IRS Publication 4557: a safeguarding checklist for firms

IRS Publication 4557, Safeguarding Taxpayer Data, is the IRS guide to protecting client information in a tax office. It asks firms to take basic security steps, watch for signs of data theft, report and recover from a loss, and comply with the FTC Safeguards Rule. Turn each step into a dated check with an owner.

What is IRS Publication 4557 for?

IRS Publication 4557 is a short guide for tax professionals on keeping taxpayer data safe, last revised in June 2024. Its audience is every preparer, "whether a partner in a large firm or a sole practitioner," and every Authorized IRS e-File Provider. It explains what to do and points to the FTC rule behind the duty.

IRS Publication 4557 (Rev. 6-2024) states its own purpose. It "seeks to help tax professionals to: understand basic security steps and how to take them; recognize the signs of data theft and how to report data theft; respond and recover from a data loss; understand and comply with the FTC Safeguards Rule."

The publication is guidance, and it says where the law comes in. "Protecting taxpayer data is the law," it says, because the FTC Safeguards Rule says tax return preparers "must create and enact security plans to protect client data." It sends readers to Publication 5708 for the plan itself and warns that "Failure to do so may result in an FTC investigation." It adds that online e-file providers must also follow the six security and privacy standards in Publication 1345.

So the two documents fit together this way. The Safeguards Rule sets the legal requirement. Publication 4557 describes the practices that put it into effect, in tax-office terms. Publication 5708 is the template for writing those practices down. What the rule requires, who it covers and how the FTC enforces it are explained in the FTC Safeguards Rule for tax preparers.

The guide has four parts: "Protect Your Clients; Protect Yourself," "Be on Guard," "Report and Respond," and "Comply with the FTC Safeguards Rule." The last part ends with a checklist of FTC suggestions, with Ongoing, Done and N/A boxes beside each item.

The Publication 4557 safeguarding checklist, item by item

The Publication 4557 safeguarding checklist is a list of practices a firm can mark done, ongoing or not applicable. Its basic steps cover security software, passwords, multi-factor authentication, encryption, backups, access limits, device disposal and account monitoring. The longer FTC checklist adds employee management, information systems and handling system failures.

The guide opens its first part with "basic security steps that tax professionals can take today." Under "Review internal controls" it lists:

• Anti-malware and antivirus software "on all devices (laptops, desktops, routers, tablets and phones)," set to update automatically.
• Strong passwords "of 8 or more characters," different for each account, and a password manager to consider.
• Multi-factor authentication "for anyone accessing customer information on your system."
• Encryption of "all sensitive files/emails."
• Backup "to a safe and secure external source not connected fulltime to a network."
• A final review of return information, "especially direct deposit information," before e-filing.
• Wiping or destroying old hard drives and printers that hold sensitive data.
• Limiting access to taxpayer data "to individuals who need to know."
• Checking e-File Application and PTIN accounts weekly for returns filed, and deactivating unused EFINs.
• Withdrawing authorizations for taxpayers who are no longer clients.
• Audit logs that record "who performed the activity, when it was performed, and what changes were made."
• A clean desk policy.

Later sections add wireless network steps (change the router's default administrative password, use WPA-3, avoid public Wi-Fi for business email), a VPN with multi-factor authentication for remote access, an inventory of devices and software that handle tax data, and physical destruction of old media.

The protections that overlap with the IRS Security Six, such as antivirus, firewalls and drive encryption, are explained one by one in IRS Security Six: the six protections.

Checklist for Kestrel Road Tax (example)

Kestrel Road Tax is a fictional four-person firm. The status, owner and date values are examples of how a filled-in checklist looks after the firm's spring review.

The "Fix" line matters as much as the "Done" lines. A checklist with every box ticked on the same afternoon reads like it was filled in without looking.

Publication 4557 guidance on spotting data theft

Publication 4557's "Spot Data Theft" section lists the warning signs that a firm's or its clients' data may have been stolen. The first is client e-filed returns rejecting because a return with the same Social Security number was already filed. Others include unexpected IRS letters, refunds and transcripts, and unexplained computer behavior.

The publication's list, in its own words where quoted:

• Client e-filed returns "begin to reject because returns with their Social Security numbers were already filed."
• Clients who have not filed receive IRS authentication letters (5071C, 4883C, 5747C).
• Clients who have not filed receive refunds.
• Clients receive tax transcripts they did not request.
• Clients get IRS notices that their online account was accessed, disabled or created in their names.
• Returns filed under the firm's EFIN or a preparer's PTIN exceed the number actually filed.
• Clients or colleagues respond to emails the practitioner did not send.
• Computers run slower than normal or turn themselves on.
• Cursors move or numbers change "without touching the keyboard."
• Network computers lock practitioners out.

Several of these show up first in day-to-day work during filing season. A rejected e-file or a client calling about a letter they did not expect is a reason to check the other signs on the list right away.

The weekly return-count check gives a firm an early warning of its own. Publication 4557 explains how to see returns filed per EFIN through e-Services and per PTIN through the online PTIN account. It notes that "Only those preparers who are attorneys, CPAs, enrolled agents or Annual Filing Season Program participants and who file 50 or more returns may obtain PTIN information." Misuse of a PTIN is reported on Form 14157.

Phishing is the most common way in, and Publication 4557 gives it two sections. Examples of the scams aimed at tax offices and how to run a practice drill are covered in phishing scams targeting tax preparers.

How should a firm record its Publication 4557 review?

A firm records its Publication 4557 review by dating each checklist item, naming who checked it, and keeping evidence that the practice is in place. File the dated checklist with the firm's written information security plan so the two documents agree. Repeat the review at least once a year and after any material change.

Publication 4557's own FTC checklist gives each item Ongoing, Done and N/A boxes. Those three states are a good start, and adding a date and an initial turns a ticked box into a record.

Evidence makes the record believable. Useful forms of evidence are small and specific:

• A screenshot of drive encryption status for each laptop, dated.
• The account list from the tax software showing multi-factor authentication on for each user.
• The weekly EFIN and PTIN counts written in a log with the date checked.
• Signed staff acknowledgments from the annual training.
• The data theft contact page, with a "last confirmed" date beside each phone number.

Link the checklist to the plan. IRS Publication 5708 (Rev. 8-2024), the IRS template for a written information security plan, lists Publication 4557 first among the resources to review before writing. Its sample policies point back to "IRS Pub. 4557 Guidelines" for the firm's rules of behavior. When the checklist and the plan say the same thing, either can be shown as proof of the other.

Keep each year's checklist. A run of dated reviews shows a practice that is maintained, which a single current checklist cannot. Firms that already plan a post-season review of their engagements can fold this into the same week; the tax season workflow category covers how firms structure the rest of that cycle.

Every tool that receives client documents belongs in the checklist's device and account inventory. A firm that gathers client files through Schema CPA would list it as the place each client's uploads are collected; the homepage's document types table shows which forms and statements it reads.

When Publication 4557 is not enough on its own

Publication 4557 is not enough on its own when other rules or agreements add duties it does not cover. State breach notification laws, state tax agency reporting, the FTC Safeguards Rule's own requirements, and contract terms with service providers can each require more than the publication describes. The publication itself points to several of these.

State law is the first. Publication 4557's checklist tells firms to "check to see if breach notification is required under applicable state law." Its "Report Data Loss to IRS/States" section adds that firms should contact the states "in which you prepare state returns," through the Federation of Tax Administrators. Publication 5708's implementation clause asks firms to note "if additional state regulatory requirements apply." Which state laws apply, and what they require, depends on where the firm and its clients are.

The Safeguards Rule is the second. Publication 4557 summarizes the rule, but the rule's text is the binding version. For example, 16 CFR 314.4 (eCFR, current as of October 14, 2026) requires encryption of customer information "both in transit over external networks and at rest" and notice to the FTC within 30 days of a breach involving at least 500 consumers. Publication 4557, last revised in June 2024, does not describe the FTC notice.

Contracts are the third. The Safeguards Rule requires firms to require service providers "by contract to implement and maintain such safeguards." Publication 4557 repeats this: "make sure your contract requires them to maintain safeguards." A firm's agreements with its IT contractor, cloud storage provider or document tools are where that duty is met, and the checklist should record that each one was reviewed.

E-file providers have a fourth layer. Publication 4557 notes that online providers "also must follow the six security and privacy standards in Publication 1345." Firms in that group check those standards as well.