IRS Publication 4557: What It Actually Requires of a Tax Preparer

IRS Publication 4557, Safeguarding Taxpayer Data (Rev. 6-2024), is the IRS's guide to protecting client data.¹ Most of it is advice. One part is law: the FTC Safeguards Rule, which names tax preparers as financial institutions and requires a written information security plan.² That is the plan Form W-12 asks you about every year.³

Key takeaways

• Pub 4557 itself is guidance. The legal requirement behind it is the FTC Safeguards Rule, 16 CFR Part 314.
• Form W-12 line 11 asks you to confirm you're aware of the requirement — it is not a statement that your plan already exists.
• Page 13 of Pub 4557 lists seven FTC requirements. Each maps to a numbered paragraph of the rule that says more than the summary.
• Firms holding data on fewer than 5,000 consumers are exempt from four specific parts of the rule — not from having a plan.

This is what the IRS and FTC publish, not legal advice. Check the current source before you rely on it, and talk to counsel about your own practice. If your intake is still email attachments, start a 14-day DokuTrak trial and see what a single request per client looks like.

What is IRS Publication 4557?

Publication 4557 is a 20-page IRS guide, current revision 6-2024, titled Safeguarding Taxpayer Data: A Guide for Your Business. It explains basic security steps, how to spot and report data theft, and how to comply with the FTC Safeguards Rule.¹ The IRS points to it from Form W-12 and from its Security Summit materials.

Read the full publication on irs.gov.¹

Is Publication 4557 mandatory?

The publication itself is guidance. The obligation behind it is not: the FTC Safeguards Rule (16 CFR Part 314) names tax preparation firms as financial institutions and requires them to keep a written information security program.² Pub 4557 says failing to create a plan "may result in an FTC investigation."¹

The rule's own definition names the exact business you run. Its list of examples states that "[a]n accountant or other tax preparation service that is in the business of completing income tax returns is a financial institution because tax preparation services is a financial activity listed in 12 CFR 225.28(b)(6)(vi)."² Size doesn't change that. Pub 4557 adds one more layer for anyone who files electronically: as an Authorized IRS e-file Provider, you're also bound by the six security and privacy standards in Publication 1345.¹ (Pub 4557 names this obligation; what Pub 1345 says is a separate document.)

What Form W-12 asks you, and what ticking "Yes" means

Line 11 of Form W-12 (Rev. October 2025), "Data Security Responsibilities," asks you to confirm you are aware that paid preparers must create and maintain a written information security plan. You must check a box, Yes or No. The form points to Publications 5708 and 4557.³

The line reads, verbatim: "I am aware that paid tax return preparers are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information."³

That's an attestation of awareness, not a statement that a plan already exists or meets every requirement. Form W-12's penalties-of-perjury certification covers the application as a whole — your name, your SSN, your tax compliance — not line 11 specifically.³ The online PTIN renewal system asks the same question during the annual renewal window, and the 2026 PTIN fee is $18.75.³

The FTC requirements in Pub 4557, mapped to the rule

Page 13 of Publication 4557 lists what the FTC requires in a security plan: a qualified individual, multi-factor authentication, a risk assessment, safeguards you test, vetted service providers, a plan you keep adjusting, and staff training.¹ Each comes from a paragraph of 16 CFR 314.4, which says more than the summary.⁴

Pub 4557 states the plan "must be appropriate to the company's size and complexity, the nature and scope of its activities and the sensitivity of the customer information it handles"¹ — and then lists the controls anyway. Size changes what's exempt, not whether a plan exists.

What small practices can skip (and what they can't)

Under 16 CFR 314.6, a firm holding customer information on fewer than 5,000 consumers is exempt from four parts of the rule: the written risk-assessment detail, continuous monitoring or penetration testing, the written incident response plan, and the annual written report.⁵ Everything else, including MFA and encryption, still applies.

Don't assume you're under 5,000 without counting. The threshold is every consumer whose customer information you still hold — which includes past clients whose files you haven't disposed of yet, not only the clients you prepared returns for this season.⁴ Count before you assume the exemption applies to you.

When something goes wrong: IRS, states, and the FTC's 30-day notice

Publication 4557 tells you to report client data theft to your IRS Stakeholder Liaison and to the states you file in.¹ It does not mention a newer federal duty: since May 13, 2024, the FTC rule has required notice to the FTC within 30 days of discovering that unencrypted data on at least 500 consumers was acquired without authorization.⁵

Pub 4557's own list, for a theft or loss: contact the IRS Stakeholder Liaison, the FBI if the IRS directs you to, and local police; contact the states where you prepare returns through the Federation of Tax Administrators' "Report a Data Breach"; and contact a security expert and your insurer.¹ A ransomware attack adds the FBI and CISA. Separately, IRS telephone assistors cannot accept third-party reports of identity theft, and after fixing the intrusion, you'll need a new EFIN before resuming e-file.¹

A "notification event" under the FTC rule means unencrypted customer information acquired without authorization.⁵ That's why the encryption requirement in the mapping table above matters: encrypt the file correctly, and a theft of it isn't necessarily a notification event.

Pub 4557 keeps state law separate from the federal picture, telling preparers to "check to see if breach notification is required under applicable state law."¹ Treat that as its own check, not something the FTC's 30-day rule covers for you.

The section most security plans skip: how client documents reach you

Pub 4557 is direct about intake. If you collect information online, "make secure transmission automatic," and caution clients against sending sensitive data by email.¹ If you must email it, encrypt it, or use SFTP instead: "Send only password-protected and encrypted documents if you must share files with clients via email or use Secure File Transfer Protocol (SFTP) to transmit files instead of email."¹ A security plan should name the channel your clients' W-2s, 1099s, and IDs actually arrive through.

So ask the practical question: in January, where do the files actually come from? Email attachments, a text of a photo, a shared Drive folder, the portal built into your tax software that half your clients never log into. Each one is a line your plan has to describe and secure. I go deeper on why the first of those is the wrong default in why email fails for document collection, and on the seasonal side of tax intake in how tax preparers collect client tax documents.

I built DokuTrak to replace those four channels with one request per client. The client uploads through a single secure link, no account to create, over TLS, into storage encrypted at rest (AES-256, per our security page), with an append-only log of who did what. DokuTrak follows up on its own schedule when a client goes quiet, and an AI first pass flags a wrong, unreadable, or expired file before you open it — you accept every file, or ask the client to re-upload it.

That gives your plan one intake channel to describe instead of four. It does not write the plan for you, and like any upload tool, it is itself a service provider you have to assess under 314.4(f).⁴

Pub 4557, Pub 5708, Pub 5293 and the Security Six: which is which

Pub 4557 explains the obligations. Pub 5708 is the IRS's sample written information security plan. Pub 5293 is a short data security resource guide. The Security Six is a list of six technical measures on the IRS "Taxes-Security-Together" checklist page. Start with 4557, write the plan from 5708.

"Security Six" isn't a phrase in Publication 4557 itself — it's the title of the IRS's separate checklist page.⁸ If you're ready to write the plan rather than read about the requirement, Pub 5708 is a free, downloadable starting point with sample policies for employee training, data disposal, and breach notification.⁶

Pub 4557 in 20 minutes: a self-check you can copy

Before reading the whole publication, work through this plain-text self-check. Each line traces back to a page of Pub 4557 or a paragraph of the rule.

☐ A named person is responsible for the security program — 314.4(a)
☐ MFA required on tax software, email, and cloud storage — 314.4(c)(5)
☐ Client files encrypted in transit and at rest, including how clients send them — 314.4(c)(3); Pub 4557 p. 16
☐ Online uploads default to secure transmission, not plain email — Pub 4557 p. 16
☐ Files shared by email are password-protected and encrypted, or sent over SFTP — Pub 4557 p. 10
☐ "Returns filed per PTIN" checked weekly during season — Pub 4557 p. 8
☐ A written risk assessment on file, unless under 5,000 consumers — 314.4(b)(1)
☐ Old client data disposed of within two years of last use — 314.4(c)(6)
☐ A written incident response plan on file, unless under 5,000 consumers — 314.4(h)
☐ Service providers, including your intake tool, assessed under contract — 314.4(f)
☐ Staff trained on phishing and data handling — 314.4(e)
☐ IRS Stakeholder Liaison contact saved for reporting — Pub 4557 p. 11
☐ FTC notification plan ready for a breach touching 500+ consumers — 314.4(j)
☐ Plan reviewed and dated within the last 12 months — 314.4(g)

Ticking every line does not make a practice compliant; it tells you where your written plan has gaps.

---

Start your 14-day trial and give your clients one request instead of four channels to secure. Plans are on the pricing page, and DokuTrak for accountants shows the tax-season setup.

Sources

Footnotes

1. Internal Revenue Service, Publication 4557, Safeguarding Taxpayer Data: A Guide for Your Business (Rev. 6-2024), Catalog Number 48905Y. Retrieved 2026-10-01. https://www.irs.gov/pub/irs-pdf/p4557.pdf ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹ ↩¹² ↩¹³

2. 16 CFR § 314.2(h)(2)(viii), eCFR, current as of 2026-10-01. https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314 ↩ ↩² ↩³

3. Internal Revenue Service, Form W-12, IRS Paid Preparer Tax Identification Number (PTIN) Application and Renewal (Rev. October 2025), Catalog Number 55469F. Retrieved 2026-10-01. https://www.irs.gov/pub/irs-pdf/fw12.pdf ↩ ↩² ↩³ ↩⁴ ↩⁵

4. 16 CFR § 314.4, eCFR, current as of 2026-10-01. https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314 ↩ ↩² ↩³

5. 16 CFR §§ 314.4(j), 314.5, 314.6, eCFR, current as of 2026-10-01. https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314 ↩ ↩² ↩³

6. Internal Revenue Service, Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice (Rev. 8-2024), Catalog Number 93462W. Retrieved 2026-10-01. https://www.irs.gov/pub/irs-pdf/p5708.pdf ↩ ↩²

7. Internal Revenue Service, Publication 5293, Data Security Resource Guide for Tax Professionals (5-2018), Catalog Number 71256E. Retrieved 2026-10-01. https://www.irs.gov/pub/irs-pdf/p5293.pdf ↩

8. Internal Revenue Service, "Tax Security 2.0: The Taxes-Security-Together Checklist." Page last reviewed 8-Oct-2025. Retrieved 2026-10-01. https://www.irs.gov/tax-professionals/tax-security-2-point-0-the-taxes-security-together-checklist ↩ ↩²