Form 15272 – VITA/TCE Site Security Plan Guide and Checklist

Editorial Standards

How we research, review, and update this guide

Every Accountably guide is researched against primary IRS sources, reviewed by a U.S. CPA, and refreshed as guidance evolves. Read our Editorial Guidelines to see how we source, fact-check, and update our content.

Opening day at a VITA site usually slips for one boring reason: the partner sign-off is not in the file yet, and the partner contact is out until January. Form 15272 is the Site Security Plan that has to clear that hurdle before SPEC will approve anything.

It documents how a volunteer site protects taxpayer data per Publication 4299, and the Rev. 10-2025 version goes to your SPEC territory manager signed by both the site coordinator and the partner. Complete Section I for every site except FSA remote, add Section II whenever any part of the workflow is virtual, and attach Form 13632 if you hold IRS-loaned devices so the barcodes and serials match your inventory. Approval does not carry forward from last year, so a fresh one is required each cycle.

Key Takeaways

• Form 15272 is the VITA/TCE Site Security Plan that documents your security controls, responsible contacts, software, and full equipment inventory.
• You need a separate plan for each physical site, and for any virtual site, complete the virtual process section (Section II) in addition to Section I, never in place of it.
• The site coordinator and partner sign, then your Territory Manager approves the plan before you open.
• Update and resubmit each year by late December, and any time you make significant changes, for example leadership, software, or equipment changes (prior-year approval does not carry forward – a fresh approval is required every season).
• Attach Form 13632 if you have IRS‑loaned devices and make sure barcodes and serials match your inventory.

What Form 15272 Is, And Why It Matters

Form 15272 is short, but it carries real weight. You use it to show how your site prevents unauthorized access, how you handle incidents, and how you control devices, from IRS‑loaned laptops to partner owned printers. You list the software you use, identify the people in charge, and confirm your workflow for virtual operations if you run a remote or hybrid model. Most of all, you create traceable accountability so reviewers can approve your site quickly.

Here is what you accomplish when you complete it properly:

• You document how you protect taxpayer information, including physical safeguards, encryption, antivirus, backups, and breach reporting steps.
• You list every device, whether IRS‑loaned, partner, site, or volunteer owned, with make, model, serial, and barcode details.
• You write down your virtual steps, if used, from consent to quality review to final signoff, so reviewers see your process at a glance.
• You secure signatures, then your Territory Manager validates the plan and approves your site before opening.

If something changes, you revise the plan, route it for signatures again, and send the update to your SPEC Territory Office. Treat the plan as a living document, not a one‑and‑done form.

Who Completes And Signs The Plan

Site Coordinator Responsibilities

You are the accountable lead for accuracy and timing. Complete Form 15272 for each location you operate, sign it, and submit it for approval. Use monitored contact information, since SPEC relies on those details for alerts and urgent updates. Keep a signed copy in your records and resubmit after significant changes and annually by late December.

Partner Organization’s Role

Your partner organization co‑owns security outcomes. Both the site coordinator and partner signatures are independently required before submission; help maintain accurate inventories, keep storage and transport rules in place, and support rapid incident reporting. If IRS‑loaned equipment is involved, they help maintain the Property Loan Agreement attachment and ensure return procedures are followed.

Territory Manager Approval

Your Territory Manager reviews your plan, checks signatures, confirms Publication 4299 alignment, and verifies inventory completeness. If anything is missing, expect a request for correction. Approval gates site activation, so build in time for review and potential edits.

Deadlines And Timing You Can Count On

Treat the end of December as your practical annual submission deadline (not the site-opening date – approval must be in hand before opening day, even if opening falls in mid-January or later), with submission two to four weeks earlier to allow for review and edits. If you plan to open in early January, target early December for submission. If you plan to open mid‑January, aim for mid‑December. Keep the approved copy on file and confirm SPEC receipt if you send it by email, fax, or mail.

Simple rule, file early, think two to four weeks before your opening date, and use late December as an outside annual checkpoint.

What To Gather Before You Start

• Site identity, exact Site Name and full Site Address, including suite, room, and mailing address, as they should appear on the form.
• Contacts, coordinator and alternate coordinator, partner point of contact, SPEC Relationship Manager, and Territory Manager, include titles, phones, and monitored emails.
• Software and tools, list tax prep software and any virtual tools you will use, for example intake, identity, document exchange, and e‑signature platforms that your territory allows.
• Security documentation, a short summary of physical safeguards, encryption, antivirus status, backup schedule, and breach response steps.
• Equipment inventory, make, model, serial number, barcode, and ownership for every device. Keep IRS‑loaned items clearly labeled and paired with Property Loan Agreement details.
• Prior incident notes, if any, plus any signed Form 13632 agreements for IRS‑loaned assets, so you can reconcile inventory cleanly.

Core Fields On Form 15272, How To Fill Them Correctly

Site Details And Contacts

• Enter the exact Site Name and Site Address you use for SPEC records.
• Provide a monitored phone and email for the site coordinator and alternate coordinator, since urgent SPEC notices will go there.
• Include partner contact information, especially if a facility manager controls building access or storage.

Software Used

List all tax preparation tools and any virtual or support tools you will rely on. Include versions when relevant, and only list tools your territory permits. If in doubt, ask your SPEC Relationship Manager before you submit.

Equipment Inventory

Create a device list with these columns, Make, Model, Serial, Barcode, Ownership, Encryption status, Storage location. If space is tight, attach a separate, clearly labeled inventory that matches the plan. Mark each IRS‑loaned item so it can be matched to an attached Property Loan Agreement.

Security Controls And Incident Response

In plain language, describe the controls you actually use:

• Physical security, locked storage after hours, key control list, screens facing away from public areas.
• Electronic security, full‑disk encryption, automatic updates, antivirus, secure Wi‑Fi, and password policies.
• Incident response, who to call immediately, what to document, how fast to notify SPEC, and how to preserve evidence, for example serials and barcodes.

Signatures And Submission

Route the plan for signatures, at minimum the site coordinator and partner, then submit to your SPEC Territory Office for Territory Manager approval. Keep the approved plan in your site records (a copy of the approved plan must be physically available at the site during operations, not only at partner HQ or the SPEC office). If your territory accepts e‑signatures and email, use them to speed routing and preserve a clean audit trail.

Editing The PDF Without Headaches

• Download and open the current Form 15272 PDF in a reliable editor so fields validate properly.
• Enter the Site Name, Site Address, Software Used, Contact Information, and Equipment Inventory details in one sitting if possible, to reduce version mix‑ups.
• Save drafts with clear filenames and dates, for example SiteName_15272_TY2026_Draft_2025‑12‑05_v1.pdf.
• When the form is complete and signed, export a locked PDF for distribution and archiving.

E‑Signatures That Stand Up

A legally binding e‑signature keeps your process fast and traceable. Before anyone signs, double‑check equipment barcodes and serials, match any IRS‑loaned devices to the attached Form 13632, and confirm names and titles are correct. After e‑signing, download and retain the final PDF along with the platform’s completion record.

Pro tip, route the plan in this order, coordinator first, partner second, then submit to SPEC for Territory Manager approval, that sequence prevents version drift.

Sharing And Submitting To SPEC Territory Offices

Your SPEC Territory Office typically accepts one or more of these channels:

• Email with an e‑signed PDF, fastest and easiest for most territories.
• Fax to the designated regional number if email is unavailable.
• Mail, when a physical original is required by local instructions.

Attach the equipment inventory list and any relevant Form 13632 agreements when IRS‑loaned assets are on site. After you send, confirm receipt and track the approval status. The moment you are approved, save the final plan and close the loop with your volunteer team so everyone is aligned for opening.

Territory Manager Review And Approval Workflow

Once your plan arrives, the Territory Manager checks three things:

• Required signatures and dates are present and legible.
• The security plan aligns with Publication 4299 expectations for privacy and incident response.
• The equipment inventory is complete and consistent, and any IRS‑loaned items are supported by Form 13632.

You will receive either an approval notice or a returned plan with requested fixes. Common requests include missing serial numbers, unclear virtual process descriptions, or signature issues. Virtual sites follow the same review path, with emphasis on the virtual steps you documented.

How To Make Approval Faster

• Use a clear equipment table with all fields filled, including ownership and encryption status.
• Add a one‑page virtual process summary if you operate remotely, identity, consent, document flow, quality review, final signoff.
• Keep filenames precise so reviewers can find the latest version in seconds.

Equipment Inventory And IRS‑Loaned Assets, Zero Gaps

Every device you use must be in your inventory, including volunteer owned laptops used on site. For IRS‑loaned equipment, keep the following tight:

• Record make, model, serial, and barcode exactly as labeled.
• Maintain a signed Property Loan Agreement for each IRS‑loaned device.
• Store IRS‑loaned laptops and printers in locked cabinets when not in use, and never leave them visible in vehicles.
• If a device is lost, stolen, or damaged, notify your SPEC relationship manager by the next business day, log the incident, and, when applicable, file a police report and capture the case number.

When returns are required, follow your territory’s shipping or drop‑off instructions, keep tracking numbers, and save receipts in your archive. Always reconcile returns against your inventory list so your records match SPEC’s.

Update The Plan When Anything Important Changes

Treat Form 15272 as a living control. Update and resubmit in each of these cases:

• Leadership changes, new site coordinator or partner contact.
• Technology changes, new or retired hardware, software version changes, or new virtual tools.
• Location changes, a move, a room change that affects storage, or a switch between in‑person and virtual.
• Security events, any loss, theft, unauthorized access, or incident that triggers new controls or training.

Submission Timing At A Glance

Action	Timing
Significant site change	Immediately, and before reopening
Software or hardware change	Immediately after the change
Annual security plan	Submit by late December for the next season
Virtual model change	Prior to offering virtual service
Archive updated approval	As soon as approval arrives

The faster you submit updates, the fewer surprises you face at the start of the season.

Recordkeeping, Version Control, And Site Archives

Strong security relies on strong records. Use an encrypted master folder for each site and tax year. Save each revision with a precise filename that includes site, tax year, revision date, and version, for example Riverdale_15272_TY2026_Rev_2025‑12‑12_v3.pdf. Keep a simple change log in the same folder so you always know what changed and why.

• Append equipment lists, signed Property Loan Agreements, and any incident reports.
• Redact PII in shared copies, keep unredacted masters encrypted with access logs.
• Preserve timestamped proof of submission and approval emails.
• Review archives at season end to confirm that your records are complete.

Common Mistakes, And How To Avoid Them

The Form 15272 cycle squeezes every VITA/TCE program in late fall. Per the IRS Form 15272 (Rev. 10-2025) instructions, every site except FSA remote must complete Section I, any site running a virtual step must also complete Section II, and the SPEC territory manager has to approve before opening day. December 31 is the latest acceptable submission date regardless of when the site actually opens, and prior-season approvals never carry forward into the new filing season.

Most stalls show up in two places: missing partner signatures and incomplete equipment inventories. Both are fixable with structure, not heroics.

• Build a one-page intake sheet for Section I that captures site address, software used for VITA/TCE activity, the personnel responsible for security oversight, and every device on the floor (IRS-loaned laptops and partner-owned printers alike) before the coordinator opens the PDF.
• Pre-route the partner signature in October so the December push is single-pass; track each site on a shared status board with the planned SPEC submission date next to the coordinator name.
• For sites with any remote workflow, lock the Section II model selection from the Publication 5450 list (100% Virtual, Drop-Off, Facilitated Self-Assistance, or hybrid) before drafting the virtual-workflow narrative, so the model choice is not made mid-write.
• Maintain a master device register that ties each laptop and printer to a serial, location, and assigned volunteer; the same register feeds the lost-or-stolen reporting workflow when an incident happens.
• Calendar the annual resubmission in early November every year so prior-season approvals never get re-used by mistake, and keep a copy of the approved Form 15272 physically present at each open site.

This is the kind of program-management overhead that gets dropped first when production workload spikes. Accountably's outsourced tax operations absorb the documentation discipline behind the scenes, so coordinators and partners are signing the right revision of the form on the right date, every season.

Your Step‑By‑Step Checklist

Before You Draft

• Pick your intended opening date, then work backward by two to four weeks.
• Confirm the current coordinator and partner contacts.
• List the exact software and any virtual tools you plan to use and verify they are permitted by your territory.

While You Draft

• Complete Section I with specific, testable safeguards, locked storage, encryption, antivirus, backups, and incident steps.
• If you operate remotely, complete Section II with the virtual model and each step from consent to final signoff.
• Build the equipment inventory and clearly flag IRS‑loaned devices with matching PLA references.

Sign, Submit, And Archive

• Obtain coordinator and partner signatures.
• Submit to your SPEC Territory Office for approval before you open, plan for late December at the latest each year.
• Save the approved plan in your encrypted archive, log access, and circulate a read‑only copy to your lead volunteers.

Virtual VITA/TCE, What To Include In Your Plan

If you run any part of your process virtually, document the exact model:

• Scheduling and intake, how appointments are booked and confirmed.
• Identity verification and consent, how you collect and store Form 14446.
• Secure document exchange, approved channels and storage rules.
• Preparation and quality review, who prepares, who reviews, and how you record corrections.
• Final signoff, how you collect signatures and close the file.
• Closeout and retention, how you purge or retain PII based on territory guidance.

Clarity here prevents rework. A crisp one‑page diagram of your virtual steps, attached to Form 15272, can cut days off review time.

Security Incidents, Be Ready Before You Need To Be

No one plans for a breach or a lost device, but you can plan your response. Keep a one‑page incident card in your coordinator binder and your secure drive. Include who to notify, what facts to capture, how to preserve evidence, and where to log the report.

• Lost or stolen equipment, notify your SPEC contact by the next business day, document the timeline, include serials and barcodes, and request next steps in writing.
• Suspected data exposure, halt use of the affected system, notify SPEC, capture what was accessed, when, by whom, and follow the corrective steps your territory provides.
• After action, update your plan with the new control you adopted, for example new storage rules, additional encryption, or extra volunteer training.

Templates You Can Reuse

Equipment Inventory Table

Item	Make	Model	Serial	Barcode	Ownership	Encrypted	Storage Location	Notes
Laptop 01	Dell	Latitude 5440	ABC12345	IRS‑000111	IRS‑loaned	Yes	Locked cabinet A	PLA on file
Printer 01	HP	LaserJet 402	XYZ67890	IRS‑000222	IRS‑loaned	N/A	Locked cabinet B	Toner in cabinet B
Laptop 02	Lenovo	ThinkPad T14	LMN54321	PART‑000333	Partner	Yes	Coordinator office	Volunteer training device

Virtual Process Snapshot

• Verify identity over live video, collect and store signed consents, then receive documents through your approved secure channel.
• Prepare the return, run quality review by a separate volunteer, resolve comments, then collect final signatures.
• Close the file, store required records in your encrypted archive, and purge temporary files per your territory’s guidance.

Simple Training Plan You Can Run In An Hour

• 10 minutes, why security matters, what Publication 4299 requires, and how Form 15272 fits in.
• 20 minutes, walk through your plan, Section I for everyone, and the virtual steps if you use them.
• 15 minutes, equipment do’s and don’ts, sign‑out, transport, storage, and incident reporting.
• 15 minutes, incident practice, simulate a lost laptop, find serials and barcodes, make the call, and fill the log.

Minimal And Appropriate Accountably Note

If you ever need outside help, look for partners who work inside your systems and respect your compliance boundaries. Accountably occasionally supports organizations that want disciplined delivery, tight documentation, and review protection without adding chaos. If that would help your team, ask us what a clean, structured rollout could look like. No resume farming, no band‑aids, only practical workflow support where it adds real value.

Your first priority is a safe, predictable site. Any partner should make that easier, not harder.

Wrap‑Up, Your Action Plan For This Week

• Set your internal deadline, aim to submit two to four weeks before opening, use late December as your annual checkpoint.
• Draft Section I now, and Section II if you use a virtual model.
• Build the equipment inventory table and match IRS‑loaned items to signed Property Loan Agreements.
• Route for coordinator and partner signatures, then submit to your SPEC Territory Office.
• Archive the approved plan in your encrypted master folder, share a read‑only copy with leads, and log access.

Quick Troubleshooting Guide

• Approval delayed, send a concise follow‑up asking whether signatures, inventory, or virtual steps need clarification, and offer a one‑page summary if that helps.
• Missing serials or barcodes, stop and re‑scan the devices, then reconcile your list with storage labels and PLA details.
• New volunteer confusion, add a one‑page “how we keep data safe” handout that mirrors your plan’s highlights.

Final Word

You are the lighthouse keeper for your site. Form 15272 is your lamp, you check the fuel, keep the glass clean, and log each rotation. Update it each year, tighten it after storms, and know where every device sits. Do that, and your volunteers will feel calm, your taxpayers will feel safe, and opening day will feel like a plan, not a gamble.

Reusable Checklists

These checklists are copy-paste ready for site SOPs and partner onboarding binders. Run them in order during the late-fall submission window, then again the week before opening day.

Keep 15272 Season From Stalling

Run a VITA or TCE program and the rhythm is familiar. Form 15272 is a four-page security plan with two completable sections, and the SPEC territory manager needs an approved copy in hand before opening day. The submission cutoff sits at December 31 of the year preceding the filing season (per the Form 15272 instructions), so the plan, the signatures, the device list, and the virtual-model selection all converge in a narrow late-fall window.

What stalls sites is rarely the form itself. It is the moving parts around it. Partner-owned printers, IRS-loaned laptops, virtual-model selections from Publication 5450, and dual signatures from the site coordinator and the partner all need to land before submission. The fix is to treat each as its own checkpoint, not one single race against the calendar.

• Lock the inventory early. Catalog every device used at the site, IRS-loaned and partner-owned, with serial numbers, barcodes, and named owners. Section I will not approve without it.
• Route the signatures in parallel. Both the site coordinator and the partner (sponsoring organization) must sign before submission, and waiting for one to finish before starting the other is where late-November plans slip.
• Walk Section II line by line if any workflow step is virtual. Identity verification, document transmission, signature capture, and the Virtual VITA/TCE Model choice from Publication 5450 each need a written control, even on a hybrid site.
• Refresh the file, do not recycle it. Form 15272 (Rev. 10-2025) supersedes Rev. 10-2024 for the 2025 filing season, and prior-year approvals do not carry forward.
• Keep the approved copy at the site. SPEC quality reviews look for the physical copy on the floor, not in a partner headquarters file or a SPEC office.

When tax-season production runs on documented SOPs and a layered review discipline, programs like Form 15272 stop competing with paid client work for the same review hours. Accountably's tax execution support handles the U.S. compliance load with the same structure SPEC asks for, so capacity stays available when the December 31 plan deadline lands.

FAQs

Do virtual sites need a separate Form 15272?

Yes. Complete a separate plan for each site. For virtual operations, complete the virtual process section and route it for the same approvals as a physical site.

Can we use electronic signatures?

Yes, if your territory allows e‑signatures for routing and approval, electronic signatures are acceptable and they simplify recordkeeping. Keep the platform’s completion record with your final PDF.

What if we change software or add hardware mid‑season?

Update the plan immediately, route for signatures, and submit the revision to your SPEC Territory Office. Wait for approval before relying on the new setup in production.

How fast should we report lost or stolen equipment?

Report within the next business day. Provide serials, barcodes, last known location, a brief timeline, and any available tracking or police report numbers.

Where should we store the approved plan?

Keep an encrypted master copy in your site’s archive for the current tax year. Share a read‑only version with leads, and log administrative access.