IRS Publication 4557, “Safeguarding Taxpayer Data: A Guide for Your Business”, is the document the IRS points tax professionals to when it says protecting client data is the law. It is guidance rather than statute – the legal force comes from the FTC Safeguards Rule – but it is the clearest statement of what the IRS expects a practice to be doing, and it is free.
This is Publication 4557 reduced to the things a two-to-twenty person practice actually has to do, in the order that makes them possible.
Where Publication 4557 sits among the IRS documents
The IRS publishes several overlapping documents, which is a common source of confusion. Practically:
| Publication | What it is for |
|---|---|
| 4557 – Safeguarding Taxpayer Data | What to protect and why. The substance. |
| 5709 – How to Create a Written Information Security Plan | The step-by-step for producing the plan document itself. |
| 5293 – Data Theft Resource Guide for Tax Professionals | What to do, and who to call, after a breach. |
| 4524 – Security Awareness for Taxpayers | Client-facing material you can hand out. |
| 5461-D | A short prompt to review your security protocols. |
If you read two, read 4557 and 5709. The first tells you what good looks like; the second turns it into the document you are required to have.
Step one: the inventory nobody wants to do
Every piece of guidance starts here, because nothing else can be done honestly without it. List every place client information exists:
- Practice and tax preparation software, including anything hosted by a vendor.
- Email – which for most practices is where the largest volume of sensitive documents actually sits, in attachments going back years.
- Cloud storage and file sharing, including personal accounts someone used “just once”.
- Laptops, home machines and phones that open work email.
- Backups, including external drives in a desk drawer.
- Paper – files, printouts, and the scanner’s own storage.
The inventory nearly always turns up somewhere unaccounted for. That discovery is the point of the exercise, not a sign you have done it wrong.
IRS Publication 4557 step two: the controls that do the most
Publication 4557 covers a broad range of safeguards. In a small practice, five of them account for most of the real risk reduction.
- Multi-factor authentication everywhere. Tax software, email, cloud storage, the hosting control panel, the domain registrar. This is also a hard requirement of the FTC Safeguards Rule for anyone accessing customer information, so it is not optional advice.
- Encryption in transit and at rest. Confirm it rather than assume it – ask each vendor in writing.
- Unique accounts, never shared logins. Shared credentials make the required activity logging meaningless, because you can no longer tell who did what.
- Remove access promptly. Seasonal preparers are the classic gap: hired in January, gone in May, still holding a login in November.
- Stop emailing unencrypted documents. A return or a W-2 as an email attachment is the most common exposure in the whole practice, and the easiest to fix with a secure file share.
Step three: retention and disposal
This is the element practices most often skip, and it compounds quietly. The FTC Safeguards Rule requires secure disposal of customer information no later than two years after the most recent use in serving that customer, unless you have a legitimate business need or legal requirement to keep it.
In practice that means deciding a retention period, writing it down, and having a routine that actually deletes – from email, from cloud storage, from backups, and from paper. Old data you no longer need is pure liability: it cannot earn you anything and it can still be stolen.
Step four: know what you would do on the bad day
Publication 5293 exists because tax practices are targeted specifically – criminals want client data to file convincing fraudulent returns. Before anything happens, write down:
- Who inside the practice makes the decisions.
- Your IRS Stakeholder Liaison contact details, and your state tax agency’s reporting route.
- That the FTC must be notified within 30 days of discovering a breach affecting 500 or more consumers.
- How you would reach clients if your own email were compromised.
- Where your backups are, and whether anyone has tested restoring one.
An EFIN or CAF number compromise is its own reporting path and time matters – the sooner it is reported, the less can be filed in your name.
Step five: the seasonal reality
Security work in a tax practice has to fit the calendar, which is what most generic advice ignores. From January to April nobody is going to rewrite a security plan. That is the argument for doing it now:
- October to December: inventory, close technical gaps, write the plan, train the staff.
- January to April: follow it. Add seasonal staff to the access list on the way in.
- May: remove seasonal access on the way out, while you remember.
- Summer: review, reassess, and file the annual report.
What a vendor can and cannot do for you under IRS Publication 4557
Plainly: no provider can make your practice compliant, and any that claims to is describing something the rules do not recognize. What a provider can do is carry specific technical controls and answer the service-provider questions your plan has to document.
Liberation Email from $1.95 per user per month puts mail on your own domain on hardware we own and operate in the United States, with nothing scanned for advertising or passed to a data broker. Hub For Teams from $7.49 per user adds secure file sharing, which is the practical fix for emailing returns as attachments. Hosting includes cPanel, where multi-factor authentication is configured, and free SSL.
Ask us the vendor questions in writing – where data sits, who can reach it, what happens in an incident – and file the answers with your plan.
What the IRS actually says about your role
Two framings in the IRS guidance are worth quoting to anyone in the practice who thinks this is somebody else’s problem.
The first is about who is targeted: the IRS states that every tax professional in the United States – whether at a major accounting firm or running a one-person storefront – is a potential target for sophisticated, well-funded and technically capable criminals. The objective is client data, because stolen data produces fraudulent returns that impersonate victims convincingly and are harder to detect.
The second is about the methods: email, phone calls and other approaches designed to obtain computer passwords and e-Services credentials, to steal EFINs or CAF numbers, or to take remote control of the practice’s computers. None of those are technical exploits. They are attempts to persuade a person, which is why staff training is an element of the Rule rather than an optional extra.
A simple annual rhythm for IRS Publication 4557 compliance
| When | What to do |
|---|---|
| October to December | Inventory data, close technical gaps, write or refresh the plan, train staff |
| January | Add seasonal staff to the access list; brief them before they touch client data |
| January to April | Follow the plan. Change nothing you do not have to |
| May | Remove seasonal access the week people leave, not later |
| Summer | Reassess risks, test a backup restore, file the annual report |
Written down and diarised, that is perhaps two days of work spread across a year. Left undiarised, it becomes the thing that never happens because April is always coming.
One more thing worth reading
Publication 5461-D is a two-page prompt to review your security protocols, and Publication 4524 is client-facing security awareness material you can hand out or link from your website. Neither takes long, and the second one does double duty – it demonstrates to clients that the practice takes this seriously, which is increasingly something they ask about before handing over a year of financial records.
Turning IRS Publication 4557 into a written plan you would actually use
The gap between reading IRS Publication 4557 and being able to show a plan is usually a single afternoon of writing. Most practices already do the majority of what the publication describes; what they lack is the document that says so. Here is a structure that fits on four pages.
Page one: what you hold and where. List every system that touches client data – tax software, email, the portal, cloud storage, the scanner’s network folder, any laptop that leaves the office, and the paper files. For each, note where it physically lives and who can reach it. IRS Publication 4557 leans heavily on this inventory because every other control depends on it, and because most practices discover at least one surprise while writing it.
Page two: who may see what. Name the roles in the practice and what each may access. A seasonal preparer usually does not need the firm’s banking records, and a bookkeeper usually does not need every client’s identity documents. Write down how access is granted when somebody starts and, more importantly, how it is removed on the day they leave.
Page three: the controls. Multi-factor authentication on everything that has it. A secure portal rather than emailed attachments. Encrypted laptops. Automatic screen locks. A backup you hold yourself, plus the date you last restored from it. Current software and a named person who checks for updates. This is the part most firms are already doing informally; the publication simply asks you to say it out loud.
Page four: the bad day. Who do you call first, in what order, and with what phone numbers? IRS Publication 4557 points practitioners to their IRS Stakeholder Liaison, and the IRS keeps its current Stakeholder Liaison contact list online – find the number for your state now and put it on the page, because searching for it during an incident is exactly the wrong time. Add your state tax agency, your insurer, your IT provider and the FTC. Note what you would tell clients and how quickly.
Date the document, have the owner sign it, and diarise a review each autumn before the season starts. Four pages, reviewed annually, is a defensible answer to the question IRS Publication 4557 is really asking: can you show that you thought about this before something went wrong?
Frequently asked questions
What is IRS Publication 4557?
Publication 4557, Safeguarding Taxpayer Data: A Guide for Your Business, is the IRS guide telling tax professionals how to protect client information. The IRS points practitioners to it directly in its Protect Your Clients, Protect Yourself campaign, alongside Publication 5709 on writing a security plan and Publication 5293, the data theft resource guide.
Is Publication 4557 mandatory?
The publication itself is guidance rather than the law. The legal requirement comes from the FTC Safeguards Rule, which covers tax preparation firms and requires a written information security program. The IRS states plainly that protecting client data is the law and points to Publication 4557 for how to do it.
What is the difference between Publication 4557 and Publication 5709?
Publication 4557 explains what to safeguard and why. Publication 5709 is the step-by-step guide to producing the plan itself. Most practitioners need both – 4557 for the substance and 5709 for the document.
What should a tax practice do first?
Inventory where client data actually lives, including email, cloud storage, laptops, backups and paper. Nothing else can be done properly until you know what you hold and where, and the inventory almost always turns up somewhere nobody had accounted for.
Who do you notify if a tax practice is breached?
The IRS publishes a data theft resource guide, Publication 5293, covering who to contact – including your IRS Stakeholder Liaison and state tax agency. Separately, the FTC Safeguards Rule requires notifying the FTC within 30 days of discovering a breach involving at least 500 consumers’ unencrypted information.
Related reading
- WISP for Tax Preparers: The 9 Elements You Must Write
- How to Protect Your Business Online — The wider security picture for a small firm.
- Business Email Setup — Email on your own domain, with the agreement in place.