The IRS Security Six are six basic protections the IRS and its Security Summit partners ask every tax professional to use: antivirus software, firewalls, multi-factor authentication, backup software or services, drive encryption, and a virtual private network. Each one can be checked on a workstation in a minute or two.
What are the IRS Security Six?
The IRS Security Six is the IRS name for six technical protections that form a starting point for securing a tax office's computers and client data. The IRS described them in news release IR-2024-218, dated August 20, 2024. It calls them "a relatively simple but important starting point for tax pros to protect their offices, computers and data."
IR-2024-218 (August 20, 2024) describes each one. In plain terms:
Antivirus software scans files and memory for patterns that suggest malware. The release notes that vendors "update malware daily," which is why the software must stay current. IRS Publication 4557 (Rev. 6-2024) adds that it should be set to update automatically.
Firewalls shield "computers and networks from malicious or unnecessary web traffic." Publication 4557 notes that Windows and Mac both include a built-in firewall, "which you should enable unless your anti-virus software includes a firewall feature."
Multi-factor authentication adds a step after the password, "such as entering a security code, token or a biometric like a fingerprint." The release adds: "Under new rules from the Federal Trade Commission, all tax professionals are required to use multi-factor authentication." Choosing a method and rolling it out across a firm is covered in multi-factor authentication for tax professionals.
Backup software or services copy critical files to external sources on a routine schedule. The release says backups help with a cyber-attack and also with device failure or a natural disaster.
Drive encryption, also called disk encryption, "transforms data on the computer into protected files that are unreadable to outsiders." It protects a lost or stolen laptop. How it differs from protecting files while they travel is explained in encryption at rest vs in transit.
A virtual private network, or VPN, gives staff who connect from home or unknown networks "a secure, encrypted tunnel to transmit data between a remote user over the internet and the company network."
A five-minute Security Six check for each workstation
A Security Six check for each workstation means opening the settings where each protection shows its status and writing down pass or fix. On Windows, most of the answers are in the Windows Security app and the Settings app. On a Mac, they are in System Settings. Repeat the check on every computer that touches client data.
On Windows, Microsoft's Windows Security app overview lists the app's areas, including "Virus & threat protection" and "Firewall & network protection." It explains the status colors: green means the device is "sufficiently protected," yellow means a safety recommendation, and red "indicates something that needs your immediate attention." Microsoft's Device Encryption page gives the path Settings > Privacy & security > Device encryption, signed in as an administrator.
On a Mac, Apple's FileVault guide gives the path System Settings > Privacy & Security > FileVault. Apple's firewall guide gives System Settings > Network > Firewall. Apple's Time Machine settings guide gives System Settings > General > Time Machine.
Workstation check sheet for laptop WS-04 (example)
The rows below show one fictional workstation, labelled WS-04, at a fictional firm. The pass and fix values are examples.
| Protection | How to confirm | Pass or fix |
|---|---|---|
| Antivirus | Windows: Windows Security, Virus & threat protection shows green. Mac: the firm's security software is installed and its last update is recent. | Pass |
| Firewall | Windows: Windows Security, Firewall & network protection shows green. Mac: System Settings > Network > Firewall is on. | Pass |
| Multi-factor authentication | Sign in to the tax software and firm email from a new browser and confirm a second step is asked for. | Fix: email has no second step |
| Backup | Open the firm's backup tool and confirm a backup finished in the last week. Mac: System Settings > General > Time Machine shows a backup disk. | Pass |
| Drive encryption | Windows: Settings > Privacy & security > Device encryption is on. Mac: System Settings > Privacy & Security > FileVault is on. | Pass |
| VPN | From outside the office, confirm office systems are reachable only after the VPN connects. | Pass |
Record the date, the person who checked and the machine label on the sheet. A "Fix" row gets a name and a due date beside it.
Do Security Six protections cover phones and home offices?
Security Six protections apply to phones and home offices wherever client data is handled. IRS guidance names phones and tablets for antivirus and drive encryption, and the VPN exists specifically for staff who work from home or on unknown networks. A personal device that holds client data needs the same protections as an office computer.
Publication 4557 asks for antivirus on "all devices (laptops, desktops, routers, tablets and phones)." It says drive encryption protects information "on computers, tablets, laptops and smart phones if they are lost, stolen or improperly discarded." Phones that receive client emails or photos of documents are in scope.
Home offices are the VPN's reason for being on the list. IR-2024-218 says firms should set one up because "many tax firms’ employees must occasionally connect to unknown networks or work from home." Publication 4557 adds that multi-factor authentication and a VPN "should be minimum standards for remote access to the firm's office network," and warns against using public Wi-Fi for business email or sensitive documents.
Personal computers are the harder case. Publication 4557's checklist suggests policies for telecommuting staff, including requiring "employees who use personal computers to store or access customer data to use protections against viruses, spyware, and other unauthorized intrusions." IRS Publication 5708 (Rev. 8-2024) goes further, recommending a policy "that no client PII can be stored on any personal employee devices."
Fewer copies of client files on phones and home computers means fewer devices to check. Sending clients one upload link instead of asking them to text photos keeps documents off staff phones; Schema CPA gives each client one link, and the client tracker demo shows what arrived for each client. The client document collection category covers collection methods in general.
Security Six gaps the list does not close
The Security Six leave out staff training, access rights and a written plan, all of which the FTC Safeguards Rule requires. The six are technical controls on devices and networks. They do not decide who may see client data, teach staff to spot phishing, or record the firm's program in writing, and the IRS describes them as a starting point.
Training is the first gap. Publication 4557 says "All employees in your office must be educated on the dangers of phishing scams." The Safeguards Rule at 16 CFR 314.4 (eCFR, current as of October 14, 2026) requires "security awareness training that is updated as necessary." Antivirus does not stop an employee from typing a password into a fake login page.
Access rights are the second. The rule requires access controls that "limit authorized users' access only to customer information that they need to perform their duties and functions." A fully patched, encrypted laptop still exposes every client file if every login can open every folder.
The written plan is the third. Publication 4557 states that the Safeguards Rule "requires companies to develop a written information security plan." The Security Six would appear in such a plan as safeguards, alongside a risk assessment, vendor oversight and an incident response plan. The full list of duties is in the FTC Safeguards Rule for tax preparers.