Sample report. Maple Street Tax Service is a fictional firm used to show the format.
Client Data Security Check
Checked November 13, 2026

Maple Street Tax Service (sample)

The site shows a way for client documents to arrive without protection. Secure client file intake is the first safeguard the plan closes.

If you prepare returns for pay, your PTIN expires December 31, 2026, and the renewal form (W-12, line 11) asks you to confirm you know paid preparers are required by law to keep a written information security plan.
Prepared for
Maple Street Tax Service (sample), Anytown, VA
Prepared by
Michael Arthur, CIPP/US
mike@2080loyalty.com · (540) 268-0534
Scope
maplestreettax.example, maplestreettax.example/new-clients, maplestreettax.example/contact, Email: @maplestreettax.example
Maple Street Tax Service (sample) · Client Data Security Check · November 2026 · Prepared by Michael Arthur, CIPP/US01 / 11
Michael Arthur, CIPP/US
Your security plan 1 of 2
Your security plan, safeguard by safeguard

The written plan covers all 14 safeguards. This check looked only at the public website and the email domain's published records, so most rows are filled in when the plan is drafted.

  1. 01
    Qualified individual
    • Not checked from outside. Covered in the plan.

    In the plan: The plan names one person in charge of it.

    ○ Not checked from outside
  2. 02
    Risk assessment
    • Not checked from outside. Covered in the plan.

    In the plan: The plan maps where client data arrives, where it lives and where it leaves.

    At 5,000 or more clients: the risk assessment is written down.

    ○ Not checked from outside
  3. 03
    Access controls
    • Not checked from outside. Covered in the plan.

    In the plan: Only the people who need client data can open it, and the plan lists who they are.

    ○ Not checked from outside
  4. 04
    Encryption of client data, in transit and at rest
    • HTTPS in use

    In the plan: Client data is encrypted on the website, in email and on every device that stores it.

    ✓ Looks good from outside
  5. 05
    Secure client file intake
    • A form collects SSNs or bank details without encryption
    • The site asks clients to email their tax documents

    Fix: Remove those fields from the website form and collect them in a secure portal instead. Point clients to a secure upload portal and change the sentence to say so.

    ● Fix
  6. 06
    Multi-factor authentication
    • Not checked from outside. Covered in the plan.

    In the plan: Anyone who opens client data signs in with a second step, including in tax software.

    ○ Not checked from outside
  7. 07
    Email and transmission security
    • No DMARC policy tells mail servers to reject fakes
    • SPF soft fail (~all): v=spf1 include:mail.example ~all
    • Mail handled by another provider

    Fix: Publish a DMARC record with reports turned on, then move it to quarantine or reject.

    ● Fix
Maple Street Tax Service (sample) · Client Data Security Check · November 2026 · Prepared by Michael Arthur, CIPP/US02 / 11
Michael Arthur, CIPP/US
Your security plan 2 of 2
Your security plan, safeguard by safeguard (continued)
  1. 08
    Client privacy and security notice
    • No page explains how client data is protected

    Fix: Add a short privacy and security page: how you collect, store, and dispose of client documents.

    ● Fix
  2. 09
    Employee training
    • Not checked from outside. Covered in the plan.

    In the plan: Staff get security training when they start and once a year after that.

    ○ Not checked from outside
  3. 10
    Vendor and service provider oversight
    • Not checked from outside. Covered in the plan.

    In the plan: Vendors who touch client data agree in writing to protect it.

    ○ Not checked from outside
  4. 11
    Monitoring, logging and testing
    • Not checked from outside. Covered in the plan.

    In the plan: Access to client data is logged and the safeguards are tested on a schedule.

    At 5,000 or more clients: yearly penetration testing and scans every six months.

    ○ Not checked from outside
  5. 12
    Incident response
    • Not checked from outside. Covered in the plan.

    In the plan: The plan says who does what after a breach: notify the FTC within 30 days of a breach affecting 500 or more people, and Virginia preparers also notify the Virginia Department of Taxation.

    At 5,000 or more clients: the incident response plan is written down, with a yearly written report to the owner.

    ○ Not checked from outside
  6. 13
    Data retention and secure disposal
    • Not checked from outside. Covered in the plan.

    In the plan: Client files are kept for a set period, then shredded or securely wiped, paper and digital.

    This applies to paper files as well as digital ones.

    ○ Not checked from outside
  7. 14
    Keeping the plan current
    • Not checked from outside. Covered in the plan.

    In the plan: The plan is reviewed every year and updated whenever the office changes.

    ○ Not checked from outside
Maple Street Tax Service (sample) · Client Data Security Check · November 2026 · Prepared by Michael Arthur, CIPP/US03 / 11
Michael Arthur, CIPP/US
Summary
Summary: the score covers only what can be checked from outside
45/100
Grade D
4 problems found
Urgent
2
High
1
Medium
1
Website
  • ● No page explains how client data is protected
  • ✓ HTTPS in use
Fix
Client intake
  • ● A form collects SSNs or bank details without encryption
  • ● The site asks clients to email their tax documents
Fix
Email domain
  • ● No DMARC policy tells mail servers to reject fakes
  • ✓ SPF soft fail (~all): v=spf1 include:mail.example ~all
  • ✓ Mail handled by another provider
Fix
Fix these first
  1. 01A form collects SSNs or bank details without encryption
  2. 02No DMARC policy tells mail servers to reject fakes
  3. 03No page explains how client data is protected

* Score covers only what can be checked from outside your office. Formula: 100 − 20 per Urgent − 10 per High − 5 per Medium, minimum 0. A 90+, B 75–89, C 60–74, D 40–59, F under 40.

Maple Street Tax Service (sample) · Client Data Security Check · November 2026 · Prepared by Michael Arthur, CIPP/US04 / 11
Michael Arthur, CIPP/US
Finding 01 of 04
01of 04
● UrgentSafeguard 5 · Secure client file intake

A form collects SSNs or bank details without encryption

A form on the site asks for Social Security numbers, birth dates, or bank numbers and sends them unencrypted.

Evidence
https://maplestreettax.example/new-clients
Fields: full_name, ssn, date_of_birth, routing_number
Where to see it

The page and fields shown in the evidence box.

Why it puts client data at risk

SSNs and bank numbers are exactly what someone filing a fake return needs.

The fix

Remove those fields from the website form and collect them in a secure portal instead.

Maple Street Tax Service (sample) · Client Data Security Check · November 2026 · Prepared by Michael Arthur, CIPP/US05 / 11
Michael Arthur, CIPP/US
Finding 02 of 04
02of 04
● HighSafeguard 5 · Secure client file intake

The site asks clients to email their tax documents

Clients are told to send W-2s and other documents by email.

Evidence
https://maplestreettax.example/contact
"Email your W-2s and 1099s to us and we will get started."
Where to see it

The sentence shown in the evidence box, on the page listed.

Why it puts client data at risk

Plain email copies W-2s and SSNs into inboxes and servers you don't control, where they stay.

The fix

Point clients to a secure upload portal and change the sentence to say so.

Maple Street Tax Service (sample) · Client Data Security Check · November 2026 · Prepared by Michael Arthur, CIPP/US06 / 11
Michael Arthur, CIPP/US
Finding 03 of 04
03of 04
● UrgentSafeguard 7 · Email and transmission security

No DMARC policy tells mail servers to reject fakes

No DMARC policy is published, so receiving mail servers have no instruction to reject email faked from your address.

Evidence
No TXT record at _dmarc.maplestreettax.example
Where to see it

The domain's DNS records (TXT at _dmarc).

Why it puts client data at risk

Without DMARC, a fake “upload your W-2 here” email can look like it came from the firm.

The fix

Publish a DMARC record with reports turned on, then move it to quarantine or reject.

Maple Street Tax Service (sample) · Client Data Security Check · November 2026 · Prepared by Michael Arthur, CIPP/US07 / 11
Michael Arthur, CIPP/US
Finding 04 of 04
04of 04
● MediumSafeguard 8 · Client privacy and security notice

No page explains how client data is protected

I didn't find a privacy or security page on the pages checked.

Evidence
3 pages checked on maplestreettax.example
Where to see it

The pages listed in the evidence box.

Why it puts client data at risk

Clients can't tell how their documents are handled, and a fraudster can't tell you're watching.

The fix

Add a short privacy and security page: how you collect, store, and dispose of client documents.

Maple Street Tax Service (sample) · Client Data Security Check · November 2026 · Prepared by Michael Arthur, CIPP/US08 / 11
Michael Arthur, CIPP/US
Action plan
Action plan

Four weeks

WEEK 1
Close what's visible

Fix the findings in this report.

WEEK 2
Map the practice

A 30-minute call: where client files arrive, live, and leave.

WEEK 3
Write the plan

Drafted from IRS Publication 5708, fitted to your office.

WEEK 4
Adopt it

You review and sign, staff acknowledge, and a yearly review date is set.

Maple Street Tax Service (sample) · Client Data Security Check · November 2026 · Prepared by Michael Arthur, CIPP/US09 / 11
Michael Arthur, CIPP/US
Next step
Next step

Renew your PTIN knowing the plan behind that Yes is written down.

  1. 01
    A 15-minute call
  2. 02
    I draft the plan
  3. 03
    You review and adopt it
Pricing
  • Written security plan$495 one time + $295/yr
Michael Arthur, CIPP/US
mike@2080loyalty.com
(540) 268-0534
Book a 15-minute call

This isn't legal advice. The plan is yours to review and adopt.

Maple Street Tax Service (sample) · Client Data Security Check · November 2026 · Prepared by Michael Arthur, CIPP/US10 / 11
Michael Arthur, CIPP/US
What happens next
What happens next

A written security plan for your practice, built on the IRS Publication 5708 outline and delivered within 48 hours, email security setup included. $495 for the first 25 firms through December 31, $295 a year to renew. If it's late or you don't like it, you pay nothing.

Book a 15-minute call

Michael Arthur, CIPP/US

Maple Street Tax Service (sample) · Client Data Security Check · November 2026 · Prepared by Michael Arthur, CIPP/US11 / 11