EXPLAINER · UPDATED 2026
IRS Publication 4557, "Safeguarding Taxpayer Data," is the IRS's guide telling tax professionals how to protect client information and comply with the FTC Safeguards Rule. In plain terms: every tax pro who handles client data must put administrative, technical, and physical safeguards in place — and document them in a Written Information Security Plan (WISP). It applies to firms of every size, including solo preparers, and a compliant WISP is tied to your ability to e-file. Pub 4557 isn't a new law itself; it's the tax-industry playbook for meeting the legal requirement.
What is IRS Publication 4557?
Pub 4557 is an IRS publication that helps tax professionals safeguard taxpayer data and recognize and respond to data theft. It translates the FTC Safeguards Rule (a federal law) into concrete steps for tax firms, and points you to the WISP as the document that proves compliance:
- FTC Safeguards Rule = the law (you must have a written security program).
- IRS Publication 4557 = the how-to for tax pros.
- Your WISP = the artifact that satisfies both.
Who has to comply?
Every paid tax preparer who handles client returns and data — from national firms to a single-person practice run from a home office. There is no small-firm exemption from the written plan; firms holding data on fewer than 5,000 consumers are excused only from four specific provisions (16 CFR 314.6). If you have a PTIN and prepare returns for compensation, this applies to you.
What Pub 4557 recommends (the safeguards)
Pub 4557 groups protections into three categories, plus a required written plan:
| Category | What it covers |
|---|---|
| Administrative | Designate a responsible individual (Qualified Individual / Data Security Coordinator), conduct and document a risk assessment, train employees, and oversee vendors with data access. |
| Technical | Multi-factor authentication on systems accessing client data, encryption at rest and in transit, anti-malware, firewalls, patching, secure backups, and least-privilege access controls. |
| Physical | Secure storage for paper and devices, controlled access to offices and equipment, and secure disposal of records and media. |
| A written plan (the WISP) | All of the above, documented, adopted, and maintained — with an incident response plan and periodic review. |
The "Security Six" and MFA
Pub 4557 popularized the IRS's "Security Six" baseline protections: anti-virus software, firewalls, multi-factor authentication, backup software/services, drive encryption, and a VPN for remote access. MFA in particular is now an expectation, not an option, for accessing systems that hold taxpayer data.
How Pub 4557 connects to your WISP
Pub 4557 explicitly directs tax pros to create and maintain a WISP, and the IRS provides templates to help: Publication 5708 (a sample WISP you can adapt) and Publication 5709 (step-by-step guidance). A WISP is how you demonstrate you've met Pub 4557's safeguards — one that's written, adopted, staff-trained, and reviewed annually is the evidence auditors, the IRS, and cyber-insurers look for.
Quick compliance checklist
- ☐Designated Data Security Coordinator named
- ☐Written risk assessment completed
- ☐MFA enabled on all systems with client data
- ☐Encryption at rest and in transit
- ☐Incident response plan documented
- ☐Employee security training completed and logged
- ☐Vendor register with security obligations
- ☐Data retention and secure disposal rules
- ☐WISP written, adopted (signed), and scheduled for annual review
Frequently asked questions
Keep reading
Sources & official references
- IRS Publication 4557 — Safeguarding Taxpayer Data: irs.gov/pub/irs-pdf/p4557.pdf
- IRS Publication 5708 — Sample WISP; Publication 5709 — Creating a WISP
- FTC Safeguards Rule (Gramm-Leach-Bliley Act), 16 C.F.R. Part 314
This guide is general information, not legal advice. Consult a qualified professional for your firm's specific obligations.