Pub 4557 requirements: what the IRS guide asks of a tax office

The short answer

IRS Publication 4557, Safeguarding Taxpayer Data (Rev. 6-2024), is an educational guide, not a rule. It explains what the FTC Safeguards Rule requires, then lists many practices the IRS wants you to follow. Most of those are recommendations. The legal duties it describes come from the FTC Safeguards Rule, mainly in the section "Comply with the FTC Safeguards Rule."

Where the legal duty comes from

The introduction says: "Protecting taxpayer data is the law." It explains that federal law "gives the Federal Trade Commission authority to set data safeguard regulations for various entities, including professional tax return preparers." Then:

"According to the FTC Safeguards Rule, tax return preparers must create and enact security plans to protect client data."

It adds that "Failure to do so may result in an FTC investigation." On the page about the rule itself, Pub 4557 says the Gramm-Leach-Bliley Act requires "financial institutions" to protect customer information, and that the definition "includes professional tax preparers." So the "must" is the FTC's. See the FTC Safeguards Rule guide for the rule text.

The seven items Pub 4557 says each company "must" do

Under "Comply with the FTC Safeguards Rule," the booklet says the plan must fit "the company's size and complexity, the nature and scope of its activities and the sensitivity of the customer information it handles." Then: "As part of its plan, each company must:"

1. Designate a qualified individual to oversee, implement and enforce the information security program.
2. Implement multi-factor authentication for anyone accessing customer information on your system. The booklet adds: "This is required for all companies regardless of size." The rule itself lets your Qualified Individual approve, in writing, "reasonably equivalent or more secure access controls" instead.
3. Identify and assess the risks to customer information in each relevant area, and evaluate how well the current safeguards control those risks.
4. Design and implement a safeguards program, and regularly monitor and test it.
5. Select service providers that can maintain appropriate safeguards, require it in the contract, and oversee how they handle customer information.
6. Evaluate and adjust the program when circumstances change, including changes in the business or the results of security testing and monitoring.
7. Provide security awareness training and schedule regular refreshers.

This is the IRS's summary. It is shorter than the rule. The full list of what the program has to include is in 16 CFR 314.4, paragraphs (a) through (j), and Pub 4557 does not reproduce all of it. The booklet also says "The requirements are designed to be flexible. Companies should implement safeguards appropriate to their own circumstances."

Items that are recommendations

The checklist section opens by saying the Safeguards Rule "requires companies to assess and address the risks to customer information in all areas of their operation." It names three areas: employee management and training, information systems, and detecting and managing system failures. Then it says:

"Not each of these recommendations will apply to circumstances found in tax preparer offices, but they still provide the building blocks for the creation of a security plan... Depending on the nature of their business operations, firms should consider implementing the following practices:"

So the checklist items are recommendations to consider. The Information Systems area is introduced as "FTC suggestions," and several lines carry added notes labeled "IRS Suggestion." Examples from each area:

• Employees: check references or do background checks before hiring; have new employees sign a confidentiality and security agreement; use password-activated screen savers; impose disciplinary measures for policy violations; deactivate terminated employees' passwords immediately.
• Information systems: know where sensitive information is stored; keep an inventory of computers and equipment; use SSL or another secure connection when sending credit card or other sensitive financial data; encrypt sensitive data sent by email; burn, pulverize or shred paper, and destroy or erase data on computers and other media before disposal.
• System failures: install vendor patches; keep firewalls and anti-virus current; keep logs and monitor them; use an intrusion detection system; have steps ready if a breach occurs.

Each checklist line has boxes for "Ongoing," "Done" and "N/A." The booklet expects that some will not apply to your office. One line, "Require multi-factor authentication for anyone accessing customer information on your system," repeats a "must" item, so it cannot be N/A. For the rest, write down why a line does not apply.

The "basic security steps" section

The earlier "Protect Your Clients; Protect Yourself" pages are written as steps tax professionals "can take today." The list includes anti-virus software on all devices, strong passwords, multi-factor authentication, encrypting sensitive files and emails, backups, limiting access to people who need to know, and a clean desk policy. Its password section says "Use a minimum of eight characters; consider minimum of 16 characters for an administrator's password." These are the IRS's guidance. Multi-factor authentication is also one of the seven "must" items above. The full rule, 16 CFR 314.4, also covers others on this list: it requires encrypting customer information in transit over external networks and at rest (or, where you determine encryption is infeasible, "effective alternative compensating controls reviewed and approved by your Qualified Individual"), and limiting each user's access to the customer information they need for their duties.

The booklet asks for employee training in two places without citing the rule. The phishing section says "All employees in your office must be educated on the dangers of phishing scams." The introduction says "Every employee, both professional and administrative staff, should be educated about security threats and safeguards." Read them as the IRS's expectation. Training is also item 7 in the legal list.

EFIN, PTIN and reporting

The booklet says to check "e-File Applications and PTIN accounts weekly for total returns filed using EFINs and PTINs." It describes how: in e-Services, select "EFIN Status," and contact the e-help Desk if the totals exceed the returns you filed. For PTINs, only preparers who are attorneys, CPAs, enrolled agents or Annual Filing Season Program participants "and who file 50 or more returns may obtain PTIN information." If client data is lost or stolen, "Tax practitioners should report data losses or thefts immediately to the IRS," through your local IRS stakeholder liaison. See what to do after a data theft.

The introduction adds: "Online providers also must follow the six security and privacy standards in Publication 1345." That is a separate IRS requirement for online providers, outside Pub 4557.

What to do with this

Start your written plan from the seven "must" items, then check it against the full list in 16 CFR 314.4, which the FTC Safeguards Rule guide walks through. Treat the checklist as a menu to work through, marking each line done, ongoing or N/A with a reason. IRS Publication 5708 has a sample plan to adapt, and the free WISP generator can give you a draft to edit. For MFA in detail, see the MFA guide.

Sources

• IRS Publication 4557 (Rev. 6-2024), Safeguarding Taxpayer Data: irs.gov/pub/irs-pdf/p4557.pdf
• IRS Publication 5708 (Rev. 8-2024): irs.gov/pub/irs-pdf/p5708.pdf
• IRS Publication 1345: irs.gov/pub/irs-pdf/p1345.pdf
• 16 CFR Part 314 (eCFR): ecfr.gov, Part 314

This is general information, not legal advice.