IRS Publication 4557: Security Plan, Safeguards, and Penalties

IRS Publication 4557 sets out the data security requirements for tax professionals, pulling together the obligations preparers already have under Internal Revenue Code Section 7216 and the FTC Safeguards Rule into one practical guide. If you prepare returns for compensation, it tells you what written plan you need, what safeguards must be in place, and what to do when client data is exposed.

The publication itself does not create new law. It translates two sets of existing federal requirements into steps a working practice can follow, and it is the document the IRS will measure you against if something goes wrong.

The Legal Obligations Behind the Publication

Two separate federal regimes drive what Publication 4557 asks of you, and they operate differently.

Section 7216 of the Internal Revenue Code makes it a federal crime for a preparer to disclose or misuse information a client provides for return preparation. The definition is broad: names, addresses, Social Security numbers, income, deductions, and anything else connected to the return.¹ You can use that information to prepare the return. Using it for anything else, or sharing it with a third party, requires the client’s written consent in advance, and that consent must name you, name the client, describe the information, state the purpose, and identify the recipient.² Certain disclosures do not need consent, including those to the IRS itself, those required by court order, and sharing with other preparers working on the same return.³

The FTC Safeguards Rule covers the mechanical security of the data itself. The rule applies to “financial institutions” under FTC jurisdiction and specifically names tax preparation firms as covered entities. Every covered firm must develop, implement, and maintain a written information security program with administrative, technical, and physical safeguards. Firms with fewer than 5,000 customers are exempt from certain provisions, but the core duty to protect client data still applies.⁴

The Written Information Security Plan

The Written Information Security Plan, or WISP, is the central document the law requires you to produce and maintain. The IRS published a separate companion guide, Publication 5708, to help small and mid-size practices build one.⁵

At a minimum, your WISP has to cover:

A designated security coordinator responsible for the program. In a solo or small practice this is often the owner.
A risk assessment identifying what client information you handle, where it lives, and the threats it faces, repeated regularly.
An inventory of every device that stores or processes taxpayer data, including computers, external drives, printers with internal memory, and mobile devices, along with their locations.
The administrative, technical, and physical safeguards you have in place.
Service provider oversight. Any contract with cloud tax software vendors, outside IT, or other third parties that touch client data must require those providers to maintain appropriate safeguards.
An incident response plan setting out what happens if a breach occurs.

The plan has to fit the firm. A solo preparer working from a home office faces different risks than a 20-person operation with multiple locations. What matters is that the WISP addresses your actual operations, not that it reaches a particular length.⁵

The Safeguards You Have to Put in Place

Publication 4557 groups required controls into three categories. The categories overlap in practice, but thinking through each one helps make sure nothing is missing.⁶

Administrative Safeguards

These are the people-and-process controls. The security coordinator runs the program, but every person in the firm needs training on how to spot phishing emails, handle paper documents, and report anything suspicious. Training is ongoing, not a one-time orientation.

Remote work gets special attention. Staff accessing client data from home or on the road should use company-approved devices and connect through a virtual private network. Tax software should never be opened over public Wi-Fi. Data access should be limited to employees who actually need it, and audit logs should record who accessed what and when.⁶

Technical Safeguards

Multi-factor authentication is required for anyone logging into systems that hold client information. That means something beyond a password: a code sent to a phone, a hardware token, or a biometric scan.⁶ It is the single most effective step a small practice can take, because stolen passwords are how most breaches start.

All taxpayer data must be encrypted, whether it is sitting on a hard drive or moving through email. Anti-malware software is required on every device, routers and tablets included, and should update automatically. Patch management matters more than it sounds: when the operating system or tax software vendor releases a security update, apply it promptly, because the vulnerabilities those patches close are often already being exploited. Your network should sit behind a properly configured firewall, and regular vulnerability scanning helps you find gaps before someone else does.

Physical Safeguards

Physical controls protect against the oldest form of data theft: someone walking out with files. Offices need locked doors and restricted access to rooms holding servers or paper records. Alarm systems add a layer. Paper records belong in locked cabinets when not in use, and a clean desk policy at the end of each day keeps sensitive documents out of sight.⁶

Disposal is where firms often slip. Paper records require cross-cut shredding; a strip-cut shredder is not enough. Old hard drives, USB sticks, and printers with internal memory must be securely wiped or physically destroyed before you sell, donate, or discard them. Deleting files does not remove recoverable data.

What to Do If Client Data Is Breached

Even prepared firms get hit. Publication 4557 requires an incident response plan so the critical decisions are not being made in a panic.

First, isolate the compromised systems from the rest of the network, then assess the scope: what was accessed, which data was exposed, and how many clients are affected. Preserve logs and evidence for law enforcement and for your own forensic review, which should identify the root cause so the vulnerability can be closed.

Contact your local IRS Stakeholder Liaison immediately. The Liaison notifies IRS Criminal Investigation and other relevant divisions on your behalf, and if the IRS learns quickly enough it can flag affected clients’ accounts and block fraudulent returns filed under their names.⁷

A 2023 amendment to the Safeguards Rule requires financial institutions, tax firms included, to notify the FTC within 30 days of discovering a breach involving the unencrypted information of at least 500 consumers. The notice must describe the event and the number of consumers affected.⁸

You also have to notify the individual taxpayers whose data was exposed. The timing is governed by state breach notification laws, which vary. States with numeric deadlines generally require notification within 30 to 60 days of discovery; others use open-ended language like “without unreasonable delay.” Your notice should explain what happened, what was exposed, and what steps you are taking.

Once the crisis is contained, conduct a post-incident review. What failed, who followed the plan, what would change next time. Document the forensic findings, remediation steps, and communications, and feed what you learned back into the WISP.

Penalties for Non-Compliance

Consequences come from more than one direction and can stack.

Section 6713 imposes a civil penalty of $250 for each unauthorized disclosure or use of return information, capped at $10,000 per preparer per calendar year. When the violation is connected to identity theft, whether or not a fraudulent return is actually filed, the penalty rises to $1,000 per violation with a $50,000 annual cap. The standard and enhanced penalties are tracked separately, so a preparer involved in both can face up to $60,000 in civil penalties in a single year.⁹

A knowing or reckless violation of Section 7216 is a misdemeanor punishable by up to one year in prison and a fine of up to $1,000. Where the violation involves identity theft covered by Section 6713(b), the maximum fine rises to $100,000.¹

FTC enforcement is separate. As of the January 2025 inflation adjustment, the FTC can seek civil penalties of up to $53,088 per violation, with the figure adjusting upward each year.¹⁰ “Per violation” can mean per affected consumer or per day of non-compliance depending on the circumstances, so FTC exposure can grow quickly for firms handling thousands of returns.

For most practices, the most immediately damaging consequence is losing the ability to e-file. The IRS can revoke a firm’s Electronic Filing Identification Number, and any preparer expecting to file 11 or more returns in a year is required to e-file. Losing that privilege effectively shuts a modern practice down. Sanctioned preparers can request an administrative review and, if the review goes against them, appeal to the IRS Independent Office of Appeals, but the disruption during that process is severe.¹¹

Keeping the Plan Current

Publication 4557 is not a one-time compliance exercise. The IRS recommends checking your e-file application and PTIN account weekly for unexpected filing activity, deactivating EFINs you no longer use, and withdrawing powers of attorney for clients who have left.⁶

The WISP has to be re-evaluated whenever the business changes. New employees, new offices, new software, or a move to remote work all create risks the original plan did not contemplate. The Safeguards Rule specifically requires you to adjust your program in light of changes to business operations or the results of security testing.⁵ Tax season creates tunnel vision, and security reviews tend to get pushed to “after April.” The firms that get breached are almost always the ones that let their plans go stale.

1
Office of the Law Revision Counsel. 26 USC 7216 – Disclosure or Use of Information by Preparers of Returns
2
GovInfo. 26 CFR 301.7216-3 – Disclosure or Use Permitted Only With the Taxpayers Prior Consent
3
eCFR. 26 CFR 301.7216-2 – Permissible Disclosures or Uses Without Consent of the Taxpayer
4
Federal Trade Commission. FTC Safeguards Rule: What Your Business Needs to Know
5
Internal Revenue Service. IRS Publication 5708 – Creating a Written Information Security Plan for Your Tax and Accounting Practice
6
Internal Revenue Service. IRS Publication 4557 – Safeguarding Taxpayer Data
7
Internal Revenue Service. Heres Who Tax Pros Should Contact if Their Business Suffers a Data Theft or Loss
8
Federal Trade Commission. FTC Amends Safeguards Rule to Require Non-Banking Financial Institutions to Report Data Security Breaches
9
Office of the Law Revision Counsel. 26 USC 6713 – Disclosure or Use of Information by Preparers of Returns
10
Federal Register. Adjustments to Civil Penalty Amounts
11
Internal Revenue Service. Internal Revenue Manual 8.7.13 – e-file Cases