Contents
- 01
Work out what the plan has to cover
- 02
Find the upload page in it
- 03
Write it in and keep it true
Does a data security plan for tax preparers have to cover the website?
Yes, when client files reach the firm through its own site. The plan’s scope is “all taxpayer information,” and the upload page carries taxpayer information, so the page belongs in the plan. The step from that scope language to the website is our reading of it, not an IRS sentence.
Two cases need little or nothing.
How the written plan is built, and where the rule comes from
The rule behind the attestation
The IRS Security Summit release IR-2025-79, dated July 29, 2025, says “The Gramm-Leach-Bliley Act (GLBA) requires all financial institutions to protect customer data,” and that “tax and accounting professionals are considered financial institutions.” The regulation is the FTC Safeguards Rule, 16 CFR Part 314.
Form W-12 (Rev. 10-2025), line 11, carries the attestation:
Form W-12, line 11“I am aware that paid tax return preparers are required by law to create and maintain a written information security plan … that provides data and system security protections for all taxpayer information.”
The wording is “I am aware.” It attests awareness, not that the plan is complete or covers any particular system.
The IRS template, Publication 5708
Publication 5708 (Rev. 8-2024) is the IRS template. The IRS term is WISP, short for written information security plan, and this is the IRS WISP. It sets out seven steps:
-
IDefine the WISP objectives, purpose, and scope
-
IIDesignate a qualified individual
-
IIIAssess Risks
-
IVInventory Hardwarewhere a hosted page can slip through (our reading)
-
VDocument Safety Measures in place
-
VIDraft an implementation clause
-
VIIAttachments
Step IV is hardware. A hosted web page is not obviously prompted by that step, so a template filled in step by step can be finished without listing the upload page. That is our reading of the template, not an IRS statement. Pub 5708 does not name websites or upload pages as such.
Why the client upload page sits inside the plan’s scope
The IRS documents already use web wording.
Refers to “Online (Web-based) applications, portals, and cloud software applications such as Box.” It also says “The Firm may use a Password Protected Portal to exchange documents containing PII upon approval.”
Names websites twice: “If hosting your own website, also consider some other form of multifactor authentication” and “If you collect information online directly from customers, make secure transmission automatic.”
Says “The risk assessment shall be written and shall include:” and in our reading, a system that holds client files belongs in it.
Read Publication 4557 (Rev. 6-2024) in full for the website lines.
Pub 5708 exempts tax software vendors and e-Filing transmitters from its third-party limits. That exemption does not reach a separately hosted website. To see what state the site is in, start with how to check whether your website is secure.
What the plan says about the upload page when it covers it
Which of these the firm does is for the firm and its Qualified Individual to decide.
| Element | Where it comes from | What the plan records |
|---|---|---|
|
Scope
|
Pub 5708 Scope; 314.4(b)(1) | The upload page and wherever the files are stored |
|
Responsible person
|
314.4(a): “Designate a qualified individual responsible for overseeing and implementing your information security program.” | Who owns the page |
|
Who maintains it
|
314.4(f): “Oversee service providers, by:” | The maintainer, if a third party |
|
Access and MFA
|
314.4(c)(1), (c)(5): “Implement multi-factor authentication for any individual accessing any information system.” | Who can log in, and how |
|
Encryption
|
314.4(c)(3): “Protect by encryption all customer information held or transmitted by you.” | How files travel and where they rest |
|
Monitoring
|
314.4(c)(8): “Implement policies, procedures, and controls designed to monitor and log the activity of authorized users.” | What is watched |
|
Incident
|
314.4(h): written incident response plan | What happens if the page is exposed |
The FTC notification rule in 314.4(j) belongs in the incident row. From the Federal Register notice:
314.2(m), notification event“acquisition of unencrypted customer information without the authorization of the individual to which the information pertains.”
See how NoDrama approaches WordPress security.
How to add the upload path to your plan
Five edits, one line each:
- 01
Name the upload page in the Scope section and in the list of places PII is stored.
- 02
Name who maintains the site it sits on, and whether that is a service provider under 314.4(f).
- 03
Record how logins to the site work, including MFA.
- 04
Record how files travel and where they land.
- 05
Record what is monitored and what happens on an incident, pointing to the firm’s incident response plan.
Where the site runs on WordPress, the maintenance can be written into the plan as a procedure. NoDrama’s plans include “WordPress, plugins and themes kept current,” “Scanned for malware every 12 hours,” and “Backed up offsite, kept 90 days,” plus reporting. That supports compliance work. It does not make a firm compliant. See the three NoDrama plans and what each covers.
Read the finished plan against the upload path from end to end. Every system a client file touches, from the page to wherever it is stored, should appear in the Scope and have a named owner. If one step has no owner, the plan is not yet true of it.
Ask what your plan says about the upload page.
If the answer is nothing, NoDrama’s free WordPress audit is a place to start with the site it sits on.
Common misreadings of the plan requirement
What WordPress hardening covers lists the maintenance a plan can describe.
What this does not solve
This is not legal advice and not a plan review. It does not write the plan, designate the Qualified Individual, or decide whether the firm meets 16 CFR 314. It does not cover state-specific rules.
NoDrama maintains and secures WordPress sites. It does not set up MFA, encrypt uploads, or operate client portals, and none of those is a listed plan item.
The plan should be true of the upload page too
A data security plan for tax preparers is attested to every year and has to describe every system it claims to cover. If clients upload files through your own site, the plan should name that page, name who maintains it, and record how access, transit, monitoring and incidents are handled. No IRS text says so by name, so this is a reading of the scope language, and the call belongs to the firm and its Qualified Individual.