1. Introduction: What is Form 15272?

IRS Form 15272, officially titled VITA/TCE Security Plan, is an administrative security compliance and planning document published by the Internal Revenue Service (IRS). It is governed by the Stakeholder Partnerships, Education and Communication (SPEC) organization, an operating division within the IRS Taxpayer Services Division.

This form is not an individual tax return filed by everyday taxpayers. Instead, Form 15272 is a mandatory operational safety plan required of all community volunteer tax preparation programs participating in the Volunteer Income Tax Assistance (VITA) and Tax Counseling for the Elderly (TCE) programs. Sponsoring partner organizations and site coordinators use Form 15272 to document how their tax site physically and digitally protects taxpayers’ Personally Identifiable Information (PII) in accordance with the mandatory security standards outlined in IRS Publication 4299 (Privacy, Confidentiality, and Civil Rights – A Public Trust).

2. Purpose of the Form: Why Does Form 15272 Exist?

Every tax season, thousands of VITA and TCE sites operate in diverse community venues—such as public libraries, community centers, universities, places of worship, and mobile vans. At these locations, certified volunteers handle sensitive taxpayer documents, including Social Security numbers, dates of birth, wage statements, and direct deposit bank account details.

Because free tax clinics operate in open, shared spaces and frequently utilize laptops, wireless routers, and cloud-based tax software, safeguarding taxpayer information against data theft and cyber threats is a top federal priority. Form 15272 exists to establish strict data security protocols across the entire volunteer network:

Standardizing Site Security Protocols: It requires site coordinators to implement physical safeguards (such as locked storage and clean-desk policies) and technical safeguards (such as firewalls, disk encryption, and secure Wi-Fi networks).
Maintaining Equipment Inventory: It creates a formal audit registry of every computer, printer, and router used to prepare or transmit tax returns, whether the hardware is loaned by the IRS, owned by the partner, or supplied by a volunteer.
Regulating Virtual and Remote Services: For sites offering virtual, drop-off, or remote tax preparation, Form 15272 ensures that electronic document transmission uses secure, encrypted file portals rather than standard unencrypted email.
Establishing Incident Response Plans: It outlines immediate reporting procedures in the event of a lost laptop, compromised password, or physical break-in, ensuring rapid coordination with the IRS and the Treasury Inspector General for Tax Administration (TIGTA).

3. Who Needs to File This Form?

Form 15272 is completed by program leaders managing free volunteer tax sites rather than individual clients. Specifically, it must be completed by:

Sponsoring partner organizations (such as local United Way chapters, AARP Foundation Tax-Aide programs, community action agencies, or university programs) entering into a formal VITA/TCE Partner Sponsor Agreement (Form 13533).
Designated VITA and TCE Site Coordinators responsible for opening and managing physical or virtual volunteer tax preparation sites.
Program administrators operating alternative filing models, including drop-off clinics, mobile units, and remote virtual tax preparation services.

4. Who Is Exempt / Not Required to File?

Large segments of the public and individual volunteers do not need to prepare Form 15272:

General Individual Taxpayers: Everyday citizens who visit a volunteer clinic to have their taxes prepared for free never complete Form 15272.
Individual Volunteer Preparers: Frontline volunteer tax preparers, quality reviewers, and greeters do not complete this form; site-wide security planning is the sole responsibility of the Site Coordinator and Partner Sponsor.
Commercial Paid Tax Preparers: Commercial accounting firms and retail tax businesses follow separate Federal Trade Commission (FTC) Safeguards Rules and IRS Publication 4557, but do not use VITA Form 15272.
Low Income Taxpayer Clinics (LITCs): Legal clinics assisting taxpayers in audits or court controversies operate under separate grant guidelines and do not use this SPEC form.

5. When to File: Deadlines and Frequency

Form 15272 is an annual administrative requirement that must be executed prior to opening your tax site for the public.

Under official IRS VITA/TCE guidelines, Form 15272 must be completed, signed, and submitted to your local IRS SPEC Territory Office no later than December 31st prior to the opening of the upcoming tax filing season. Completing the form before December 31 ensures that your site’s Electronic Filing Identification Number (EFIN) is authorized and active for tax software access. If your site introduces new technology, adopts a virtual model, or relocates during the filing season, an amended Form 15272 must be submitted to your SPEC relationship manager immediately.

6. Where and How to File

Form 15272 is an administrative document submitted locally to your regional IRS SPEC territory leadership rather than a central tax return processing center:

Electronic / Email Submission: Most SPEC territory offices instruct partners to submit completed, signed PDF copies of Form 15272 directly via email to their assigned IRS-SPEC Relationship Manager or Tax Consultant.
Paper Submission: If paper submission is required, mail the signed original to the designated IRS address as per instructions provided in your annual site coordinator briefing packet or Publication 5683.
On-Site Retention: A fully executed copy of Form 15272 must be kept on-site in the Site Coordinator’s administrative binder or secure digital folder. When an IRS quality reviewer conducts an on-site audit (using Form 14512), Form 15272 must be produced for inspection.

7. Step-by-Step Instructions to Fill Form 15272

Form 15272 is structured into distinct sections covering site identification, physical security, computer security, hardware inventory, virtual operations, and administrative approvals. The table below outlines each primary section.

Section	Item Name	Required Information & Standards
Header	Site Identification	Partner name, site name, Site Identification Number (SIDN), EFIN, and physical street address.
Part 1	Physical Security	Protocols for locked file storage, document shredding, restricted volunteer areas, and clean desks.
Part 2	Technical & Network Security	Password standards, multi-factor authentication, active antivirus, software firewalls, and secure Wi-Fi.
Part 3	Hardware Inventory	Detailed tracking table for all laptops, desktops, printers, routers, and scanners used at the site.
Part 4	Virtual VITA/TCE Models	Procedures for secure file uploads, taxpayer consent (Form 14446), and remote quality reviews.
Part 5	Incident Response Plan	Mandatory protocols for reporting data loss, stolen hardware, or breaches to the IRS and TIGTA.
Part 6	Approvals & Signatures	Original signatures, titles, and dates of the Site Coordinator and Partner Sponsoring Official.

Part 1: Site Identification

Enter your sponsoring partner organization name (e.g., “United Way of Central Valley”) and the official site name. Provide your five-digit Site Identification Number (SIDN) and your six-digit Electronic Filing Identification Number (EFIN). Enter the physical street address where tax preparation takes place, including building and room numbers.

Part 2: Physical Security Safeguards

You must outline how paper taxpayer records are protected on-site. Form 15272 requires confirmation that:

Taxpayer intake sheets (Form 13614-C) and source documents are stored in locked file cabinets or lockboxes when unattended.
Only certified volunteers who have signed Form 13615 (Volunteer Standards of Conduct) are allowed in tax preparation areas.
Paper documents containing sensitive data are shredded immediately after use, or returned directly to the taxpayer before they leave the site.

Part 3: Technical and Network Security Safeguards

Document the digital protections implemented on all computers and networks used at the site. You must verify that:

Every computer has an active, updated operating system, up-to-date antivirus/anti-malware software, and an enabled software firewall.
Computers are set to automatically lock screens after a short period of inactivity (typically 10 to 15 minutes).
Internet access utilizes password-protected, encrypted WPA2 or WPA3 wireless networks. Public, unencrypted Wi-Fi networks (such as open coffee shop or library networks) are strictly prohibited for tax preparation.

Part 4: Hardware and Equipment Inventory Tracking

This section is an equipment log. You must list every computer, printer, scanner, and wireless router used for tax preparation. For each device, record:

Equipment type (laptop, desktop, printer, router).
Manufacturer, make, and model.
Unique hardware serial number and agency asset barcode number.
Ownership source: designate whether the equipment is IRS-loaned, Partner-owned, Site-owned, or Volunteer-owned.

Part 5: Virtual VITA/TCE Operations (If Applicable)

If your site offers virtual or hybrid tax preparation, document how client data is handled remotely. Confirm that clients complete and sign Form 14446 (Virtual VITA/TCE Taxpayer Consent) before sharing documents, that files are transferred using secure, encrypted cloud portals rather than standard email, and that remote quality reviews follow federal guidelines.

Part 6: Incident Reporting and Signatures

Review the mandatory data incident protocol: any lost, stolen, or hacked device must be reported to the local IRS SPEC Territory Office and TIGTA within 24 hours. The Site Coordinator and the Partner Sponsoring Official must sign, date, and print their titles, certifying that the security plan has been fully implemented.

8. Required Documents and Information Needed Before Filling

Before completing Form 15272, assemble the following program records:

IRS Publication 4299: Privacy, Confidentiality, and Civil Rights – A Public Trust (the foundational reference manual).
IRS Publication 5683: VITA/TCE Handbook for Partners and Site Coordinators.
Your site’s five-digit Site Identification Number (SIDN) and six-digit EFIN.
A complete hardware inventory list showing makes, models, and serial numbers for all laptops and printers.
Network security specifications for your internet connection (Wi-Fi encryption and firewall settings).
Form 13533 (VITA/TCE Partner Sponsor Agreement) executed with the IRS.

9. Common Mistakes to Avoid

Failing to follow security guidelines can jeopardize your site’s authorization to operate. Watch out for these frequent mistakes:

Missing the December 31 Deadline: Submitting Form 15272 late delays the activation of your tax software and EFIN, preventing your site from opening on schedule in January.
Using Unsecured, Public Wi-Fi: Conducting tax preparation over open public networks without password protection or encryption is a severe security violation that can shut down your site immediately.
Omitting Volunteer-Owned Devices: If volunteers use their personal laptops to prepare returns, those devices must be fully inventoried on Form 15272 and meet all IRS antivirus and encryption standards.
Leaving Paper Files Unattended: Leaving completed tax returns or intake sheets on open desks while volunteers take breaks violates physical security rules. Documents must remain attended or locked away.
Failing to Keep a Signed Copy On-Site: When IRS monitors visit your site during tax season, failing to produce a signed, approved Form 15272 will result in an immediate quality audit failure on Form 14512.

10. Penalties for Non-Filing or Security Violations

Because Form 15272 is an administrative program document, volunteers face no personal tax penalties for filing it. However, the program, administrative, and legal consequences of noncompliance are severe:

Immediate Suspension of Site EFIN: If a site fails to implement its security plan or suffers an avoidable data breach, the IRS can immediately deactivate its Electronic Filing Identification Number, shutting down all e-filing operations.
Termination of Federal Grant Funding: Host organizations that receive federal VITA or TCE matching grants can have their grant awards revoked or be disqualified from future funding competitions for security noncompliance.
Site Closure by IRS Monitors: During unannounced Field Site Visits, IRS monitors who discover missing security plans or unencrypted networks can temporarily or permanently close the clinic.
Criminal Penalties for Data Breaches (IRC Section 7216): If taxpayer data is knowingly or recklessly compromised due to gross negligence, individuals involved may face federal criminal misdemeanor charges under Section 7216, carrying fines and imprisonment.

11. Related Forms or Schedules

Form 15272 operates within an interconnected system of VITA/TCE management forms and publications:

IRS Publication 4299: Privacy, Confidentiality, and Civil Rights – A Public Trust.
IRS Publication 5683: VITA/TCE Handbook for Partners and Site Coordinators.
IRS Publication 5166: VITA/TCE Volunteer Quality Site Requirements.
Form 13533: VITA/TCE Partner Sponsor Agreement.
Form 13614-C: Intake/Interview and Quality Review Sheet.
Form 13615: Volunteer Standards of Conduct Agreement – VITA/TCE Programs.
Form 14446: Virtual VITA/TCE Taxpayer Consent.
Form 14512: VITA/TCE History Sheet for Site and Return Reviews.
Form 15080: Consent to Disclose Tax Return Information to VITA/TCE Tax Preparation Sites.

12. Frequently Asked Questions (FAQs)

1. Who is legally responsible for preparing and signing Form 15272?

Form 15272 is completed and signed jointly by the designated VITA/TCE Site Coordinator and the Partner Sponsoring Official representing the host organization.

2. When is Form 15272 due to the IRS?

Form 15272 must be submitted to your local IRS SPEC Territory Office by December 31st prior to the start of the tax season, or before the site opens its doors to the public.

3. Can volunteers use their personal laptops to prepare taxes at a VITA site?

Yes, but only if permitted by the sponsoring partner. If volunteer-owned laptops are used, they must be fully recorded on the Form 15272 equipment inventory, have up-to-date operating systems, run active antivirus software, and adhere to all Publication 4299 security standards.

4. What should a site coordinator do if an IRS-loaned laptop is stolen?

The Site Coordinator must immediately file a local police report, notify the local IRS SPEC Territory Office within 24 hours, and contact the Treasury Inspector General for Tax Administration (TIGTA) to report the stolen hardware.

5. Is Form 15272 required for 100% virtual or remote tax preparation programs?

Yes. Virtual and remote tax programs handle confidential taxpayer files online, making a comprehensive security plan even more vital. Virtual programs must detail their encrypted file transfer platforms and remote quality review protocols in Part 4 of Form 15272.

6. Where should the signed copy of Form 15272 be stored during tax season?

A completed, signed copy must be kept on-site in the Site Coordinator’s administrative binder or secure digital site file so it is readily available for inspection during IRS Field Site Visits.

13. Conclusion: Key Takeaways

IRS Form 15272 is the cornerstone of data protection and public trust in the VITA and TCE programs. By systematically establishing physical security safeguards, verifying network encryption, and maintaining an exact inventory of all tax preparation hardware, site coordinators protect vulnerable taxpayers from identity theft and cyber threats.

Because an incomplete or missing security plan can lead to the immediate suspension of your site’s EFIN and the loss of federal grant funding, partner sponsors and site coordinators should complete Form 15272 thoroughly, verify all technical controls, and submit the plan to their local SPEC territory office before the December 31 deadline.

IRS Form 15272 Guide: VITA & TCE Site Security Plan Rules