Most tax and accounting firms know they are supposed to have a written security plan. Far fewer can say what IRS Pub. 4557 actually asks for, which parts of it belong to the firm, and which parts a managed IT provider should be delivering every month. That gap is where firms get surprised: by an insurance questionnaire, by a client’s vendor review, or by an FTC investigation after a breach.

This guide translates the current publication (Rev. 6-2024) and the FTC Safeguards Rule behind it into plain requirements, then maps each one to the work your IT provider should be able to show you in writing.

What Publication 4557 is, and who it applies to

Publication 4557, titled Safeguarding Taxpayer Data, is the IRS guide that explains the basic steps tax professionals should take to protect client information, recognize and report data theft, and recover from it. It applies to professional tax return preparers, and the IRS is explicit that it applies to every employee at the firm, not only the owners. Online providers carry an additional layer: they must also meet the six security and privacy standards in Publication 1345.

The publication is not a standalone rule. It is the IRS’s plain-language companion to a federal law, and that distinction matters when you decide who is responsible for what.

The legal chain: from the Gramm-Leach-Bliley Act to your IT contract

The Gramm-Leach-Bliley Act requires “financial institutions” to protect the security and confidentiality of consumer information. The FTC implements that law through the Safeguards Rule (16 CFR Part 314), and the FTC’s definition of a financial institution is broader than most firms expect: it expressly includes professional tax preparers. Publication 4557 exists to help those preparers meet the Rule. The IRS states the consequence directly: failing to comply may result in an FTC investigation.

Two practical points follow from this chain. First, a firm cannot satisfy the requirement by buying a product; the Rule requires a written program, a named person accountable for it, and evidence that it is tested. Second, the FTC’s 2023 amendment added breach notification duties that took effect in May 2024, so a plan written before then is likely missing pieces.

The seven plan elements, and who actually owns each one

Publication 4557 organizes the Written Information Security Plan (WISP) around seven elements, scaled to the size, complexity, and data sensitivity of the firm. The table below shows each element in practice and where the work usually sits between the firm and its IT provider.

The technical controls Publication 4557 names

Beyond the plan elements, the publication spells out the controls the IRS expects to see. These are the items your provider should be able to demonstrate, not just describe.

• Strong authentication. Unique passwords of at least 8 characters, and 16 for administrators, managed in a password manager, with the “highest multifactor authentication available” turned on wherever it exists.
• Encryption. Sensitive files and emails encrypted, and data in transit protected with secure protocols such as SFTP or TLS. The publication still references TLS 1.1 or 1.2; current best practice is TLS 1.2 or higher.
• Patching and endpoint protection. Software kept current, automatic anti-virus and anti-spyware on every device, and firewalls in place.
• Logging and monitoring. Activity logs, intrusion detection, and monitoring of data transfers so unusual access is caught instead of discovered months later.
• Backups. Full, encrypted backups stored somewhere not permanently connected to the network, ideally monthly and more often during filing season.
• Wireless and remote access. Default router passwords changed, WPA-3 rather than WEP, no business email or taxpayer files over public Wi-Fi, and a secure VPN with MFA for remote work.
• Access control. Need-to-know access to taxpayer data, prompt deactivation of departing employees, and a clean desk policy for paper.
• Secure disposal. Shredding paper and wiping or destroying old drives, printers, and devices before they leave the building.
• Equipment inventory. A current list of every device and application that touches tax data. You cannot protect what you have not listed.

What the FTC Safeguards Rule adds on top

Publication 4557 is the readable summary. The Rule itself is stricter and more specific, and it is what an FTC investigator, a cyber insurer, or a client’s security reviewer will actually measure against. It has nine required elements: the seven above, plus a written incident response plan and annual written reporting from the Qualified Individual to the board of directors or a senior officer.

The threats the IRS says are hitting tax professionals right now

The IRS and the Security Summit, now in its 11th year, launched a five-week “Protect Your Clients; Protect Yourself” series in July 2026 focused on how fraudsters target tax professionals. The patterns are specific: IRS impersonation by email, text, and phone; spear phishing from fake “new clients” who send malicious links or attachments; and phishing aimed at EFINs, EFIN documents, PTINs, and CAF numbers.

Notice what those have in common. None of them are exotic exploits. They are email and identity attacks, which means the controls your provider owns (email filtering, MFA, training, device protection, and monitoring) sit directly between your clients’ Social Security numbers and the people trying to reach them.

If you suspect a data theft: the order of operations

Publication 4557 also tells firms what to do in the first hours. Speed matters because quick reporting lets the IRS block fraudulent returns filed in your clients’ names.

• Report the incident to your IRS Stakeholder Liaison immediately.
• Contact the FBI if directed by the IRS, and local police.
• Notify each state where you prepare state returns, using the Federation of Tax Administrators “Report a Data Breach” resource.
• Contact a security expert and your insurance company. For ransomware, also contact the FBI and CISA.
• Use the FTC’s Data Breach Response guide to notify affected clients.
• Find how the intrusion happened and fix it before resuming work or applying for a new EFIN.

Watch for the warning signs the publication lists: e-filed returns rejected because the Social Security number was already used, clients receiving IRS authentication letters or transcripts they did not request, and EFIN or PTIN return counts higher than your own filings.

Ten questions to ask your IT provider this week

• Who is named as our Qualified Individual, and is that in writing?
• When was our last risk assessment, and can we see it?
• Is MFA enforced on email, remote access, and every system that holds taxpayer data?
• Are laptops and servers fully encrypted, and where are the keys documented?
• When was our last penetration test, and when was our last vulnerability scan?
• Are backups encrypted and kept disconnected from the live network, and when did we last test a restore?
• Do we have a written incident response plan with escalation contacts, and has anyone rehearsed it?
• Does our contract with you require specific safeguards, and how do you prove them?
• When did every employee last complete awareness training?
• When did we last review the full WISP, and who signed it?

The honest version: where firms usually fall short

In our experience, the failure is rarely a missing firewall. It is paperwork and ownership. The technology exists, but nobody has written down who the Qualified Individual is, the risk assessment is two years old, the incident response plan has never been read aloud, and the “backup” has never been restored. Those are exactly the items an insurer or investigator asks for first.

A good provider closes that gap by treating compliance as a recurring deliverable: a dated risk assessment, scheduled scans and tests, training records, and an annual plan review your Qualified Individual can sign. A weak one treats it as a sales line. Use the questions above to find out which one you have. This article is general guidance, not legal advice, so confirm your specific obligations with counsel.

Related reading:
Cybersecurity services ·
Managed IT services ·
Get a free assessment

Sources: IRS, Publication 4557, Safeguarding Taxpayer Data (Rev. 6-2024), irs.gov. FTC, FTC Safeguards Rule: What Your Business Needs to Know, ftc.gov (16 CFR Part 314). IRS news release IR-2026-81, Security Summit summer series, July 7, 2026. Advran, WISP guidance for California CPA firms, 2026.