Form 15272 - VITA/TCE Site Security Plan Guide and Checklist

I once watched a coordinator spend two hours hunting a laptop barcode that was never logged. Tension rose, volunteers waited, and opening day slipped. The fix was not heroics, it was a clear security plan, a clean equipment list, and a simple approval path. That is exactly what Form 15272 gives you, a written playbook for protecting taxpayer data, accounting for every device, and getting Territory Manager approval on time.

Think of Form 15272 as your site’s safety net, you write down how you protect people and equipment, you prove Publication 4299 compliance, and you open the doors with confidence.

Download Form 15272 PDF

Key Takeaways

Form 15272 is the VITA/TCE Site Security Plan that documents your security controls, responsible contacts, software, and full equipment inventory.
You need a separate plan for each physical site, and for any virtual site, complete the virtual process section.
The site coordinator and partner sign, then your Territory Manager approves the plan before you open.
Update and resubmit each year by late December, and any time you make significant changes, for example leadership, software, or equipment changes.
Attach Form 13632 if you have IRS‑loaned devices and make sure barcodes and serials match your inventory.

What Form 15272 Is, And Why It Matters

Form 15272 is short, but it carries real weight. You use it to show how your site prevents unauthorized access, how you handle incidents, and how you control devices, from IRS‑loaned laptops to partner owned printers. You list the software you use, identify the people in charge, and confirm your workflow for virtual operations if you run a remote or hybrid model. Most of all, you create traceable accountability so reviewers can approve your site quickly.

Here is what you accomplish when you complete it properly:

You document how you protect taxpayer information, including physical safeguards, encryption, antivirus, backups, and breach reporting steps.
You list every device, whether IRS‑loaned, partner, site, or volunteer owned, with make, model, serial, and barcode details.
You write down your virtual steps, if used, from consent to quality review to final signoff, so reviewers see your process at a glance.
You secure signatures, then your Territory Manager validates the plan and approves your site before opening.

If something changes, you revise the plan, route it for signatures again, and send the update to your SPEC Territory Office. Treat the plan as a living document, not a one‑and‑done form.

Who Completes And Signs The Plan

Site Coordinator Responsibilities

You are the accountable lead for accuracy and timing. Complete Form 15272 for each location you operate, sign it, and submit it for approval. Use monitored contact information, since SPEC relies on those details for alerts and urgent updates. Keep a signed copy in your records and resubmit after significant changes and annually by late December.

Partner Organization’s Role

Your partner organization co‑owns security outcomes. They co‑sign when required, help maintain accurate inventories, keep storage and transport rules in place, and support rapid incident reporting. If IRS‑loaned equipment is involved, they help maintain the Property Loan Agreement attachment and ensure return procedures are followed.

Territory Manager Approval

Your Territory Manager reviews your plan, checks signatures, confirms Publication 4299 alignment, and verifies inventory completeness. If anything is missing, expect a request for correction. Approval gates site activation, so build in time for review and potential edits.

Deadlines And Timing You Can Count On

Treat the end of December as your practical annual deadline, with submission two to four weeks earlier to allow for review and edits. If you plan to open in early January, target early December for submission. If you plan to open mid‑January, aim for mid‑December. Keep the approved copy on file and confirm SPEC receipt if you send it by email, fax, or mail.

Simple rule, file early, think two to four weeks before your opening date, and use late December as an outside annual checkpoint.

What To Gather Before You Start

Site identity, exact Site Name and full Site Address, including suite, room, and mailing address, as they should appear on the form.
Contacts, coordinator and alternate coordinator, partner point of contact, SPEC Relationship Manager, and Territory Manager, include titles, phones, and monitored emails.
Software and tools, list tax prep software and any virtual tools you will use, for example intake, identity, document exchange, and e‑signature platforms that your territory allows.
Security documentation, a short summary of physical safeguards, encryption, antivirus status, backup schedule, and breach response steps.
Equipment inventory, make, model, serial number, barcode, and ownership for every device. Keep IRS‑loaned items clearly labeled and paired with Property Loan Agreement details.
Prior incident notes, if any, plus any signed Form 13632 agreements for IRS‑loaned assets, so you can reconcile inventory cleanly.

Core Fields On Form 15272, How To Fill Them Correctly

Site Details And Contacts

Enter the exact Site Name and Site Address you use for SPEC records.
Provide a monitored phone and email for the site coordinator and alternate coordinator, since urgent SPEC notices will go there.
Include partner contact information, especially if a facility manager controls building access or storage.

Software Used

List all tax preparation tools and any virtual or support tools you will rely on. Include versions when relevant, and only list tools your territory permits. If in doubt, ask your SPEC Relationship Manager before you submit.

Equipment Inventory

Create a device list with these columns, Make, Model, Serial, Barcode, Ownership, Encryption status, Storage location. If space is tight, attach a separate, clearly labeled inventory that matches the plan. Mark each IRS‑loaned item so it can be matched to an attached Property Loan Agreement.

Security Controls And Incident Response

In plain language, describe the controls you actually use:

Physical security, locked storage after hours, key control list, screens facing away from public areas.
Electronic security, full‑disk encryption, automatic updates, antivirus, secure Wi‑Fi, and password policies.
Incident response, who to call immediately, what to document, how fast to notify SPEC, and how to preserve evidence, for example serials and barcodes.

Signatures And Submission

Route the plan for signatures, at minimum the site coordinator and partner, then submit to your SPEC Territory Office for Territory Manager approval. Keep the approved plan in your site records. If your territory accepts e‑signatures and email, use them to speed routing and preserve a clean audit trail.

Editing The PDF Without Headaches

Download and open the current Form 15272 PDF in a reliable editor so fields validate properly.
Enter the Site Name, Site Address, Software Used, Contact Information, and Equipment Inventory details in one sitting if possible, to reduce version mix‑ups.
Save drafts with clear filenames and dates, for example SiteName_15272_TY2026_Draft_2025‑12‑05_v1.pdf.
When the form is complete and signed, export a locked PDF for distribution and archiving.

E‑Signatures That Stand Up

A legally binding e‑signature keeps your process fast and traceable. Before anyone signs, double‑check equipment barcodes and serials, match any IRS‑loaned devices to the attached Form 13632, and confirm names and titles are correct. After e‑signing, download and retain the final PDF along with the platform’s completion record.

Pro tip, route the plan in this order, coordinator first, partner second, then submit to SPEC for Territory Manager approval, that sequence prevents version drift.

Sharing And Submitting To SPEC Territory Offices

Your SPEC Territory Office typically accepts one or more of these channels:

Email with an e‑signed PDF, fastest and easiest for most territories.
Fax to the designated regional number if email is unavailable.
Mail, when a physical original is required by local instructions.

Attach the equipment inventory list and any relevant Form 13632 agreements when IRS‑loaned assets are on site. After you send, confirm receipt and track the approval status. The moment you are approved, save the final plan and close the loop with your volunteer team so everyone is aligned for opening.

Territory Manager Review And Approval Workflow

Once your plan arrives, the Territory Manager checks three things:

Required signatures and dates are present and legible.
The security plan aligns with Publication 4299 expectations for privacy and incident response.
The equipment inventory is complete and consistent, and any IRS‑loaned items are supported by Form 13632.

You will receive either an approval notice or a returned plan with requested fixes. Common requests include missing serial numbers, unclear virtual process descriptions, or signature issues. Virtual sites follow the same review path, with emphasis on the virtual steps you documented.

How To Make Approval Faster

Use a clear equipment table with all fields filled, including ownership and encryption status.
Add a one‑page virtual process summary if you operate remotely, identity, consent, document flow, quality review, final signoff.
Keep filenames precise so reviewers can find the latest version in seconds.

Equipment Inventory And IRS‑Loaned Assets, Zero Gaps

Every device you use must be in your inventory, including volunteer owned laptops used on site. For IRS‑loaned equipment, keep the following tight:

Record make, model, serial, and barcode exactly as labeled.
Maintain a signed Property Loan Agreement for each IRS‑loaned device.
Store IRS‑loaned laptops and printers in locked cabinets when not in use, and never leave them visible in vehicles.
If a device is lost, stolen, or damaged, notify your SPEC relationship manager by the next business day, log the incident, and, when applicable, file a police report and capture the case number.

When returns are required, follow your territory’s shipping or drop‑off instructions, keep tracking numbers, and save receipts in your archive. Always reconcile returns against your inventory list so your records match SPEC’s.

Update The Plan When Anything Important Changes

Treat Form 15272 as a living control. Update and resubmit in each of these cases:

Leadership changes, new site coordinator or partner contact.
Technology changes, new or retired hardware, software version changes, or new virtual tools.
Location changes, a move, a room change that affects storage, or a switch between in‑person and virtual.
Security events, any loss, theft, unauthorized access, or incident that triggers new controls or training.

Submission Timing At A Glance

Action	Timing
Significant site change	Immediately, and before reopening
Software or hardware change	Immediately after the change
Annual security plan	Submit by late December for the next season
Virtual model change	Prior to offering virtual service
Archive updated approval	As soon as approval arrives

The faster you submit updates, the fewer surprises you face at the start of the season.

Recordkeeping, Version Control, And Site Archives

Strong security relies on strong records. Use an encrypted master folder for each site and tax year. Save each revision with a precise filename that includes site, tax year, revision date, and version, for example Riverdale_15272_TY2026_Rev_2025‑12‑12_v3.pdf. Keep a simple change log in the same folder so you always know what changed and why.

Append equipment lists, signed Property Loan Agreements, and any incident reports.
Redact PII in shared copies, keep unredacted masters encrypted with access logs.
Preserve timestamped proof of submission and approval emails.
Review archives at season end to confirm that your records are complete.

Common Mistakes, And How To Avoid Them

Missing devices in the inventory, fix this by walking the floor with your list, scanning every barcode, and confirming serials match labels before you submit.
Skipping signatures, route in a set order, coordinator, partner, then submit to SPEC, and verify signatures before sending.
Weak incident details, write a one‑page incident card, who to contact, what to capture, which numbers to log, and where to store the report.
Unclear virtual steps, if you use a virtual model, spell out your flow in Section II, the more concrete your steps, the faster your approval.
Late submission, build a two to four week buffer before your intended opening date, and treat late December as your annual checkpoint.

Field‑Tested Best Practices

Label IRS‑loaned devices with a small tag that includes the PLA reference and the inventory row number, it speeds audits and returns.
Use a simple sign‑out sheet for any device that leaves locked storage, include user, date, time out, time in, and purpose.
Run a five‑minute “find it fast” exercise, can your team produce the approved plan, the latest inventory, and the incident card without asking you, if not, fix your folder structure.
After submission, email your SPEC Relationship Manager to confirm the plan arrived and ask for next steps, that short note can save days.

Your Step‑By‑Step Checklist

Before You Draft

Pick your intended opening date, then work backward by two to four weeks.
Confirm the current coordinator and partner contacts.
List the exact software and any virtual tools you plan to use and verify they are permitted by your territory.

While You Draft

Complete Section I with specific, testable safeguards, locked storage, encryption, antivirus, backups, and incident steps.
If you operate remotely, complete Section II with the virtual model and each step from consent to final signoff.
Build the equipment inventory and clearly flag IRS‑loaned devices with matching PLA references.

Sign, Submit, And Archive

Obtain coordinator and partner signatures.
Submit to your SPEC Territory Office for approval before you open, plan for late December at the latest each year.
Save the approved plan in your encrypted archive, log access, and circulate a read‑only copy to your lead volunteers.

Virtual VITA/TCE, What To Include In Your Plan

If you run any part of your process virtually, document the exact model:

Scheduling and intake, how appointments are booked and confirmed.
Identity verification and consent, how you collect and store Form 14446.
Secure document exchange, approved channels and storage rules.
Preparation and quality review, who prepares, who reviews, and how you record corrections.
Final signoff, how you collect signatures and close the file.
Closeout and retention, how you purge or retain PII based on territory guidance.

Clarity here prevents rework. A crisp one‑page diagram of your virtual steps, attached to Form 15272, can cut days off review time.

Security Incidents, Be Ready Before You Need To Be

No one plans for a breach or a lost device, but you can plan your response. Keep a one‑page incident card in your coordinator binder and your secure drive. Include who to notify, what facts to capture, how to preserve evidence, and where to log the report.

Lost or stolen equipment, notify your SPEC contact by the next business day, document the timeline, include serials and barcodes, and request next steps in writing.
Suspected data exposure, halt use of the affected system, notify SPEC, capture what was accessed, when, by whom, and follow the corrective steps your territory provides.
After action, update your plan with the new control you adopted, for example new storage rules, additional encryption, or extra volunteer training.

Templates You Can Reuse

Equipment Inventory Table

Item	Make	Model	Serial	Barcode	Ownership	Encrypted	Storage Location	Notes
Laptop 01	Dell	Latitude 5440	ABC12345	IRS‑000111	IRS‑loaned	Yes	Locked cabinet A	PLA on file
Printer 01	HP	LaserJet 402	XYZ67890	IRS‑000222	IRS‑loaned	N/A	Locked cabinet B	Toner in cabinet B
Laptop 02	Lenovo	ThinkPad T14	LMN54321	PART‑000333	Partner	Yes	Coordinator office	Volunteer training device

Virtual Process Snapshot

Verify identity over live video, collect and store signed consents, then receive documents through your approved secure channel.
Prepare the return, run quality review by a separate volunteer, resolve comments, then collect final signatures.
Close the file, store required records in your encrypted archive, and purge temporary files per your territory’s guidance.

Frequently Asked Questions

Do virtual sites need a separate Form 15272?

Yes. Complete a separate plan for each site. For virtual operations, complete the virtual process section and route it for the same approvals as a physical site.

Can we use electronic signatures?

Yes, if your territory allows e‑signatures for routing and approval, electronic signatures are acceptable and they simplify recordkeeping. Keep the platform’s completion record with your final PDF.

What if we change software or add hardware mid‑season?

Update the plan immediately, route for signatures, and submit the revision to your SPEC Territory Office. Wait for approval before relying on the new setup in production.

How fast should we report lost or stolen equipment?

Report within the next business day. Provide serials, barcodes, last known location, a brief timeline, and any available tracking or police report numbers.

Where should we store the approved plan?

Keep an encrypted master copy in your site’s archive for the current tax year. Share a read‑only version with leads, and log administrative access.

Avoid AI‑Sounding Copy, Keep It Clear And Human

Readers skim, then decide whether to trust you. Use natural phrasing, short and long sentences, and concrete details. Skip empty adjectives and avoid filler words that make content feel robotic. If you catch words like utilize, delve, leverage, realm, or tapestry, swap them for simpler language that sounds like you talking to your team. This keeps your guidance approachable and reduces confusion for new volunteers.

A good rule, write so a new volunteer can follow the steps without asking you to translate, then add just enough detail for coordinators to run the process.

Simple Training Plan You Can Run In An Hour

10 minutes, why security matters, what Publication 4299 requires, and how Form 15272 fits in.
20 minutes, walk through your plan, Section I for everyone, and the virtual steps if you use them.
15 minutes, equipment do’s and don’ts, sign‑out, transport, storage, and incident reporting.
15 minutes, incident practice, simulate a lost laptop, find serials and barcodes, make the call, and fill the log.

Cross‑References That Help Your Readers

If your site maintains a library of IRS form guides, add a short “Related Forms” note near the end of this page. For example, link to your guide for consents or non‑tax records if relevant to your audience. Keep anchor text clear, for example “See our Form 15293 guide for Privacy Act consent on non‑tax records,” so readers know exactly what they will find.

Minimal And Appropriate Accountably Note

If you ever need outside help, look for partners who work inside your systems and respect your compliance boundaries. Accountably occasionally supports organizations that want disciplined delivery, tight documentation, and review protection without adding chaos. If that would help your team, ask us what a clean, structured rollout could look like. No resume farming, no band‑aids, only practical workflow support where it adds real value.

Your first priority is a safe, predictable site. Any partner should make that easier, not harder.

Wrap‑Up, Your Action Plan For This Week

Set your internal deadline, aim to submit two to four weeks before opening, use late December as your annual checkpoint.
Draft Section I now, and Section II if you use a virtual model.
Build the equipment inventory table and match IRS‑loaned items to signed Property Loan Agreements.
Route for coordinator and partner signatures, then submit to your SPEC Territory Office.
Archive the approved plan in your encrypted master folder, share a read‑only copy with leads, and log access.

Quick Troubleshooting Guide

Approval delayed, send a concise follow‑up asking whether signatures, inventory, or virtual steps need clarification, and offer a one‑page summary if that helps.
Missing serials or barcodes, stop and re‑scan the devices, then reconcile your list with storage labels and PLA details.
New volunteer confusion, add a one‑page “how we keep data safe” handout that mirrors your plan’s highlights.

Final Word

You are the lighthouse keeper for your site. Form 15272 is your lamp, you check the fuel, keep the glass clean, and log each rotation. Update it each year, tighten it after storms, and know where every device sits. Do that, and your volunteers will feel calm, your taxpayers will feel safe, and opening day will feel like a plan, not a gamble.