The IRS Security Six for tax preparers, explained

The short answer

The IRS "Security Six" is a list of six basic protections the IRS asks tax professionals to use: anti-virus software, a firewall, two-factor authentication, backup, drive encryption and a virtual private network (VPN). The IRS presents them as advice. The FTC Safeguards Rule, 16 CFR Part 314, is the law, and its text requires two things on that list in some form: multi-factor authentication and encryption, each with an alternative your Qualified Individual can approve. It does not name the other four.

Where the IRS says it

The IRS Tax Tip 2019-117, dated August 27, 2019, says: "Part of this review is following the “Security Six” protections." It lists six items. The IRS also lists "Deploy the ‘Security Six’ measures" as the first group in its Taxes-Security-Together Checklist. Publication 4557 (Rev. 6-2024), the IRS guide to safeguarding taxpayer data, does not use the term "Security Six", but it covers each of the six topics. The sections below use the Tax Tip's wording first and Publication 4557's second.

The six, one at a time

1. Anti-virus software

The Tax Tip says this software "scans computer files or memory for certain patterns that may indicate there’s malicious software." It adds that vendors "find new issues and update malware daily," so users should "install the latest updates of the software." Publication 4557 lists it among internal controls to review: "Install anti-malware/anti-virus security software on all devices (laptops, desktops, routers, tablets and phones) and keep software set to automatically update."

2. Firewall

The Tax Tip says a firewall "shields computers and networks from malicious or unnecessary web traffic." Publication 4557 says a firewall "blocks unwanted connections," and that Windows and Mac "come with built-in firewall protection, which you should enable unless your anti-virus software includes a firewall feature."

3. Two-factor authentication

The Tax Tip says it "adds an extra layer of protection beyond a password": you enter a username and password, then another step, "such as entering a security code." The Taxes-Security-Together Checklist words it more softly: "Opt for two-factor authentication when it’s offered." Publication 4557 is firmer: "Implement multi-factor authentication for anyone accessing customer information on your system." So is the Safeguards Rule. See the table below, and the MFA guide.

4. Backup

The Tax Tip says: "Users should routinely back up critical files on their computers and hard drives to external sources." Publication 4557 says: "Back up sensitive data to a safe and secure external source not connected fulltime to a network." For cloud backups it says to "encrypt data before uploading to the cloud."

5. Drive encryption

The Tax Tip says that because tax professionals keep sensitive client data on their computers, "users should consider drive encryption software." Drive encryption "transforms data on the computer into unreadable files," so only authorized people can read it. Publication 4557 says drive encryption "protects information from being read on computers, tablets, laptops and smart phones if they are lost, stolen or improperly discarded."

6. Virtual private network

The Tax Tip says that because employees sometimes connect to unknown networks or work from home, "the office should establish an encrypted virtual private network." A VPN "provides a secure, encrypted tunnel to transmit data between a remote user over the internet and the company network." Publication 4557 says multi-factor authentication and a secure VPN "should be minimum standards for remote access to the firm’s office network."

Which of the six are in the FTC rule

Section 314.4(c) says to "design and implement safeguards to control the risks you identify through risk assessment, including by" a list of items. Two items on that list line up with the Security Six.

Paragraph (c)(5) reads:

"Implement multi-factor authentication for any individual accessing any information system, unless your Qualified Individual has approved in writing the use of reasonably equivalent or more secure access controls;"

Paragraph (c)(3) reads:

"Protect by encryption all customer information held or transmitted by you both in transit over external networks and at rest. To the extent you determine that encryption of customer information, either in transit over external networks or at rest, is infeasible, you may instead secure such customer information using effective alternative compensating controls reviewed and approved by your Qualified Individual;"

Both have an alternative the rule itself gives, and both involve your Qualified Individual. Our reading, not the rule's words: encrypting a laptop drive covers part of the "at rest" half. The "in transit over external networks" half is about data that leaves your office, such as client files you email or upload. The rule never mentions drive encryption.

The words anti-virus, firewall, backup and VPN do not appear in section 314.4. That does not settle whether your office needs them, because the rule starts from your risk assessment. It does mean the source for those four is IRS guidance, and the IRS wording varies: the Tax Tip says users "should routinely back up" critical files, and Publication 4557 says a VPN "should be" one of the minimum standards for remote access.

Do not mix it up with Pub 1345

Publication 4557 also mentions "the six security and privacy standards in Publication 1345." Those are a different list of six. Publication 1345 says the IRS mandated them for Online Providers of individual income tax returns, and that the sixth, "Reporting of Security Incidents," is now mandated for all Providers. See the EFIN guide.

Put it in your plan

Your written plan is the place to record which of these you use and who your Qualified Individual is. The free WISP generator makes a draft, and the Safeguards Rule guide covers the rest of the rule.

Sources

• IRS Tax Tip 2019-117, Tax pros: Follow the “Security Six” steps to help protect taxpayer data: irs.gov
• IRS, Tax Security 2.0: The Taxes-Security-Together Checklist: irs.gov
• IRS Publication 4557 (Rev. 6-2024): irs.gov/pub/irs-pdf/p4557.pdf
• IRS Publication 1345 (Rev. 12-2025): irs.gov/pub/irs-pdf/p1345.pdf
• 16 CFR 314.4 (eCFR, 2026-10-01): ecfr.gov, Part 314

This is general information, not legal advice.