IRS Publication 1075: Security Controls, Compliance, and Penalties

IRS Publication 1075 is the IRS Office of Safeguards rulebook that every federal, state, and local agency, along with their contractors and subcontractors, must follow when they receive, store, process, or transmit Federal Tax Information (FTI). It translates the confidentiality requirements of Internal Revenue Code Section 6103 into concrete technical, physical, and administrative controls built on the NIST SP 800-53 moderate security baseline.¹ Meeting those controls is the price of continued access to FTI; falling short can cost an agency its data feed, expose employees to felony charges, and open the organization to civil damages.

Who Has to Follow Publication 1075

The rules apply to anyone who touches FTI on behalf of an agency that has a disclosure agreement with the IRS. Federal Tax Information is any return or return information received from the IRS or derived from an IRS data source, and the statutory definition of “return information” is broad: taxpayer identity, income, deductions, credits, payment history, examination status, and essentially anything the IRS collects or generates about a taxpayer’s liability.²

That coverage flows downhill. If a state revenue department, a child support enforcement office, or a benefits eligibility agency receives FTI, every contractor, subcontractor, cloud provider, or agent that handles the data on its behalf inherits the same obligations. Sign a data exchange agreement involving IRS tax data, and Publication 1075 applies to you.

The Security Controls the Publication Requires

Publication 1075 adopts a subset of the NIST SP 800-53 moderate baseline and layers IRS-specific requirements on top of it.¹ The result cuts across more than a dozen control families. The following are the ones that shape day-to-day operations.

Access Control

Access to FTI runs on least privilege. Each user gets only the access needed for the job, and no single person should control every step of a critical FTI process. Systems must authenticate and authorize users, and remote access requires multi-factor authentication. Accounts must be monitored for unusual activity, and any account that has expired or is no longer tied to an active user must be disabled within 120 days.³

Encryption and Communications Protection

Any FTI moving across a non-trusted network, including the public internet, must be encrypted with the latest FIPS 140 validated cryptographic module. The same standard applies to FTI at rest, whether on a server, a laptop, or a cloud platform. Remote access requires a VPN with end-to-end encryption, and the FTI processing environment must be segmented from general-purpose networks. These rules apply across the whole system boundary, end-user workstations included.¹

Media Protection and Disposal

All electronic and non-electronic media containing FTI must be inventoried and protected in storage, transport, and use outside a secure area. FTI on portable media must be encrypted in transit. When the data is no longer needed, the media must be sanitized so nothing is recoverable, using methods such as degaussing or physical destruction, and each destruction event has to be documented.

Personnel Security

Everyone with FTI access must pass a background investigation first. The IRS requires three components: fingerprinting, citizenship or work-authorization verification, and local law enforcement checks covering every place the person has lived, worked, or attended school in the past five years.⁴ Agencies use the results to assess risk, not necessarily as a hiring pass/fail. Once inside, personnel must complete annual security awareness training covering their specific FTI responsibilities and insider threat risks.

Physical Security

Facilities where FTI is stored or processed must restrict physical access to authorized individuals through badge readers, biometric scanners, or physical keys, with maintained access logs. Non-electronic FTI has to sit in locked containers, safes, or vaults, and keys and combinations are managed under written procedures. The facility perimeter and critical access points require continuous monitoring.

Cloud Environments and FedRAMP

Cloud deployments carry extra requirements. Only cloud service offerings with a FedRAMP authorization at the moderate impact level may receive, process, store, or transmit FTI. A higher-layer service built on top of a FedRAMP-authorized infrastructure platform still needs its own separate FedRAMP authorization.⁵

Before moving FTI into any cloud environment, the agency must notify the IRS Office of Safeguards at least 45 days in advance by emailing the Safeguards mailbox.⁶ Once live, the cloud environment is subject to the same Publication 1075 controls as any on-premises FTI system, including encryption, access control, and audit logging.

Documentation the IRS Expects

Publication 1075 compliance is proven on paper. Verbal assurance that controls exist does not satisfy the Office of Safeguards; documentation does.

System Security Plan and Safeguard Security Report

The System Security Plan (SSP) is the central document for an FTI system. It defines the system boundary, lists components, describes the specific FTI handled, and explains how each applicable NIST and IRS control is implemented. It must be kept current as the environment changes. New agencies requesting FTI submit a Safeguard Security Report (SSR), which serves a similar function, at least 90 days before receiving data. The SSR and its attachments must be updated and resubmitted annually.⁷

Incident Response and Contingency Plans

An Incident Response Plan tailored to FTI breaches is required. It must describe how the organization detects, contains, and recovers from an FTI incident, and it should be tested regularly through tabletop exercises or similar drills. A Contingency Plan covering how FTI operations continue or are restored after a disaster or system failure is also mandatory, and it must include backup procedures and defined recovery timeframes.

Interconnection Agreements and Authority to Operate

When FTI is shared with or processed by another entity, an Interconnection Security Agreement or Memorandum of Understanding must spell out each party’s security responsibilities and confirm Publication 1075 compliance. Before an agency can start processing live FTI, it needs a completed Security Assessment and Authorization package, including a Security Assessment Report documenting an independent control assessment, ending in an Authority to Operate (ATO).⁷ No ATO, no live FTI.

How the IRS Verifies Compliance

The Office of Safeguards runs a multi-stage review cycle. Every three years, each agency receiving FTI undergoes an on-site review.⁸ Between visits, desk reviews of the SSR, SAR, and supporting documentation assess whether the described controls remain adequate, and the SSR itself is updated annually to reflect any changes to safeguarding procedures.⁷

During an on-site visit, IRS personnel inspect facilities and IT systems, interview staff, and run technical checks to confirm the controls in the SSP actually work. That includes physical security walk-throughs and detailed computer security testing. Findings go into a Safeguard Review Report identifying any deficiencies or areas of non-compliance.

Any findings trigger a Corrective Action Plan. The agency defines remediation steps, assigns resources, and commits to timelines for each deficiency. The Office of Safeguards approves the plan, and the agency provides progress updates until every item is closed. If significant deficiencies stay unresolved, the IRS can suspend or terminate FTI disclosures to that agency.²

Reporting a Suspected Breach

When an agency discovers a possible improper inspection or disclosure of FTI, including breaches and security incidents, it must notify the IRS Office of Safeguards immediately and no later than 24 hours after identifying the issue.⁹ Notification goes by encrypted email to the Safeguards mailbox and must include a data incident report with the agency point of contact, the dates the incident occurred and was discovered, a description of the data involved, and the estimated number of FTI records affected.

Speed matters more than completeness. If details are still missing, send the initial report anyway and follow up as more information comes in. The data incident report itself must not contain any actual FTI.⁹

Penalties for Getting It Wrong

The consequences of mishandling FTI reach past the loss of data access. Federal law separates unauthorized disclosure (sharing the data) from unauthorized inspection (looking at it without authorization), and each carries its own criminal tier alongside civil exposure.

Criminal Penalties

Under IRC Section 7213, willfully disclosing a return or return information without authorization is a felony. The penalty is a fine of up to $5,000, up to five years in prison, or both, plus the costs of prosecution. Federal employees convicted under this section face mandatory dismissal on top of any fine or prison time, and state employees and contractors face the same felony penalties.¹⁰

Unauthorized inspection, covered by IRC Section 7213A, is a lesser but still federal crime. It carries a fine of up to $1,000, up to one year in prison, or both. Federal employees convicted of unauthorized inspection also face mandatory dismissal.¹¹

Civil Damages

Taxpayers whose FTI is improperly inspected or disclosed can sue under IRC Section 7431. Damages are the greater of $1,000 per unauthorized act or actual damages. When the violation was willful or resulted from gross negligence, punitive damages are available on top of actual damages, and the court can award attorneys’ fees and litigation costs.¹²

Loss of FTI Access

The administrative penalty is often the one agencies feel first. If the Secretary of the Treasury determines that an agency has failed to meet Section 6103 safeguarding requirements, the IRS can refuse to disclose any further returns or return information until the deficiencies are corrected.² For agencies whose tax administration, child support enforcement, or benefits eligibility programs depend on FTI, that shutoff can halt core operations until the Corrective Action Plan closes every open finding.

1
Internal Revenue Service. Encryption Requirements of Publication 1075
2
Office of the Law Revision Counsel. 26 U.S. Code 6103 – Confidentiality and Disclosure of Returns and Return Information
3
Internal Revenue Service. Publication 1075 Tax Information Security Guidelines for Federal, State and Local Agencies
4
Internal Revenue Service. Background Investigation Requirements Safeguards Office Hours
5
Internal Revenue Service. Cloud Computing Environment
6
Internal Revenue Service. IRS Safeguards Cloud Computing Notification
7
Internal Revenue Service. Safeguard Security Report
8
Internal Revenue Service. Safeguard Review IT Scoping Office Hours Call Agenda
9
Internal Revenue Service. Reporting Improper Inspections or Disclosures
10
Office of the Law Revision Counsel. 26 U.S. Code 7213 – Unauthorized Disclosure of Information
11
Office of the Law Revision Counsel. 26 USC 7213A – Unauthorized Inspection of Returns or Return Information
12
Office of the Law Revision Counsel. 26 U.S. Code 7431 – Civil Damages for Unauthorized Inspection or Disclosure of Returns and Return Information