When you renew your PTIN, Form W-12 Line 11 asks you to confirm that you are aware paid preparers "are required by law to create and maintain a written information security plan". Most firms have the plan. Fewer can show, quickly, that they ran it this year.
This Excel / Google Sheets workbook is the evidence layer: MFA register, quarterly access reviews, training log, vendor register, device inventory, incident log and a signed annual review, each mapped to IRS Pub 5708, Pub 4557 and the FTC Safeguards Rule (16 CFR 314). With a 30-minute evidence-check guide (PDF). No macros. Example data is fictional.
Try the free WISP readiness checker first (20 yes/no questions, nothing uploaded), or read the WISP annual review checklist.
Solo
$49
- Workbook (blank + fictional example)
- Pre-sized for up to 5 staff (add rows for more)
- 20-area Annual Review with sign-off
- 30-minute WISP evidence check (PDF + Markdown)
- One firm
Firm
$99
- Everything in Solo
- Pre-sized for 15 staff
- Seasonal Staff sheet: onboarding and offboarding per season, red if accounts stay open
- One firm, all offices
14-day money-back guarantee: email labskaruna@gmail.com within 14 days of purchase for a full refund, no questions asked. (refund policy) · or buy on Gumroad
What the workbook tracks
| Sheet | Maps to | What it does |
|---|---|---|
| Systems & MFA | 16 CFR 314.4(c)(5); Pub 4557 | Every system that holds or reaches taxpayer data, MFA status, last verified, evidence. MFA off turns red. |
| People & Access | 314.4(c)(1); Pub 5708 Attachment F | Everyone with PII access, signed acknowledgment, training, leavers with accounts still open. |
| Access Reviews | 314.4(c)(1) "periodically reviewing" | Quarterly review log: accounts checked, removed, issues, evidence. |
| Training Log | 314.4(e); Pub 5708 annual training | Who was trained, when, on what. Flags anyone with PII access and no training in 12 months. |
| Vendors | 314.4(f) | Safeguards clause in the contract? Last assessed? Evidence. |
| Devices | 314.4(c)(2)-(3); Pub 4557; Pub 5708 Attachment E | Encrypted, anti-malware, automatic updates, last checked, disposal. |
| Incidents | 314.4(h), (j); Pub 4557 | Incident log with the FTC 30-day notice date for events of 500+ consumers and the IRS Stakeholder Liaison report. |
| Annual Review + sign-off | 314.4(g), (i); Pub 5708 | 20 areas with status and evidence, an evidence score, and a sign-off for the Qualified Individual and senior officer. |
Before you renew your PTIN: the 30-minute check
- Settings: firm, Qualified Individual, senior officer, consumer count, WISP date.
- Systems & MFA: one row per system; screenshot the security settings as evidence.
- People & Access: signed acknowledgments; leavers' accounts disabled.
- Training, Vendors, Devices: annual training, a safeguards clause per vendor, encrypted laptops.
- Annual Review: read the red rows, assign fixes, sign off, re-date your WISP.
PTINs expire on 31 December each year, and the IRS says renewal generally opens in mid-October. The IRS had not published the 2027 renewal fee when we checked (9 Oct 2026).
Sources (checked 9 Oct 2026)
FAQ
- Is this a WISP template?
- No. Start with the free IRS Publication 5708 sample WISP for the plan itself. This workbook keeps the records that show the plan is running: MFA checks, access reviews, training, vendors, devices, incidents and the annual review.
- Does it make my firm compliant?
- No. It is a record-keeping template, not legal, tax, compliance or IT-security advice. It organises the work and the evidence; you still need to read 16 CFR Part 314 and the IRS publications and take advice for your firm.
- Does it work in Google Sheets?
- Yes. Use File > Import > Upload. No macros or scripts; formulas, dropdowns and red/amber/green flags carry over. Excel and LibreOffice work too.
- We have fewer than 5,000 clients. Does any of this apply?
- 16 CFR 314.6 says four elements, 314.4(b)(1), (d)(2), (h) and (i), do not apply to institutions holding customer information on fewer than five thousand consumers. The rest of 314.4, including MFA, encryption, training and vendor oversight, still applies. The workbook marks those four rows 'Not required? (see note)' so you can decide.
- Solo or Firm?
- Solo ($49) is pre-sized for up to 5 staff. Firm ($99) is pre-sized for 15 staff and adds the Seasonal Staff sheet for per-season onboarding and offboarding. Both are for one firm.
- Can I get a refund?
- 14-day money-back guarantee: email labskaruna@gmail.com within 14 days of purchase for a full refund, no questions asked.
Please read: Record-keeping template only. Not legal, tax, compliance or IT-security advice, and using it does not make your firm compliant with the FTC Safeguards Rule or any IRS requirement. Not affiliated with or endorsed by the IRS or the FTC. Read 16 CFR Part 314 and IRS Publications 5708 and 4557 yourself and get qualified advice for your firm. Rule references were checked on 9 Oct 2026. Example data is fictional.