IRS Publication 5293: Your Data Security Resource Guide

IRS Publication 5293, Data Security Resource Guide for Tax Professionals, is a free directory published by the Internal Revenue Service (IRS) that gathers data security guidance from several federal agencies into one reference document for tax preparers. It does not create a new standalone security standard. Instead, it links you to the specific requirements and tools that already apply to your practice: the Security Six safeguards from Publication 4557, the sample Written Information Security Plan (WISP) in Publication 5708, Federal Trade Commission (FTC) Safeguards Rule obligations, and steps for reporting a suspected data breach.

If you're a paid tax preparer, an accounting firm owner, or an office manager responsible for client data, Pub 5293 is worth downloading, but only as a starting index. This guide covers what's actually inside it, how the pieces connect to the compliance obligations that carry real consequences, and what to do with the checklist once you've read it in 2026.

What's Inside IRS Publication 5293

Publication 5293 is organized as a resource index rather than a single checklist. Reading through it, the material falls into roughly four categories:

• Baseline security guidance: links to Publication 4557 and the IRS Security Six checklist, covering antivirus software, firewalls, multi-factor authentication, backup software, drive encryption, and a virtual private network (VPN).
• Planning tools: a pointer to Publication 5708, the IRS's sample Written Information Security Plan template, and small-business guidance from the National Institute of Standards and Technology (NIST) Cybersecurity Framework.
• Threat awareness: links to IRS Identity Theft Central and warnings about phishing attacks on tax professionals, since compromised preparer credentials remain a common way client data is stolen.
• Incident response contacts: who to call if you suspect a breach, including your local IRS Stakeholder Liaison, your state tax agency, and federal law enforcement.

None of these sections are exclusive to Pub 5293. Every document it links to already exists on its own; the guide's value is saving you the time of hunting for each one separately across IRS.gov, FTC.gov, and NIST.gov.

Why the Resource List Points Back to the FTC Safeguards Rule

Most of Publication 5293's links exist because of one requirement: the FTC Safeguards Rule, issued under the Gramm-Leach-Bliley Act (GLBA), a federal law that regulates how financial institutions handle customer information. Tax preparation businesses have been treated as covered financial institutions under the amended rule since its compliance deadline of June 9, 2023, according to the FTC. The rule requires a written information security program, a designated qualified individual to run it, and specific technical controls; our guide to the FTC Safeguards Rule qualified individual requirement covers who can hold that role at a small practice.

That's also why Pub 5293 links to the Publication 5708 WISP template instead of including a finished plan. A WISP is practice-specific: the IRS can point you to a starting template, but it can't fill in your vendor list, your access controls, or your incident response contacts for you. Our breakdowns of the IRS WISP template and the WISP template for sole proprietors walk through what each section needs to say. Multi-factor authentication (MFA) on your IRS accounts is one of the specific controls examiners look for first; see our walkthrough of IRS Tax Pro Account MFA setup if you haven't enabled it yet.

A Resource List Isn't a Finished Security Program

Publication 5293 tells you which documents to read. It doesn't encrypt your files, patch your software, or write your WISP for you. Most practices that download the guide still need to convert its checklist items into a dated, practice-specific plan and working technical controls, and skipping that step carries real consequences; see our overview of non-compliance consequences for tax preparers who stop at the reading stage.

Bellator Cyber Guard builds a custom Written Information Security Plan starting at $749 for practices with up to five users, with larger firms quoted separately (see WISP pricing and details). A properly built WISP commonly replaces 20 to 40 hours of billable staff time otherwise spent researching templates and cross-referencing IRS and FTC requirements. If you also need the underlying technical controls the Security Six describes, monitored antivirus, patching, and backup, compare managed options on the protection plans page. Solid tax data management habits, like limiting who can access client files and logging when records are opened, close gaps that Pub 5293 assumes your practice has already handled.