Every year you renew your PTIN, you sign that your office has a written data security plan. Most offices are relying on a template somebody downloaded. I come out, look at what you actually have running, and write the plan around what I find. Flat $1,500.
The FTC's Safeguards Rule treats tax preparers as financial institutions. IRS Publication 4557 lays out what your security plan is supposed to contain. And Form W-12 — your PTIN renewal — includes a line where you confirm you have one.
That last part is the one worth sitting with. It isn't a suggestion buried in a regulation somewhere. It's a statement you sign, with your name on it, every year.
The IRS publishes a free template, and it's a real starting point. But a template is a shell. It still needs your data inventory, your systems, your vendors, your people, and an honest look at your risks. Filled in generically, it describes a firm that isn't yours — and that's the version that doesn't hold up when somebody actually reads it.
Everything in one flat price. No hourly creep, no line items you didn't agree to.
Same as any other job I do — I tell you what it costs before I start, and you know what you're getting.
The visit isn't an add-on. It's the part that makes the plan yours.
Single-location office, roughly fifteen people or fewer. On-site visit included.
More than about fifteen people, more than one location, or healthcare data in the mix.
You'll find outfits online that'll write you a plan for five or six hundred dollars. They're legitimate businesses. It's worth knowing what you're comparing.
Writes the plan from a phone call or an online questionnaire. They've never seen your office, your server closet, or the sticky note on the monitor. The plan describes what you told them over the phone.
I drive out and confirm the things a security plan is supposed to claim are actually true. Then I write it. And I'm twenty minutes away in March when something goes wrong.
If a document on file is genuinely all you need, buy theirs — I'd rather tell you that than sell you something you don't want. If you'd rather have somebody local who has actually looked at your setup, that's what this is.
Straight answers before you pick up the phone.
No — and be careful of anybody who tells you it does. I build the plan to the structure the FTC Safeguards Rule and IRS Publication 4557 describe. Whether your firm is compliant depends on your practices over time, not on a document, and nobody can promise you how a regulator or an examiner will look at it. What you get is a real plan, built from your real setup, that says what it's supposed to say.
Same reason your clients pay you instead of using free filing software. The form is available to everybody — knowing what belongs in it is the work. The template still needs your data inventory, your risk assessment, your vendor list, and an incident procedure with real names and real phone numbers in it. That's ten to twenty hours done properly, and most offices never get to it.
Usually an hour to two hours depending on the size of your office. I work around your schedule — early morning or late afternoon is fine, and I'd rather not be underfoot during your busy stretch.
I write it down and tell you about it. The plan documents where you actually stand, gaps included. If you want those gaps closed, that's separate work and I'll quote it separately — you're under no obligation to have me do it.
The requirement applies regardless of size, but the work scales with you. More than about fifteen people, multiple locations, or healthcare data in the mix — call me and we'll talk about what you actually need. The flat price is built for a single-location office.
Tax preparers and CPA offices are the most common because of the PTIN certification. Title and escrow firms have overlapping obligations through ALTA Best Practices and their underwriters, and wire fraud makes it urgent for them. If you handle client financial data, this probably applies to you.
Me. Hayden Wyly, Fort Worth native, ten-plus years in IT. Same person on the phone, at the visit, and when you call in March. Not a dispatch center, not a remote operation with a Fort Worth phone number.
Ten minutes, no obligation. I'll ask a few questions about your office and tell you straight whether this is worth doing for you.