PTIN renewal opens in mid-October, and part of it asks you to acknowledge a data-security obligation. That is the WISP question, and it is the reason WISP and PTIN renewal get talked about together.
The acknowledgment itself takes one click, which is exactly why it is easy to misread. It does not certify that you have a plan. It certifies that you know you are required to have one, and that small distinction is where the weight sits. The acknowledgment is quick to make; what it commits you to is worth understanding before you check the box.
What the attestation actually says
On Form W-12, the data-security line asks you to acknowledge that you are aware of your obligation to have a written data-security plan and to protect taxpayer information. Read it closely and you will notice what it does not ask. It does not ask you to confirm you currently have a compliant plan, and it does not ask you to attach one. It asks whether you know the requirement exists. You make that acknowledgment as part of a form you sign under penalty of perjury. So the box is not proof of a WISP. It is you going on record that you know one is required.
Why it has teeth now
The weight does not come from the checkbox on its own. It comes from what sits behind it. The FTC Safeguards Rule has treated tax and accounting firms as financial institutions since 2023, and it requires a written security program regardless of firm size. The IRS backs the same expectation through Publication 4557. Put the acknowledgment next to that, and the practical effect is simple: once you have confirmed you know a WISP is required, not having one is no longer an oversight you can explain away. If a breach happens, or the IRS or an insurer asks to see your plan, the gap between what you acknowledged and what you actually built is the exposure. The attestation is the reminder. The requirement is the substance, and it was there whether or not you read the line carefully.
What to have in place before you renew
The honest to-do is short: have a real WISP, not just a checked box. That means a written plan with a named data-security coordinator, a risk assessment, the safeguards you use, staff training, a record of the vendors that touch client data, and an incident-response plan. The IRS gives you a starting framework in Publication 5708, so you are not drafting from a blank page. We walk through the whole thing in our guides to the WISP requirements and the IRS Security Six. Renewing takes fifteen minutes; the plan behind the acknowledgment is the part worth the afternoon.
If your accounting software runs in a hosted environment, part of the technical side of that plan is already covered, encryption, multi-factor authentication, managed backups, and a documentable service provider. It does not write the WISP for you, but it gives several of the safeguards a place to live. We cover that in our note on documenting your host in your WISP.
This article is general information, not legal or compliance advice. Confirm renewal dates, fees, and your obligations on IRS.gov and with a qualified advisor.
PTIN and WISP questions
Does renewing my PTIN require a WISP?
The renewal asks you to acknowledge that you are aware a written data-security plan is required, not to upload one. The WISP itself is required separately, under the FTC Safeguards Rule and IRS guidance, so you should have a real one even though the form only asks you to confirm awareness.
When does PTIN renewal open, and when is it due?
Renewal opens in mid-October for the coming filing season, and every PTIN expires December 31. Renewing early or late does not change the expiration, so there is no benefit to waiting. Check IRS.gov for the exact date, which the IRS announces each year.
How much is the PTIN fee?
The last published fee is $18.75, for 2026, made up of an IRS portion and a third-party contractor portion. The 2027 fee had not been posted as of early October, so confirm the current amount on IRS.gov before you renew. The fee is per preparer and non-refundable.
Book a 15-minute call → to talk through which safeguards hosting can cover as you build out your WISP.
Leave a Reply