.
How does the WISP connect to PTIN renewal?
When you renew your PTIN on Form W-12, a question asks you to confirm that you have a data security plan in place. Confirming it when you do not is a false statement made under penalty of perjury, so the attestation is worth taking seriously.
Is Publication 4557 the same as the FTC Safeguards Rule?
They are complementary, not identical. Publication 4557 is IRS guidance for tax pros; the FTC Safeguards Rule is the legal requirement under the Gramm-Leach-Bliley Act. Tax firms are covered by both, and a good WISP generally addresses much of what each expects.
Does hosting make me 4557 compliant?
No. Hosting can supply several of the Security Six, MFA, encryption, backups, and server-side protection, and serve as a documented provider. You still need your own WISP, Data Security Coordinator, risk assessment, and staff training. It is a foundation, not a shortcut.
Want a secure foundation for your WISP?
A 15-minute call is enough to see which Security Six controls hosting can cover for your practice, and how remote access would work day to day.
Book a 15-min consult
Leave a Reply