Study guide
30.5 Record Retention & Data Security (WISP)
Enrolled Agent EA
Track your progress as you read
Finished sections get a check mark.
1 Part 1, Chapter 1: Tax Return Basics & Filing Requirements
1.1 Form 1040 Overview & Structure 1.2 Form 1040-SR for Seniors 1.3 Who Must File (Income Thresholds) 1.4 Filing Deadlines & Extensions (Form 4868) 1.5 Penalties: Failure to File vs. Failure to Pay 1.6 Sources of Tax Information (W-2s, 1099s, K-1s) 1.7 Preparer Due Diligence Requirements 1.8 Amended Returns (Form 1040-X)
2 Part 1, Chapter 2: Filing Status & Dependents
2.1 Single & Married Filing Jointly 2.2 Married Filing Separately 2.3 Head of Household Requirements 2.4 Qualifying Surviving Spouse 2.5 Qualifying Child Test (5 Tests) 2.6 Qualifying Relative Test (4 Tests) 2.7 SSN, ITIN & Residency Status
3 Part 1, Chapter 3: Wages & Employee Compensation
3.1 W-2 Income & Withholding 3.2 Employee vs. Independent Contractor 3.3 1099-NEC, 1099-MISC & 1099-K Reporting 3.4 Fringe Benefits (Taxable vs. Non-Taxable) 3.5 Stock Options (ISO vs. NQSO) 3.6 Special Categories (Clergy, Military, Foreign)
4 Part 1, Chapter 4: Interest, Dividends & Other Income
4.1 Taxable vs. Tax-Exempt Interest 4.2 US Savings Bonds & OID 4.3 Ordinary vs. Qualified Dividends 4.4 Schedule B Requirements 4.5 Rental & Royalty Income Basics 4.6 Alimony, Gambling & Other Income 4.7 Cancelled Debt & Form 1099-C 4.8 Net Operating Loss (NOL)
5 Part 1, Chapter 5: Capital Gains & Property Transactions
5.1 Capital vs. Non-Capital Assets 5.2 Cost Basis Calculation 5.3 Inherited & Gifted Property Basis 5.4 Short-Term vs. Long-Term Gains 5.5 Capital Gains Tax Rates (0%, 15%, 20%) 5.6 Netting & the $3,000 Loss Limit 5.7 Wash Sales & Related Party Rules 5.8 Sale of Primary Residence (Section 121) 5.9 Installment Sales (Form 6252) 5.10 Like-Kind Exchanges (Section 1031)
6 Part 1, Chapter 6: Adjustments to Income
6.1 Educator Expenses & HSA Contributions 6.2 Self-Employment Tax Deduction 6.3 IRA Contributions (Traditional) 6.4 Student Loan Interest Deduction 6.5 Alimony Paid (Pre-2019 Divorces) 6.6 Other Adjustments & New OBBBA Deductions (Tips, Overtime, Auto Loan, Senior Bonus)
7 Part 1, Chapter 7: Deductions (Standard & Itemized)
7.1 Standard Deduction by Filing Status 7.2 Medical & Dental Expenses (7.5% Floor) 7.3 State & Local Taxes (SALT $40K Cap) 7.4 Mortgage Interest Deduction 7.5 Charitable Contributions 7.6 Casualty & Theft Losses 7.7 QBI Deduction (Section 199A)
8 Part 1, Chapter 8: Tax Calculation & Credits
8.1 Tax Tables & Rate Schedules 8.2 Alternative Minimum Tax (AMT) 8.3 Self-Employment Tax Calculation 8.4 Child Tax Credit & Additional CTC 8.5 Earned Income Tax Credit (EITC) 8.6 Education Credits (AOC & LLC) 8.7 Child & Dependent Care Credit 8.8 Other Credits (Saver's, Premium Tax)
9 Part 1, Chapter 9: Retirement Accounts & Social Security
9.1 Traditional vs. Roth IRA 9.2 401(k), 403(b) & TSP Basics 9.3 SEP-IRA & SIMPLE IRA 9.4 Required Minimum Distributions (RMDs) 9.5 Early Withdrawal Penalties & Exceptions 9.6 Social Security Taxation
10 Part 1, Chapter 10: Specialized Individual Returns
10.1 Estate Tax (Form 706) 10.2 Gift Tax (Form 709) 10.3 Foreign Income (Form 2555) 10.4 FBAR & FATCA Reporting 10.5 Farm Income (Schedule F) 10.6 Disaster Area Rules
11 Part 2, Chapter 11: Business Entity Types
11.1 Overview of Entity Types 11.2 State Law vs. Tax Classification 11.3 Entity Selection: Reasonable Comp & QBI 11.4 Form 8832 & Rev. Proc. 2009-41 11.5 LLC Deep Dive: Spouses & EINs 11.6 Changing Status: The 60-Month Rule
12 Part 2, Chapter 12: Starting a Business
12.1 Hobby vs. Business (Profit Motive) 12.2 Employer Identification Number (EIN) 12.3 Tax Year Selection 12.4 Recordkeeping Requirements 12.5 Statute of Limitations 12.6 Related Party Transactions 12.7 Start-Up Costs, Entity Choice & OBBBA Business Changes (2025)
13 Part 2, Chapter 13: Worker Classification & Payroll
13.1 Employee vs. Independent Contractor 13.2 Common Law Test (Behavioral, Financial, Relationship) 13.3 Statutory Employees & Non-Employees 13.4 Form 941 & Payroll Deposits 13.5 Trust Fund Recovery Penalty 13.6 FUTA & Unemployment Taxes
14 Part 2, Chapter 14: Accounting Methods & Income
14.1 Cash vs. Accrual Method 14.2 Hybrid Methods & Changes 14.3 Inventory & COGS 14.4 Gross Receipts & Income Recognition 14.5 Constructive Receipt 14.6 Form 1099 Reporting Requirements 14.7 §163(j) Business Interest Expense Limitation 14.8 §174 Research & Experimental Expenditures
15 Part 2, Chapter 15: Depreciation & Asset Treatment
15.1 MACRS Basics & Recovery Periods 15.2 Mid-Month, Mid-Quarter, Half-Year Conventions 15.3 Section 179 Expense Deduction 15.4 Bonus Depreciation 15.5 Listed Property Rules 15.6 Amortization of Intangibles 15.7 Depletion 15.8 Disposition of Business Assets
16 Part 2, Chapter 16: Business Deductions
16.1 Ordinary & Necessary Test 16.2 Business Travel Expenses 16.3 Business Meals (50% Limitation) 16.4 Business Use of Vehicle 16.5 Home Office Deduction 16.6 Business Interest Limitation (163(j)) 16.7 Business Bad Debts
17 Part 2, Chapter 17: Business Credits & Fringe Benefits
17.1 General Business Credit Overview 17.2 R&D Credit & Disabled Access Credit 17.3 Small Employer Health Insurance Credit 17.4 Fringe Benefit Rules 17.5 Cafeteria Plans (Section 125) 17.6 Achievement Awards & Other Benefits
18 Part 2, Chapter 18: Sole Proprietorships
18.1 Schedule C Overview 18.2 Calculating Net Profit/Loss 18.3 Self-Employment Tax (Schedule SE) 18.4 Estimated Tax Payments 18.5 Hobby Loss Rules
19 Part 2, Chapter 19: Partnerships
19.1 Partnership Formation 19.2 Partner's Basis Calculation 19.3 Form 1065 Overview 19.4 Schedule K-1 (Partner's Share) 19.5 Guaranteed Payments 19.6 Partnership Distributions 19.7 At-Risk & Passive Activity Rules 19.8 Partnership Termination & Liquidation
20 Part 2, Chapter 20: C Corporations
20.1 Form 1120 Overview 20.2 Corporate Tax Rate (21%) & CAMT 20.3 Accumulated Earnings Tax 20.4 Dividends Received Deduction 20.5 Earnings & Profits (E&P) 20.6 Corporate Distributions, Dividends & Stock Redemptions 20.7 §351 Transfers, §1032, §1202 QSBS & Other Corporate Provisions 20.8 Corporate Liquidation
21 Part 2, Chapter 21: S Corporations
21.1 S Election Requirements (Form 2553) 21.2 Form 1120-S Overview 21.3 Shareholder Basis Calculation 21.4 Reasonable Compensation 21.5 S Corporation Distributions 21.6 Built-In Gains Tax & Termination
22 Part 2, Chapter 22: Specialized Business Returns
22.1 Trusts & Estates (Form 1041) 22.2 Simple vs. Complex Trusts 22.3 Distributable Net Income (DNI) 22.4 Tax-Exempt Organizations (Form 990) 22.5 Retirement Plans (Form 5500) 22.6 Qualified Retirement Plans Overview 22.7 Farm Taxation 22.8 Rental Real Estate Activities
23 Part 3, Chapter 23: Practice Before the IRS
23.1 What is Practice Before the IRS? 23.2 Who Can Practice (Full Rights) 23.3 Limited Practice Rights (AFSP, Unenrolled) 23.4 Special Relationships (Family, Employees) 23.5 PTIN Requirements 23.6 Circular 230 Overview 23.7 Office of Professional Responsibility (OPR)
24 Part 3, Chapter 24: Becoming & Maintaining EA Status
24.1 Two Paths to EA (Exam vs. IRS Experience) 24.2 Application Process (Form 23) 24.3 Background & Compliance Checks 24.4 Renewal Requirements (Form 8554) 24.5 Continuing Education Requirements 24.6 Inactive Status & Termination
25 Part 3, Chapter 25: Practitioner Duties (Circular 230)
25.1 Due Diligence Requirements 25.2 Knowledge of Client's Omission 25.3 Conflict of Interest Rules 25.4 Fee Requirements (Contingent, Unconscionable) 25.5 Advertising & Solicitation Rules 25.6 Tax Return Position Standards 25.7 Written Advice Standards 25.8 Sanctions & Penalties for Violations
26 Part 3, Chapter 26: Power of Attorney & Authorization
26.1 Form 2848 (Power of Attorney) 26.2 CAF (Centralized Authorization File) 26.3 Form 8821 (Tax Information Authorization) 26.4 Third-Party Designee 26.5 Signing Returns for Taxpayers 26.6 Client Confidentiality & Privilege 26.7 Representing Clients in Audits (Examination) 26.8 Appealing IRS Decisions 26.9 Collection Representation
27 Part 3, Chapter 27: Legal Authority & Research
27.1 Hierarchy of Tax Authority 27.2 Internal Revenue Code 27.3 Treasury Regulations 27.4 Revenue Rulings & Procedures 27.5 Court Cases & Precedent 27.6 Statutes of Limitations
28 Part 3, Chapter 28: Specific Representation Issues
28.1 Trust Fund Recovery Penalty (TFRP) 28.2 Innocent Spouse Relief (Form 8857) 28.3 Injured Spouse Allocation (Form 8379) 28.4 Penalty Abatement (FTA & Reasonable Cause) 28.5 Taxpayer Advocate Service (TAS) 28.6 Freedom of Information Act (FOIA)
29 Part 3, Chapter 29: Final Review & Exam Strategy
29.1 Exam Structure & Logistics (2026-2027) 29.2 The "Clock" of Representation (Master Deadlines) 29.3 Ethics vs. Law (Sanctions & Penalties) 29.4 Final Mock Review & Exam Strategy
30 Part 3, Chapter 30: Filing Process & E-File
30.1 E-File Requirements (The "More Than 10 Returns" Rule) 30.2 ERO Responsibilities 30.3 EFIN & Application Process 30.4 Form 8879 (Signature Authorization) 30.5 Record Retention & Data Security (WISP) 30.6 Preparer Penalties (Filing Specific)
30.5 Record Retention & Data Security (WISP)
Key Takeaways Explain This Topic AI
Retention: 3 Years for signing docs (8879) from due/file date.
Data Security: All preparers must have a Written Information Security Plan (WISP).
Mandated by the FTC "Safeguards Rule" under the Gramm-Leach-Bliley Act.
Must protect taxpayer data with firewalls, encryption, and physical locks.
Data Breach: Report to IRS Stakeholder Liaison ASAP to secure EFIN/PTIN.
Last updated: October 2026
- Data Security: The WISP Requirement
- Why This Matters for the Exam
Data security is a growing emphasis on the EA exam because identity theft and data breaches are significant risks for tax preparers. The exam tests your knowledge of the WISP (Written Information Security Plan) requirement, retention periods, and what to do in case of a breach.
The IRS Publication 4557 ("Safeguarding Taxpayer Data") is the primary reference for this topic.
The WISP (Written Information Security Plan)
WISP - A written plan that documents how a tax preparer protects taxpayer information from unauthorized access, use, or disclosure.
Legal Foundation
The WISP requirement comes from the FTC Safeguards Rule , which implements the Gramm-Leach-Bliley Act (GLBA). The GLBA applies to all financial institutions, including tax preparers, because they handle sensitive financial information.
Who Must Have a WISP?
All professional tax return preparers (whether they e-file or paper file).
Solo practitioners, small firms, and large corporate preparers alike.
Exemptions: None. Even if you prepare only one return per year, you must have a WISP if you are paid to prepare returns.
WISP Requirements
A compliant WISP must include the following elements:
1. Designate a Security Officer
One individual must be responsible for overseeing the WISP. For a solo practitioner, this is the practitioner themselves. For a firm, it's typically a partner or manager.
Responsibilities:
Implementing the security plan.
Training staff on security protocols.
Monitoring compliance.
2. Identify Risks
The plan must document potential risks to taxpayer data, such as:
Physical risks: Theft of paper files, unlocked file cabinets.
Electronic risks: Hacking, malware, unencrypted email.
Human risks: Employee error, social engineering attacks.
3. Implement Safeguards
The plan must detail specific safeguards to mitigate identified risks:
Physical Safeguards: Locked file cabinets, restricted office access, shredding of paper documents.
Electronic Safeguards:
Encryption of taxpayer data (both at rest and in transit).
Firewalls and antivirus software.
Multi-Factor Authentication (MFA) or Two-Factor Authentication (2FA) for all systems.
Regular software updates and patches.
Administrative Safeguards:
Background checks for employees with access to taxpayer data.
Confidentiality agreements for all staff.
Secure disposal of data (shredding, wiping hard drives).
2024-2026 Emphasis: The IRS has increasingly emphasized MFA/2FA as a critical safeguard. Exam questions may focus on whether specific authentication methods meet IRS standards.
4. Monitor Effectiveness
The plan must include procedures for regularly testing and updating the security measures. This includes:
Annual security audits.
Monitoring for suspicious activity (e.g., unauthorized login attempts).
Updating the WISP when new risks emerge (e.g., new types of cyber attacks).
Record Retention
- Document Retention Period Notes
- Form 8879 3 Years From due date or filing date, whichever is later
- Tax Return Copy 3 Years Must be available to client on request
- W-2 / 1099 3 Years Or until statute of limitations expires
- Employment Tax Records 4 Years Payroll records (if applicable)
Note: The 3-year retention period aligns with the IRS's statute of limitations for assessment (IRC §6501).
Data Breach Response
If a tax preparer suffers a data breach (e.g., hacking, stolen laptop), they must take immediate action:
Step 1: Contact the IRS Stakeholder Liaison
The preparer must contact the IRS Stakeholder Liaison in their state as soon as possible. The Liaison will:
Help secure the preparer's EFIN and PTIN.
Stop fraudulent returns from being filed using stolen data.
Provide guidance on next steps.
How to Find Your Liaison: Visit IRS.gov and search for "Stakeholder Liaison" + your state.
Step 2: Notify Affected Clients
The preparer must notify all clients whose data may have been compromised. This notification should include:
What happened (nature of the breach).
What data was affected (SSNs, bank account numbers, etc.).
What the preparer is doing to address it.
What clients should do (e.g., monitor credit reports, file IRS Form 14039 for identity theft protection).
Step 3: Report to Law Enforcement
The preparer should file a report with local law enforcement and the FBI's Internet Crime Complaint Center (IC3).
Step 4: Review and Update the WISP
After a breach, the preparer must review the WISP and update it to prevent future incidents.
On the Exam
Question types to practice on data security:
- WISP Questions: "What federal rule requires tax preparers to have a Written Information Security Plan?"
- Breach Response: "If a tax preparer suffers a data breach, who should they contact first?"
- Retention: "How long must an ERO retain Form 8879?"
Key takeaway: All preparers need a WISP (FTC Safeguards Rule), retain Form 8879 for 3 years, and contact the IRS Stakeholder Liaison if there's a breach.