What Is IRS Form 4557? Understanding Publication 4557
Tax professionals searching for "IRS Form 4557" are typically looking for IRS Publication 4557, titled Safeguarding Taxpayer Data: A Guide for Your Business. Unlike the W-2 or 1099 series, Publication 4557 is not a tax filing form — it is the IRS's official compliance guide outlining what every tax professional must do to protect sensitive client data under federal law.
First published in 2004 and updated regularly, Publication 4557 draws its legal authority from the Gramm-Leach-Bliley Act (GLBA) and the Federal Trade Commission (FTC) Safeguards Rule. The IRS uses this publication to communicate specific security controls, administrative requirements, and incident response obligations that apply to anyone who prepares federal tax returns or handles Federal Tax Information (FTI). The current version is available as a free download from the IRS website.
If your firm has been told to review "IRS Form 4557" by a compliance auditor, a professional association, or an IRS representative, this guide breaks down exactly what Publication 4557 requires — and the concrete steps your practice must take to achieve and maintain compliance in 2026.
Tax Preparer Cybersecurity: By the Numbers
IBM Cost of Data Breach Report 2024
Verizon DBIR 2024
IRS Publication 4557 compliance threshold
Who Is Required to Follow IRS Publication 4557?
Publication 4557 applies to every tax professional who "receives, maintains, retransmits, or discloses Federal Tax Information." In practical terms, that includes:
- Individual tax preparers — CPAs, Enrolled Agents, tax attorneys, and PTIN holders of any kind
- Accounting and bookkeeping firms of any size, including solo practitioners
- Payroll service providers who handle FTI on behalf of clients
- Software companies and cloud platforms that process FTI on behalf of tax professionals
- Third-party vendors who access client tax data in any form, even temporarily
The IRS does not exempt sole proprietors or small firms from these obligations. If you prepare even a single federal return, you are responsible for implementing the safeguards described in Publication 4557. However, the most consequential compliance threshold is 11 or more returns per year: once you cross that line, federal law requires you to maintain a Written Information Security Plan (WISP) — a documented security policy reviewed and updated at least annually.
Third-party service providers represent a particular exposure point. Under the FTC Safeguards Rule — which Publication 4557 incorporates by reference — you must vet and oversee every vendor who touches your clients' data. A breach at a cloud storage provider or practice management software vendor can expose your firm to liability if you failed to perform adequate due diligence on that vendor before granting access to client records.
How to Implement IRS Publication 4557 Requirements
Designate a Security Coordinator
Assign one named individual — typically a senior partner or office manager — as the responsible person for your firm's information security program. Publication 4557 requires a named coordinator who oversees all safeguarding activities and serves as the point of contact for security incidents.
Inventory Your Data Assets
Document every location where Federal Tax Information is stored, processed, or transmitted: workstations, laptops, servers, cloud drives, email systems, USB drives, and paper files. You cannot protect what you have not mapped.
Conduct a Risk Assessment
Identify threats to the confidentiality, integrity, and availability of your client data. Evaluate the likelihood and potential impact of each threat — from phishing attacks to physical theft — and prioritize your controls based on the results.
Implement the IRS Security Six Controls
Deploy anti-virus software, enable multi-factor authentication (MFA) on all accounts, configure a business-grade firewall, encrypt sensitive data at rest and in transit, establish a tested backup routine, and require a VPN for all remote access to client data.
Write and Maintain Your WISP
Document your security program in a Written Information Security Plan. Your WISP must address data handling procedures, employee responsibilities, incident response, vendor management, and physical security. Review and update it at least annually or after any security incident.
Train Your Entire Team
All employees who handle FTI must receive documented security awareness training. The IRS specifically identifies phishing awareness as a required training component. Keep written records of who was trained and when.
Establish an Incident Response Plan
Define in writing the steps your firm will take if a breach occurs — including how you will contain the incident, notify affected clients, report to the IRS and law enforcement, and preserve forensic evidence for investigation.
Review and Test Controls Annually
Conduct at least an annual review of your security controls, update your WISP to reflect any operational or technology changes, and test your incident response procedures. Consider engaging a third-party cybersecurity firm for an independent gap assessment.
The IRS Security Six: Core Requirements of Publication 4557
Publication 4557 identifies six baseline security controls — collectively known as the IRS Security Six — that every tax professional must implement. Developed through the IRS's Security Summit partnership with state tax agencies and the private tax industry, these controls target the most common attack vectors used against tax preparers.
1. Anti-Virus and Anti-Malware Software
Every device that touches client data must run up-to-date anti-virus and anti-malware software. This includes workstations, laptops, and mobile devices used for client communication. Auto-update settings must be enabled — outdated virus definitions leave your systems exposed to the newest malware variants specifically engineered to target tax software and steal FTI.
2. Firewalls
A properly configured firewall is required on all network connections. For most small practices, this means a business-grade router with stateful packet inspection and intrusion detection capabilities. Consumer-grade routers sold at retail stores typically do not meet this standard. If employees work from home, their home networks need appropriate firewall protection on devices used for client work.
3. Multi-Factor Authentication (MFA)
Multi-factor authentication (MFA) must be enabled on all accounts that access Federal Tax Information — including tax software portals, cloud storage, email, and remote desktop connections. The IRS has identified compromised credentials as the leading cause of data theft at tax firms. MFA significantly reduces this risk by requiring a second verification step beyond a password alone. Review our guide on two-factor authentication for tax professionals for step-by-step setup instructions for the most common platforms.
4. Drive Encryption
All drives containing client data must be encrypted. Windows BitLocker and Apple FileVault provide built-in, no-cost encryption for desktop and laptop computers. Portable storage devices — USB drives, external hard disks — must also be encrypted. If a laptop containing unencrypted client data is stolen, you face both a reportable breach and potential regulatory penalties, regardless of whether anyone actually accessed the data.
5. Data Backup
Publication 4557 requires regular, tested data backups stored in a secure, separate location. The operative word is tested: backing up data that cannot be successfully restored provides no real protection. Best practice follows the 3-2-1 rule — three copies of data, stored on two different media types, with one copy kept offsite or in a geographically separate cloud region.
6. Virtual Private Network (VPN)
Any remote access to client data — whether from a home office, hotel, or public Wi-Fi — must use a business-grade Virtual Private Network (VPN). Consumer VPN services marketed for personal privacy typically lack the security controls required for handling FTI. Your firm's VPN should encrypt traffic end-to-end and log connection activity for audit purposes.
Additional Publication 4557 Requirements Beyond the Security Six
Written Information Security Plan
A WISP is legally required for any tax professional preparing 11 or more returns annually. It must address risk assessment, access controls, vendor oversight, incident response procedures, and physical safeguards in a single documented plan.
Employee Training and Awareness
All staff handling Federal Tax Information must receive documented security awareness training, including phishing recognition, password hygiene, and safe data handling procedures — with written records retained.
Vendor Risk Management
Tax professionals must vet and monitor every third-party service provider who accesses client data, maintaining written agreements that obligate vendors to implement appropriate safeguards.
Incident Response Planning
A formal incident response plan must define notification procedures, evidence preservation steps, IRS reporting requirements, and client communication protocols to activate when a breach is suspected or confirmed.
Physical Security Controls
Publication 4557 addresses physical safeguards including locked filing cabinets for paper records, visitor access controls, and clean-desk policies that prevent unauthorized viewing of client data.
Annual Security Review
Your security program and WISP must be reviewed and updated at least once per year, or whenever a material change in business operations, technology infrastructure, or the threat environment occurs.
WISP Requirements Under IRS Publication 4557
The Written Information Security Plan (WISP) is the centerpiece of Publication 4557 compliance for most tax professionals. If you prepare 11 or more federal returns annually, a WISP is not an administrative formality — it is a federal legal requirement under the Gramm-Leach-Bliley Act, enforced through the FTC Safeguards Rule.
At minimum, your WISP must document:
- Scope: Which data, systems, and employees are covered by the security program
- Risk assessment methodology: How you identify and evaluate threats to client data
- Security controls: The specific measures you use to mitigate each identified risk
- Employee responsibilities: Who is accountable for each security function and what training they receive
- Vendor management: How you vet, onboard, and monitor third-party service providers
- Incident response: Step-by-step procedures for responding to a suspected or confirmed breach
- Physical safeguards: Controls for paper records and physical access to data systems
- Annual review process: How and when you will review, test, and update the plan
The IRS does not mandate a specific WISP format, which gives firms flexibility — but that flexibility is also a compliance trap. A WISP that is too vague, or one that fails to address your actual data environment, may not satisfy an IRS examiner or an FTC audit. If you are building your WISP from scratch, our free 2026 WISP template provides a detailed starting framework aligned with Publication 4557 requirements.
One of the most frequently overlooked WISP components is vendor risk management. Tax software companies, payroll processors, cloud storage providers, and IT support vendors who have access to your client data must all be addressed in your plan. Maintain a current vendor inventory documenting what data each vendor accesses, and keep copies of any data processing agreements or security attestations they provide. For a detailed walkthrough of what the IRS expects, see our guide on the IRS Written Information Security Plan.
IRS Publication 4557 vs. FTC Safeguards Rule vs. NIST SP 800-171
| Feature | IRS Pub. 4557 | RecommendedFTC Safeguards Rule | NIST SP 800-171 |
|---|---|---|---|
| Written Security Plan (WISP) | Required (11+ returns) | Required | Required |
| Multi-Factor Authentication | Required | Required | Required |
| Data Encryption (at rest & in transit) | Required | Required | Required |
| Formal Risk Assessment | Required | Required | Required |
| Penetration Testing | Recommended | Required (annual) | Required |
| Incident Response Plan | Required | Required | Required |
| Employee Security Training | Required | Required | Required |
| Vendor Oversight with Written Agreements | Required | Required | Required |
| Audit Logging and Monitoring | Recommended | Required | Required |
| FTC Breach Notification (30-day) | — | Required (500+ customers) | — |
Breach Reporting and Enforcement Under Publication 4557
IRS Publication 4557 dedicates substantial guidance to what tax professionals must do when a data breach occurs. The IRS defines a breach as any unauthorized access to, use of, or disclosure of Federal Tax Information — including incidents originating at third-party vendors who process your clients' data on your behalf.
Immediate Steps After a Suspected Breach
Publication 4557 directs you to take the following actions when a breach is discovered or suspected:
- Contain the breach: Disconnect affected systems from the network without powering them off. Powering down machines can destroy forensic evidence needed for investigation and prosecution.
- Report to the IRS: Contact the IRS Stakeholder Liaison in your area and notify the IRS Identity Protection Specialized Unit at 1-800-908-4490. For clients whose identities have been compromised, assist them in filing IRS Form 14039 (Identity Theft Affidavit).
- Notify affected clients: Most states mandate breach notification within 30 to 72 hours. Publication 4557 recommends proactive client notification regardless of applicable state law thresholds.
- File a police report: Report to local law enforcement. For incidents involving interstate activity, submit a complaint to the FBI's Internet Crime Complaint Center (IC3).
- Report to the FTC: If the breach affects 500 or more customers, you must notify the FTC within 30 days under the Safeguards Rule.
Penalties for Non-Compliance
The IRS can revoke or suspend your Electronic Filing Identification Number (EFIN) or Preparer Tax Identification Number (PTIN), effectively prohibiting you from filing returns electronically or operating as a preparer. The FTC, under its Safeguards Rule authority, can impose civil penalties of up to $51,744 per violation per day — a figure that can become existential for a small firm operating on thin margins. Read our guide on FTC Safeguards Rule compliance for tax preparers for a breakdown of enforcement mechanisms and documented penalty cases.
Beyond regulatory exposure, a breach opens your firm to civil liability from affected clients. IBM's 2024 Cost of Data Breach Report found that the average breach in the financial services sector — the category that encompasses tax preparation — exceeded $6 million when litigation costs were factored in. For a solo practitioner or a firm with fewer than 10 employees, that exposure is financially catastrophic. See our analysis of cyberattacks on tax firms for a breakdown of how attackers target the tax preparation industry and the documented cost when those attacks succeed.
IRS Alert: Tax Firms Are a Primary Target
The IRS reports thousands of tax professional data thefts each year. Attackers specifically target tax preparers during filing season because a single compromised EFIN or client account can yield hundreds of fraudulent refund claims worth millions of dollars. If your firm is not actively monitoring for unauthorized EFIN use or dark web exposure of your credentials and client data, you may not discover a breach until the IRS contacts you — often after fraudulent returns have already been processed.
Building a Security Program That Exceeds Publication 4557 Minimums
IRS Publication 4557 sets the floor for taxpayer data protection — not the ceiling. Tax professionals who treat it as a one-time checklist exercise often discover, after an incident, that minimum compliance was not sufficient to prevent real-world attacks. The publication itself acknowledges that its recommendations represent baseline standards and encourages practitioners to implement additional controls based on their specific risk profile.
Dark Web Monitoring for Credential Exposure
Compromised credentials from prior data breaches frequently appear on dark web marketplaces within hours of being stolen — long before the affected organization knows a breach occurred. Continuous dark web monitoring provides early warning when credentials associated with your firm's domain or your employees' email addresses surface in criminal markets, allowing you to rotate passwords and enforce MFA before attackers exploit those credentials against your tax software accounts or client portals.
Security Awareness Training Beyond Annual Refreshers
Publication 4557 requires employee security training but does not specify frequency or format. Verizon's 2024 Data Breach Investigations Report found that phishing remains the primary entry point for professional services breaches. Running quarterly simulated phishing tests — not just annual training sessions — measurably reduces employee click rates on malicious links over time. Our guide on phishing attacks targeting tax professionals covers the specific lures attackers use against CPAs and preparers in the current filing season, including W-2 fraud schemes and software credential harvesting campaigns.
Aligning with NIST SP 800-171 for a More Mature Program
For firms that want a more rigorous framework than Publication 4557 alone, NIST Special Publication 800-171 Revision 3 provides 110 security controls for protecting controlled unclassified information (CUI). While originally developed for federal contractors, NIST SP 800-171 is increasingly used by accounting firms as a benchmark for a mature security program that goes well beyond IRS Publication 4557's requirements. Aligning your controls with this framework also strengthens your position with cyber insurance underwriters, who increasingly require evidence of formal control frameworks before issuing or renewing coverage. Use our tax season cybersecurity checklist as a structured starting point for your pre-filing-season security review.
Get Your IRS Publication 4557 Compliance Assessment
Bellator Cyber Guard's tax cybersecurity specialists will evaluate your firm's security posture against IRS Publication 4557 requirements, identify gaps before filing season, and deliver a prioritized remediation roadmap — including a full WISP review and Security Six verification.
Frequently Asked Questions About IRS Form 4557
No. Despite the common search term "IRS Form 4557," Publication 4557 is not a tax filing form — it is an IRS guidance document titled Safeguarding Taxpayer Data: A Guide for Your Business. You do not submit Publication 4557 to the IRS. Instead, it outlines the security practices your firm must implement and maintain to comply with federal law. Compliance is demonstrated through your security controls, your Written Information Security Plan (WISP), employee training records, and vendor agreements.
Any tax professional who receives, maintains, transmits, or discloses Federal Tax Information is subject to Publication 4557's requirements. This includes individual preparers, accounting firms of any size, payroll processors, and software vendors that handle FTI. The core safeguarding requirements apply regardless of return volume. The Written Information Security Plan (WISP) requirement becomes legally mandatory once you prepare 11 or more federal returns per year.
The IRS Security Six are the six baseline cybersecurity controls identified in Publication 4557 as required for all tax professionals: (1) anti-virus and anti-malware software with automatic updates enabled, (2) a properly configured business-grade firewall, (3) multi-factor authentication (MFA) on all accounts accessing client data, (4) drive encryption on all devices containing Federal Tax Information, (5) regular, tested data backups stored in a secure separate location, and (6) a business-grade VPN for any remote access to client data.
Non-compliance carries multiple serious risks. The IRS may suspend or revoke your EFIN or PTIN, preventing you from filing returns electronically or operating as a preparer. The FTC can impose civil penalties of up to $51,744 per violation per day under the Safeguards Rule — which applies to tax preparers as financial institutions under the Gramm-Leach-Bliley Act. Clients whose data is compromised due to inadequate safeguards may also pursue civil litigation against your firm for damages stemming from identity theft or fraudulent returns.
IRS Publication 4557 and the FTC Safeguards Rule both require that your Written Information Security Plan be reviewed and updated at least annually. You should also update your WISP whenever a material change occurs — such as adopting new technology, adding remote employees, onboarding a new vendor with access to client data, or experiencing a security incident. Many firms align their WISP review with pre-filing-season preparation each fall to ensure the plan reflects their current operating environment before the high-risk period begins.
Yes. If you use cloud-based tax preparation software, practice management platforms, or any cloud storage that holds Federal Tax Information, those systems fall within Publication 4557's scope. You remain responsible for the security of that data even when it is stored or processed by a third-party vendor. Publication 4557 requires you to vet vendors before granting access, maintain written agreements that address data protection obligations, and monitor vendor security practices on an ongoing basis.
IRS Publication 4557 is an IRS guidance document that interprets how the Gramm-Leach-Bliley Act (GLBA) applies to tax professionals. The FTC Safeguards Rule (16 CFR Part 314) is the actual federal regulation that gives these requirements the force of law. Publication 4557 generally aligns with Safeguards Rule requirements but provides tax-specific guidance. The Safeguards Rule imposes additional obligations — including mandatory annual penetration testing for larger institutions and a 30-day FTC breach notification requirement for incidents affecting 500 or more customers — that go beyond what Publication 4557 explicitly states.
Act immediately without powering down affected systems — doing so destroys forensic evidence. Disconnect them from the network to contain the breach, then: (1) Contact the IRS Stakeholder Liaison for your area and the IRS Identity Protection Specialized Unit at 1-800-908-4490. (2) Report to local law enforcement and the FBI's Internet Crime Complaint Center (IC3). (3) Notify affected clients as required by applicable state breach notification laws. (4) Document every step taken with timestamps. (5) Engage a cybersecurity incident response firm if you lack internal forensic capabilities. Do not clean or reimage affected systems before preserving forensic images.
IRS Publication 4557 is available as a free PDF download directly from the IRS website. Always verify you are using the most current version by downloading it from irs.gov. Bellator Cyber Guard also provides a detailed IRS Publication 4557 implementation guide and a free WISP template for 2026 aligned with current publication requirements to help your firm translate those requirements into an operational security program.
Free Consultation
Need help with IRS compliance?
Our tax cybersecurity specialists can review your security posture and help you get compliant.