IRS Publication 4557, Safeguarding Taxpayer Data, is the IRS guide to protecting client data in a tax practice. The current edition is Rev. 6-2024. Most of it is advice: security steps the IRS recommends, signs of data theft, and who to call when it happens. The legal duty sits elsewhere, in the FTC Safeguards Rule, which the publication itself points to. This guide walks through what Pub 4557 says, section by section, and marks which items the Safeguards Rule turns into requirements.
Is Publication 4557 mandatory?
Not by itself. Pub 4557 is educational guidance, and much of it is written as "consider" or "should". The binding law is the FTC Safeguards Rule (16 CFR Part 314), issued under the Gramm-Leach-Bliley Act. The rule treats professional tax preparers as financial institutions and requires a written information security program. Pub 4557 says so directly: tax return preparers must create and enact security plans, and failing to do so may result in an FTC investigation.
Two related IRS documents matter too. Publication 5708 is the IRS guide to writing a written information security plan (WISP). Authorized IRS e-file Providers must also follow the six security and privacy standards in Publication 1345.
What Publication 4557 covers
The guide has four parts:
- Protect your clients, protect yourself: basic security steps, security software, strong passwords, secure wireless networks and protecting stored client data.
- Be on guard: spotting data theft, monitoring your EFIN and PTIN, recognising phishing and staying safe online.
- Report and respond: reporting a data loss to the IRS and the states, then recovering from it.
- Comply with the FTC Safeguards Rule: what the rule requires and a three-part checklist for building your plan.
The basic security steps the IRS lists
Pub 4557 opens with internal controls every practice can put in place. In the IRS's words, condensed:
- Anti-malware on every device, including routers, tablets and phones, set to update automatically.
- Strong, unique passwords of at least 8 characters, and at least 16 for administrator accounts, with a password manager.
- Multi-factor authentication for anyone accessing customer information on your system.
- Encryption of sensitive files and emails, especially those holding taxpayers' personal information.
- Backups to a secure external source that is not connected full time to a network.
- A final check of return information, especially direct deposit details, before e-filing.
- Wiping or destroying old hard drives and printers that held sensitive data.
- Access to taxpayer data limited to people who need it.
- Weekly checks of returns filed under your EFINs and PTINs, and deactivating unused EFINs.
- Withdrawing authorizations (power of attorney, tax information) for people who are no longer clients.
- Audit logs recording who did what, and when.
- A clean desk policy.
Where the Safeguards Rule makes it mandatory
Several of those steps are requirements under 16 CFR 314.4, not just advice:
- A Qualified Individual who oversees the program. This can be an employee or a service provider, but the firm keeps responsibility (314.4(a)).
- A risk assessment the program is based on (314.4(b)).
- Encryption of customer information in transit over external networks and at rest. If that is infeasible, the Qualified Individual can approve effective compensating controls (314.4(c)(3)).
- Multi-factor authentication for any individual accessing any information system, unless the Qualified Individual approves equivalent or stronger controls in writing (314.4(c)(5)).
- Logging and monitoring of what authorized users do with customer information (314.4(c)(8)).
- Without continuous monitoring: an annual penetration test and a vulnerability assessment at least every six months (314.4(d)(2)).
- Security awareness training for staff (314.4(e)).
- Service providers that can keep appropriate safeguards, a contract requiring them to, and periodic reassessment (314.4(f)).
- A written incident response plan (314.4(h)), and a written report from the Qualified Individual at least once a year to the board or a senior officer (314.4(i)).
- Notice to the FTC as soon as possible, and no later than 30 days after discovery, when unencrypted customer information of at least 500 consumers is acquired without authorization (314.4(j)).
The exemption for smaller practices
Under 16 CFR 314.6, a firm that holds customer information on fewer than 5,000 consumers does not have to meet four of these: the written form of the risk assessment, the annual penetration test and six-monthly vulnerability assessment, the written incident response plan, and the annual written report. The rest still applies, including the risk assessment itself, encryption, MFA, training and service-provider oversight. Count every consumer whose information you keep, not just this season's clients.
Spotting data theft and monitoring your EFIN and PTIN
Pub 4557 lists the signs that a practice has been breached. These include client e-filed returns rejected because a return was already filed under their Social Security number, clients who have not filed receiving IRS authentication letters (5071C, 4883C or 5747C) or refunds, and more returns filed under your EFIN or PTIN than you actually filed.
You can check EFIN totals weekly in e-Services under EFIN Status, and contact the e-help Desk if the count is too high. PTIN totals are available under "View Returns Filed Per PTIN" to attorneys, CPAs, enrolled agents and Annual Filing Season Program participants who file 50 or more returns. Report misuse of a PTIN on Form 14157.
If client data is stolen
Pub 4557 sets out who to contact:
- The IRS, through your local Stakeholder Liaison. IRS telephone assistors cannot take third-party identity theft reports.
- The states where you prepare returns, using the Federation of Tax Administrators contact list.
- Local police, and the FBI if the IRS directs you to. For ransomware, the IRS also says to contact the FBI and CISA.
- A security expert to find the cause and scope and stop the breach, and your insurer.
- The FTC, within 30 days, if the event meets the 500-consumer threshold above. State breach notification laws may apply as well.
The Publication 4557 checklist
The last part of Pub 4557 is a checklist, drawn from FTC guidance, for building the security plan. It covers three areas. Employee management and training: background checks, confidentiality agreements, need-to-know access, MFA, screen locks, telework rules, and cutting off access the moment someone leaves. Information systems: knowing where client data is stored, encrypting it in transit, offline backups, a device inventory and secure disposal. Detecting and managing system failures: patching, up-to-date firewalls, closing unused ports, activity logs, intrusion detection, and a breach plan that starts with disconnecting a compromised machine and preserving evidence.
The checklist is the starting point for a WISP. The IRS does not review or approve WISPs; you keep yours current and produce it if asked. Our WISP checklist for tax preparers and WISP templates vs custom plans go into more detail.
Where we can help
We build the technical safeguards the rule requires, write the WISP around them for you to adopt and sign, and can act as your Qualified Individual. See IT and WISP support for CPA and tax firms. Sources: IRS Publication 4557 (Rev. 6-2024) and the FTC Safeguards Rule, 16 CFR Part 314. This is general information, not legal advice.
Frequently asked questions
Is IRS Publication 4557 a legal requirement?
Does a text-message code count as multi-factor authentication?
Does the IRS approve my security plan?
What is the difference between Publication 4557 and Publication 5708?
Get your practice's WISP and safeguards in place
We set up MFA, encryption, backups and logging, write the WISP for you to sign, and can serve as your Qualified Individual.