The IRS Security Six, the WISP and collecting client documents

The IRS and its Security Summit partners publish the Taxes-Security-Together Checklist as the basics of cybersecurity for tax pros. It has five parts: deploy the “Security Six” measures, create a data security plan, learn about phishing scams, recognize the signs of client data theft, and create a data theft recovery plan. The checklist says federal law requires all professional tax preparers “to create and maintain an information security plan for client data”, and that the requirement is flexible enough to fit a firm of any size.

The Security Six are listed in IRS Tax Tip 2019-117: anti-virus software, a firewall, two-factor authentication, backup software or services, drive encryption and a virtual private network for remote connections.

The written plan is the subject of Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice (revised August 2024). It says tax and accounting professionals are financial institutions under the FTC Safeguards Rule “regardless of size”, and that “Your WISP must be written and accessible.” What that rule requires in detail, encryption, access controls, multi-factor authentication, service providers and the 5,000-consumer exemptions, is in our FTC Safeguards Rule guide; this page does not repeat it.

The PTIN form asks the question directly. Line 11 of Form W-12 (revised October 2025), headed Data Security Responsibilities, asks you to check yes or no to being aware that paid preparers “are required by law to create and maintain a written information security plan”, and says you must check a box.

Four of the six measures are about your own computers and network: anti-virus, firewall, backups and drive encryption. They protect documents once they are on your machines, so they apply whatever intake method you use. Two bear directly on how documents arrive.

Two-factor authentication. Every account that holds client documents, your email, your cloud storage, a portal or an upload tool, is part of the attack surface. Publication 4557 asks for multi-factor authentication “for anyone accessing customer information” and tells you to use the most secure option available for email and storage accounts as well as tax software. If documents arrive in your inbox, the inbox needs it too.

Drive encryption. It protects files on a lost or stolen laptop. It does nothing for copies that sit in a client’s sent folder, in your mailbox on the mail provider’s servers, or in a download folder on a shared office computer. The fewer places a W-2 lands, the less there is to protect.

Publication 4557’s checklist adds two items that matter at intake: “Encrypt all sensitive files/emails”, and “Limit access to taxpayer data to individuals who need to know.”

The sample WISP in Publication 5708 has an Electronic Exchange of PII Policy with two clauses. First, PII is not to be emailed in plain text “unless encryption or password protection is present”, and passwords “MUST be communicated to the receiving party via a method other than what is used to send the data”, such as a phone call or text message. Second, the firm “may use a Password Protected Portal to exchange documents containing PII upon approval of data security protocols” by the firm’s data security coordinator.

The same template asks you to collect only the PII needed for a legitimate business purpose, to list every place PII is stored, naming client portals and web-based applications among them, and to destroy records at the earliest opportunity consistent with business needs or legal retention requirements. Whatever you use to collect documents belongs on that list, with a note on who can open what it holds and when it is cleared out.

1. Decide the method and write it in the WISP. Name the tool, who approved it, and that PII is not accepted by plain email. Say what staff do if a client emails a document anyway: save it to the approved place and delete it from the mailbox.

2. Ask for only what the return needs. Start from a list, such as the Form 1040 checklist, and remove what does not apply to this client.

3. Send one link per client and the PIN or password by a different channel, as the sample policy requires: the link by email, the PIN by text or on the phone.

4. Track what is missing on your side, not in an email thread, and follow up by the channel you normally use with that client.

5. Turn on two-factor authentication for every staff account that can open received documents, and limit access to the people preparing that return.

6. When the engagement is done, move what you must keep into your records system, then revoke the link and delete the copies you do not need, following your retention schedule.

You create a request with a checklist of the documents you need, from a template or your own list, set a PIN of at least four characters, and send the client one link. The client opens it in a browser without an account, enters the PIN and uploads. Each file and its name is encrypted in the client’s browser before upload, so the server stores ciphertext; you decrypt in your own browser.

On your side you see which checklist items are still missing, and you can mark an item received, if it came another way, or not needed. If nothing has been uploaded after about three and seven days, ShieldFive emails you a reminder to follow up. Your account supports an authenticator-app code as a second sign-in factor, off until you turn it on.

Price: a new firm gets 14 days with everything unlocked, then 1 open request at a time free, with links that last up to 7 days and no client reminders. The Firm plan is €29 per seat per month or €290 per year for unlimited open requests, client reminders, your logo and links up to 90 days or with no expiry.

It does not make your practice compliant with anything. It is one tool in your plan; the WISP, the Security Six on your own machines, training and your incident plan are still yours to do.

It collects documents. It does not prepare returns, collect e-signatures on Form 8879, take payments or integrate with tax software. If your practice software already includes a portal your clients use, that is a reasonable default, and Publication 5708’s template names a portal.

Your firm name and logo appear on the upload page on the paid plan and during the 14-day trial. There are no recurring requests; you create a new request each season. You need a free ShieldFive account to create requests; only the client skips signup.

Like any web app, we serve the JavaScript that does the encryption. The guarantee is “encrypted in the client’s browser, ciphertext at rest”, not a claim that no compromised server could ever interfere. The request security page sets out the threat model.

This page summarises IRS guidance as published on irs.gov on the date at the top, with a link to each source. It is not legal advice or tax advice and does not tell you whether your practice meets its obligations. Read the publications and, where needed, ask a professional who knows your practice.