IRS Publication 4557, Safeguarding Taxpayer Data, is the IRS security guide for tax professionals. It explains the basic protections every tax office should have, how to spot data theft, who to report it to and how the FTC Safeguards Rule applies to your firm.
It isn't a law by itself. It explains one. The FTC Safeguards Rule requires tax preparers to keep a written security plan, and Publication 4557 warns that failing to do so "may result in an FTC investigation." The plan itself goes in Publication 5708, the IRS template. Publication 4557 tells you what that plan should protect.
The current version is Rev. 6-2024, 21 pages in four parts. Most of it is technical work, like multi-factor authentication, encryption, backups, firewalls and device inventories. For a small firm, the most useful way to read it is as a checklist against your office as it is today. For each item, note who does it and how you'd show someone it's done.
Who Publication 4557 is for
The IRS wrote it "for all tax preparers, transmitters, and software developers." The introduction is direct about scope. "Data security is now a necessity for every tax professional, whether a partner in a large firm or a sole practitioner." And it says every employee, "both professional and administrative staff," should be educated about threats.
It also makes the legal point early. "Protecting taxpayer data is the law." Under the FTC Safeguards Rule, it says, "tax return preparers must create and enact security plans to protect client data," and failing to do so "may result in an FTC investigation."
For the plan itself, Publication 4557 points you to Publication 5708, the IRS template for a written information security plan. The two work together. Publication 4557 explains what to protect and why. Publication 5708 is where you write down how your firm does it. Both are named on line 11 of Form W-12, where every PTIN renewal has you confirm you're aware that preparers are required by law to keep a written plan.
What Publication 4557 asks you to do
The guide is 21 pages in four parts. Here's the substance of each.
Protect your clients, protect yourself
The basic security steps. Security software on every device, set to update automatically. Strong, unique passwords that aren't shared between employees. Multi-factor authentication on tax software, email and storage accounts. Encryption for sensitive files and emails. Backups to a secure location that isn't connected to the network full time, which the guide calls "your best protection against ransomware attacks." Wiping or destroying old drives and printers. Limiting access to people who need it. An inventory of every device and every piece of software that touches client data.
It also covers wireless networks. Change the router's default password, use current Wi-Fi encryption, and don't use public Wi-Fi for client work. For staff who work from home, it says multi-factor authentication and a VPN "should be minimum standards."
Be on guard
How to tell you've been hit. The signs it lists include e-filed returns rejecting because a client's Social Security number was already used, clients getting IRS letters or refunds for returns they never filed, and more returns filed under your EFIN or PTIN than you actually filed. Computers that run slow, turn on by themselves or have cursors moving on their own also make the list.
It recommends checking your e-File application and PTIN account weekly for the number of returns filed under your numbers.
Then phishing. "All employees in your office must be educated on the dangers of phishing scams." The guide explains spear phishing, where thieves pose as your tax software provider, your storage provider, the IRS or a prospective client. We cover what staff training should include in security awareness training.
Report and respond
If client data is stolen, report it to your local IRS Stakeholder Liaison, the states where you prepare returns, the FBI if directed and local police. The guide also says to bring in a security expert to find the cause and stop the breach, and to call your insurer. Speed matters here because the IRS can act to block fraudulent returns using your clients' information once it knows (IRS data theft information for tax professionals).
Before resuming tax prep and being issued a new EFIN, the guide says to figure out how the intrusion happened and fix it. Our incident response plan guide walks through the order of calls.
Comply with the FTC Safeguards Rule
The last section restates what the rule requires of every firm, quoting the FTC's requirements. Designate a qualified individual. Assess risks. Design safeguards and test them. Oversee your service providers. Adjust the program over time. Provide security awareness training with regular refreshers. And use multi-factor authentication for anyone accessing customer information, which it says is "required for all companies regardless of size." The rule itself is 16 CFR 314.4.
It closes with a checklist you can mark "ongoing," "done" or "N/A." The items are grouped under employee management and training, information systems, and detecting and managing system failures. The IRS notes that not every item will fit every tax office.
Publication 4557 vs. the WISP
People mix these up. Here's the short version.
| Publication 4557 | Publication 5708 | FTC Safeguards Rule | |
|---|---|---|---|
| What it is | IRS guidance | IRS template | Federal regulation |
| What it does | Explains what good security looks like in a tax office | Gives you a sample written plan to fill in | Requires the written plan and the safeguards in it |
| Do you have to use it? | No, but it describes what the rule expects | No, but you must have a written plan | Yes |
| Where to read it | irs.gov | irs.gov | 16 CFR 314.4 |
Our guides cover the WISP template and the IRS WISP requirements in detail.
Reading Publication 4557 doesn't satisfy the rule. Having a written plan that describes safeguards you actually run does.
Where firms get stuck
Most of Publication 4557 is technical. Firewalls, encryption, multi-factor authentication, patching, logs, backups. For a firm of five or fifty people, that's work for whoever runs IT, and in plenty of small offices that's the owner. As one preparer on Reddit joked about their own office, "my IT guy is me" (r/taxpros).
The guide even says so itself. "Consider engaging security professionals for assistance or check with your professional liability carrier about data theft coverage."
A useful way to read Publication 4557 is as a checklist against your office as it is today. For each item, write down whether it's done, who does it and how you'd show someone it's done. The gaps are your to-do list.
Where to start this week
- Download Publication 4557 and go through the checklist at the back.
- Turn on multi-factor authentication anywhere it's available and off, starting with tax software and email.
- Check your EFIN and PTIN return counts, and put a weekly reminder on the calendar.
- Look up your IRS Stakeholder Liaison and save the contact now, before you need it.
- Confirm your backups are encrypted and kept somewhere ransomware can't reach.
- Start or update your written plan using Publication 5708.
Our free security check gives you a plain score on these basics, and it can match you with one IT company that works with firms like yours.