What does IRS Publication 4557 ask tax professionals to do?

Who is it written for?

IRS Publication 4557 is the IRS guide to protecting client data for tax professionals. It names every tax professional, from a partner in a large firm to a sole practitioner, and every Authorized IRS e-File Provider.

Data security is now a necessity for every tax professional, whether a partner in a large firm or a sole practitioner, and every Authorized IRS e-File Provider.

What does it say about the FTC Safeguards Rule?

The publication says the FTC Safeguards Rule covers professional tax preparers, because the rule's definition of financial institutions includes them.

It says tax return preparers are to create and put in place security plans to protect client data.

According to the FTC Safeguards Rule, tax return preparers must create and enact security plans to protect client data.

The "financial institutions" definition includes professional tax preparers.

What does it say about a written plan?

The publication says the Safeguards Rule asks for a written information security plan that describes how the business protects customer information.

It says the plan should fit the size and complexity of the business, what it does, and how sensitive the customer information is.

The Safeguards Rule requires companies to develop a written information security plan that describes their program to protect customer information.

According to the FTC, the required information security plan must be appropriate to the company's size and complexity, the nature and scope of its activities and the sensitivity of the customer information it handles.

Who should be told about a data theft?

The publication asks a preparer to report client data theft to the local IRS stakeholder liaison.

After a data loss, it asks the preparer to keep the stakeholder liaison updated, and notes that IRS telephone assistors cannot take third-party reports of identity theft.

Internal Revenue Service, report client data theft to your local stakeholder liaison.

Update your IRS Stakeholder Liaison with developments; IRS telephone assistors cannot accept third-party reports of identity theft.

What can an outside reading show for this rule?

This rule asks for care across the whole firm. An outside reading cannot see your policies, your training, your devices, your access lists or who can sign in to what.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

That is evidence toward the duty, never proof of it. Where the text names no control, we add none for it.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.