IRS Publication 4557, explained for small tax practices
Publication 4557 is the IRS guide to safeguarding taxpayer data. Here is what it asks of a small firm, what each control looks like in practice, and where most offices fall short.
What the publication is
Publication 4557, Safeguarding Taxpayer Data: A Guide for Your Business, is written for tax professionals of every size. It explains that paid preparers are treated as financial institutions under federal law, that a written information security plan is required, and what basic protections every office should have in place.
Its companion, Publication 5708, provides a WISP template. The template is a good starting point, but it describes a generic office, not yours.
The Security Six
The IRS and its Security Summit partners call these the baseline protections for every tax professional.
- Antivirus software. In practice today, that means endpoint detection and response with someone watching the alerts, not a free scanner.
- A firewall. A business firewall with current security subscriptions, not the router your internet provider supplied.
- Multi-factor authentication. On email, tax software, the client portal, remote access and anything else that holds client data.
- Backup software or services. Encrypted, offsite copies that ransomware cannot delete, with restore tests you can prove.
- Drive encryption. BitLocker or FileVault on every laptop and workstation, so a stolen device is not a data breach.
- A virtual private network. Secure connections for staff working from home or during season from a second location.
Where small firms usually fall short
- MFA on email but not on the tax software, the portal or the remote access tool.
- Backups that have never been test restored, or that skip the tax software database.
- Encryption on new laptops but not on the older desktop at the front desk.
- No written record that any of it is in place, which is what an insurer or the IRS will ask for.
If data is stolen
Publication 4557 tells firms to report data theft to their IRS Stakeholder Liaison, to state tax agencies, and, under the FTC Safeguards Rule, to the FTC when the incident affects 500 or more people. Knowing those steps before an incident is part of a good incident response plan.
This page is a summary for small firms and is not legal advice. Read the current publication on irs.gov for the full text.
Sunesis Services builds, runs and proves your WISP
Help Desk NW runs the technology. Our sister firm Sunesis Services writes and maintains the Written Information Security Plan the IRS and the FTC require, with a fixed-price WISP and Security Six Diagnostic.
Want to know where your firm stands on the Security Six?
We check all six in an on-site IT assessment and give you a written list you keep.