Publication 4557, Safeguarding Taxpayer Data, is the IRS's guide for tax professionals on protecting client information. Its checklist for creating a plan turns the FTC Safeguards Rule into three working areas and a set of practices under each. This article shows how to use the checklist as a working tool: what each area covers, which items a CPA firm should treat as non-negotiable and how to convert a checkbox into evidence that someone can inspect. The plan document itself is covered in the WISP template walkthrough, and the wider program in cybersecurity for CPA firms.
How the checklist is organized
The publication states that the Safeguards Rule requires companies to assess and address risks to customer information in all areas of their operation, including three areas that are particularly important: employee management and training, information systems, and detecting and managing system failures. It adds that not every recommendation will apply in every tax preparer's office, and that the items are building blocks for a plan. Each item has check boxes for ongoing, done and not applicable. Use them: a checklist where every box is blank is a plan that was never started, and one where every box says "done" with no dates is a plan nobody tested.
Area one: employee management and training
The publication lists practices including:
- Check references or run background checks before hiring employees who will have access to customer information.
- Have each new employee sign an agreement to follow the firm's confidentiality and security standards.
- Limit access to customer information to employees with a business reason to see it.
- Require strong passwords, never shared, with a unique password for each employee with access to taxpayer accounts. The IRS notes a minimum of eight characters, the NIST standard, for passwords.
- Require multi-factor authentication for anyone accessing customer information.
- Lock computers with password-activated screen savers after inactivity.
- Set policies for laptops, phones and mobile devices, including secure storage when not in use, and prefer encrypted files.
- Train employees on locking rooms and file cabinets, not posting passwords, encrypting sensitive information sent over public networks, referring information requests to designated trained individuals and reporting suspicious attempts to obtain customer information.
- Remind employees regularly of the policy and the legal requirement.
- Set policies for employees who telecommute, including whether and how they can access customer data at home, and protections on personal computers.
- Impose discipline for violations.
- Deactivate passwords and user names of departing employees immediately.
The IRS adds a suggestion to label documents to show their importance, such as "Sensitive."
Evidence to keep: signed agreements, training attendance sheets with dates, the access list by role, the offboarding checklist with dates and times, and the remote work policy with employee acknowledgments.
Area two: information systems
The publication follows customer information from data entry to disposal:
- Storage. Know where sensitive information is stored and secure it. Protect storage areas against fire and flood, lock rooms and cabinets when unattended, require strong passwords on servers in physically secure areas and, for cloud storage, use strong passwords and multi-factor authentication and beware of thieves posing as providers. Where possible, avoid storing sensitive data on an internet-connected computer, and keep secure backups and archived data offline in a physically secure place.
- Inventory. Maintain a careful inventory of computers and equipment where customer information may be stored.
- Transmission. Use secure connections when transmitting credit card or other sensitive financial data. If collecting information online, make secure transmission automatic. Do not send sensitive data by email unless it is encrypted, and the IRS suggests using secure file transfer in place of email.
- Disposal. Dispose of customer information securely, consistent with the FTC's Disposal Rule where applicable. Designate someone to supervise disposal, do due diligence on outside disposal companies, shred or pulverize paper, and destroy or erase data on retired computers, drives, phones and other media.
Evidence to keep: the data map showing where client data sits, the equipment inventory, backup logs and restore tests, encryption settings screenshots, the secure transfer procedure and certificates of destruction.
Area three: detecting and managing system failures
The publication says effective security means deterring, detecting and defending against breaches: preventing attacks, diagnosing incidents quickly and having a plan to respond. Its items include:
- Monitor software vendors' websites and industry publications for emerging threats.
- Install patches regularly, use anti-virus and anti-spyware that update automatically, keep firewalls up to date, close unused ports and pass security information to employees promptly.
- Keep logs of network activity and monitor them for unauthorized access, use an intrusion detection system, monitor inbound and outbound transfers for signs of compromise and consider inserting a dummy account in customer lists to detect unauthorized contacts.
- If a breach occurs, secure compromised information at once, such as by disconnecting an internet-connected computer, preserve files that show how it happened and bring in security professionals when feasible.
- Consider notifying consumers where there is a significant risk of identity theft, law enforcement where criminal activity may be involved, credit bureaus and affected businesses, and check state breach notification laws.
- The IRS suggests contacting the IRS and the states after a data loss and having a technical support contract in place.
Evidence to keep: patch logs, antivirus status reports, firewall configuration review dates, log review records, incident log and the response plan. See data theft response plan for tax and audit firms.
Turning the checklist into a control
- Assign an owner for each item. One name, not a department.
- Record the date and the proof. A date and a link to the evidence beside each checkbox.
- Set a frequency. Weekly, monthly, quarterly or annual, matching the item.
- Review quarterly. The coordinator reports status to the partners.
- Mark not applicable with a reason. "Not applicable" without an explanation is an unexamined gap.
- Re-run after changes. New software, a new office, new vendors or a change in remote work should trigger a refresh.
Where the checklist stops
The checklist is a guide, and the written plan has to reflect the firm's own operations. Items such as multi-factor authentication and encryption are firm requirements under the FTC rule as the FTC describes it, and not optional. Where the publication's suggestion is dated, such as a password length or a protocol version, use the current standard the IRS or the FTC publishes. The Safeguards Rule's service provider oversight, board reporting and 30-day FTC notice for a breach affecting 500 or more consumers sit outside the checklist items above and belong in the plan. See FTC Safeguards Rule and vendor oversight.
FAQ
Is Publication 4557 a regulation?
No. It is an IRS guide. The legal requirement comes from the FTC Safeguards Rule.
Do I need every item?
The publication says not every recommendation applies to every office. Record the decision on each.
How often should the checklist be reviewed?
At least quarterly by the coordinator, and fully when the plan is revised.
CORAA prepares ready-to-review audit files for US CPA firms; see /us.
Sources
- IRS, Publication 4557, Safeguarding Taxpayer Data: https://www.irs.gov/pub/irs-pdf/p4557.pdf
- FTC, Standards for Safeguarding Customer Information (Safeguards Rule), 16 CFR Part 314: https://www.ecfr.gov/current/title-16/part-314
Part of CORAA University · Tax and compliance for CPA firms: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error