The Quick Answer
IRS Publication 4557 gives tax professionals practical guidance for protecting taxpayer information, recognizing signs of data theft, responding to an incident, recovering from data loss, and understanding responsibilities connected to the FTC Safeguards Rule.
But the document should not be treated as another checklist that gets completed and forgotten.
For an accounting or tax firm, the better question is:
“Can we prove that the safeguards we depend on are actually working?”
Publication 4557 addresses areas such as multifactor authentication, employee education, backups, access control, phishing, secure transmission of taxpayer information, monitoring EFIN/PTIN activity, incident reporting, recovery planning, and written information-security planning.
Those safeguards matter.
But MTS believes leadership needs to go one step further.
For every important safeguard, ask:
- What are we expected to do?
- What have we actually implemented?
- What evidence proves it is working?
- What happens to the business if it fails?
- What Cyber Liability remains?
That is how guidance becomes an operating system instead of a binder.
That is how guidance becomes an operating system instead of a binder.
Create Clarity Before Action.
What Is IRS Publication 4557?
IRS Publication 4557 is titled:
Safeguarding Taxpayer Data: A Guide for Your Business.
It is written specifically to help tax professionals protect taxpayer information and understand their responsibilities around data security.
The IRS explains that the guide is intended to help tax professionals:
- Understand basic security steps and how to take them
- Recognize signs of data theft
- Report a data theft
- Respond and recover from data loss
- Understand responsibilities connected to the FTC Safeguards Rule
The publication also states plainly that protecting taxpayer data is both a legal responsibility and good business practice.
That last point matters.
Cybersecurity is not simply about satisfying an external requirement.
It is about protecting:
- Clients
- Employees
- Operations
- Revenue
- Reputation
- Business continuity
- Leadership confidence
That is where IRS guidance and Cyber Liability meet.
The MTS Perspective: Publication 4557 Should Start a Conversation, Not End One
A tax firm can read Publication 4557.
It can create policies.
It can implement several controls.
It can have an IT provider.
It can even have a Written Information Security Plan.
And leadership may still not know:
- Whether every important system is covered
- Whether controls are configured correctly
- Whether former employees still have access
- Whether backups can actually restore operations
- Whether seasonal staff understand their responsibilities
- Whether leadership knows what to do during an incident
- Whether the written plan matches the way the firm actually operates
That gap between what leadership believes exists and what evidence confirms exists is where Cyber Liability can hide.
Publication 4557 gives useful direction.
MTS helps leadership ask what happens next.
Five Lessons Tax Professionals Should Take Beyond the Checklist
Lesson #1: Protecting Taxpayer Data Is an Ongoing Business Responsibility
Security is not something a firm finishes once.
Tax firms change constantly.
Employees join.
Employees leave.
Seasonal staff return.
New applications are introduced.
Clients begin sharing information differently.
Remote work expands.
Cloud platforms change.
AI tools appear in workflows.
Vendors gain access.
Devices are replaced.
Each change can alter the firm’s Cyber Liability.
That means security cannot be reduced to:
“We completed the checklist last year.”
The better question is:
“Does our current security program still match the firm we operate today?”
That is a leadership question.
Lesson #2: Everyone Has a Role in Protecting Taxpayer Information
Publication 4557 specifically emphasizes employee education and security awareness.
That makes sense.
Technology controls are important.
People still make decisions every day.
An employee decides whether to open an attachment.
Someone decides where a client document gets stored.
A seasonal preparer chooses whether to reuse a password.
Someone sends information by email.
Someone grants access to a cloud application.
Someone receives a suspicious request.
People are part of the security system.
The solution is not to frighten employees.
It is to teach them.
That aligns directly with the MTS principle:
Teach Before We Act.
Employees should understand:
- What information is sensitive
- Why the rules exist
- How to handle information safely
- What suspicious activity looks like
- Who to contact when something feels wrong
- What not to improvise during an incident
The objective is not to make employees cybersecurity professionals.
It is to help them make better decisions.
Seasonal Staff Creates a Special Tax-Firm Challenge
Tax firms are different from many businesses because staffing may change dramatically during filing season.
A 17-person firm might temporarily add several seasonal employees or contractors.
That creates practical questions:
- What systems should seasonal staff access?
- How is access approved?
- Is MFA required?
- What client information can they see?
- Are devices managed?
- What security education occurs before access is granted?
- When does access expire?
- Who verifies that access is removed?
The last question is especially important.
The fact that an account should have been disabled is not evidence that it was disabled.
This is why evidence matters.
Lesson #3: MFA Is Important, but “We Have MFA” Is Not Enough
Publication 4557 recommends multifactor authentication and discusses its use for access to customer information.
That is important.
But leadership should avoid reducing the conversation to:
“Do we have MFA?”
A better set of questions is:
Where is MFA enabled?
- Tax software?
- Microsoft 365?
- Email?
- Cloud storage?
- Remote access?
- Administrative accounts?
- Vendor portals?
Where is it not enabled?
Are there important exceptions?
Who verifies the configuration?
Is someone checking?
What happens when a user replaces a phone or loses an authentication device?
Does the recovery process create a weaker path into the account?
Are privileged accounts treated differently?
They may carry significantly more risk.
The control is important.
The evidence around the control is equally important.
Lesson #4: Backup Is Not the Same Thing as Recovery
Publication 4557 repeatedly addresses protecting and backing up taxpayer data and recommends developing continuity planning when responding to data loss.
This supports an important MTS distinction:
Backup is a technology function. Recovery is a business outcome.
Leadership may hear:
“The backups are successful.”
Good.
Now ask:
“If our tax software environment or critical client information became unavailable during filing season, what could we restore, and how long would it take?”
Those are different questions.
A useful recovery conversation should address:
- What data is protected
- What systems are protected
- How frequently backups occur
- Where backup copies exist
- Whether backup systems are isolated appropriately
- Who monitors failures
- What recovery process would be used
- How long recovery might take
- When recovery was last tested
A green backup dashboard can create confidence.
A successful recovery test creates evidence.
An Illustrative Busy-Season Scenario
Consider a 25-person tax firm during a major filing period.
The firm experiences an incident that makes a key system unavailable for four hours.
If 20 employees depend on that system, the direct productivity impact could be:
20 employees × 4 hours = 80 employee-hours
That does not include:
- Partner time
- Client communication
- Rescheduling
- Staff overtime
- Missed deadlines
- Investigation
- Recovery work
- Reputation concerns
The purpose of the example is not to manufacture fear.
It shows why availability and recovery are business issues, not simply technical ones.
Lesson #5: Detection Matters Before the Crisis Becomes Obvious
Publication 4557 does more than discuss prevention.
It also helps tax professionals recognize signs of data theft.
That is a major point.
A firm may experience suspicious activity before leadership knows there is a larger incident.
Publication 4557 identifies warning signs that can include unusual return activity, unexpected client IRS notices, suspicious email behavior, unexplained computer activity, and irregular EFIN/PTIN usage.
The IRS also recommends monitoring EFIN and PTIN activity; Publication 4557 says weekly checks can help identify misuse.
That is an excellent example of security becoming an operational process.
The question is not:
“Do we know our EFIN?”
It is:
“Who reviews the activity, how often, what constitutes an exception, and what happens when something looks wrong?”
That transforms guidance into ownership.
The MTS Guidance-to-Decision Framework
Instead of turning Publication 4557 into a static checklist, use a five-step framework.
Step 1: Understand the Guidance
What issue is the guidance trying to address?
Do not begin with the product.
Understand the purpose.
Step 2: Implement the Safeguard
Put the appropriate people, process, or technology in place.
Examples might include:
- MFA
- Access controls
- Backup
- Employee education
- Secure document exchange
- Monitoring
- Device protection
Step 3: Produce Evidence
Ask:
“How do we know?”
Evidence might include:
- Configuration reports
- Access reports
- Training records
- Backup reports
- Recovery-test results
- EFIN/PTIN review records
- Ticket records
- Security assessments
- Documentation
Step 4: Translate It Into Business Impact
What could happen if the safeguard fails?
Look through the four MTS Cyber Liability areas.
Operational
Can the firm keep operating?
Legal
Could additional responsibilities arise?
Reputational
Could client trust be affected?
Regulatory
Could the firm fail to meet an expected responsibility?
Step 5: Make and Document the Decision
Leadership chooses what happens next.
- Accept
- Defer
- Decline
- Investigate
Then document:
- The decision
- The owner
- The next action
- The review date
That turns guidance into governance.
IRS Publication 4557: From Guidance to Business Protection
A checklist tells you what to look at. Evidence tells leadership what is actually happening.
Why EFIN and PTIN Monitoring Is a Good Example of “Evidence Before Assumption”
Publication 4557 recommends reviewing EFIN activity and describes weekly monitoring as a way to help identify misuse.
This is valuable because it demonstrates a larger principle.
Without monitoring, leadership may assume:
“No one is misusing our credentials.”
With monitoring, leadership can say:
“We checked the evidence.”
The same principle applies throughout cybersecurity.
Instead of:
- Instead of: “Nobody else has access.”
Use: access reports. - Instead of: “Backups work.”
Use: test recovery. - Instead of: “Everyone completed training.”
Use: maintain training records. - Instead of: “MFA is everywhere.”
Use: verify configurations. - Instead of: “We removed the former employee.”
Use: verify the accounts.
Evidence before assumption.
A WISP Should Connect the Firm’s Responsibilities to Reality
Publication 4557 points tax professionals toward maintaining a security plan, while IRS resources also include Publication 5708 for creating a Written Information Security Plan.
A WISP can be useful.
But a WISP becomes weak when it functions only as a document.
The stronger question is:
“Does the WISP describe how our firm actually protects information?”
Consider:
The WISP says access is limited.
Can the firm show access lists?
The WISP says employees receive security education.
Can the firm show training records?
The WISP says backups exist.
Can the firm show recovery evidence?
The WISP says incidents are reported.
Does everyone know who to contact?
The WISP describes approved technology.
Does it account for all the cloud applications employees actually use?
This is the same lesson from Chapter 7:
A policy is not proof.
What Happens When the Written Plan and Reality Differ?
Suppose the WISP says client files are exchanged only through an approved secure portal.
But employees occasionally send sensitive information through regular email because the portal is inconvenient.
What is the security program?
The written document?
Or the actual employee behavior?
From a Cyber Liability perspective, reality matters.
The appropriate response is not automatically to blame employees.
Ask:
- Why are they bypassing the process?
- Is the approved process too difficult?
- Was training unclear?
- Are clients resisting the portal?
- Is the technology unreliable?
- Is management modeling the same behavior?
That turns a policy violation into a useful business investigation.
Teach Before We Act.
Employee Training Should Produce Behavior, Not Certificates
Many organizations treat security education as an annual event.
Employee watches training.
Employee passes quiz.
Certificate is generated.
Done.
A certificate is useful evidence that training occurred.
But leadership ultimately needs another outcome:
Do employees know what to do?
That means education should reinforce real scenarios.
For tax firms, that might include:
- Suspicious prospective-client attachments
- Fake IRS messages
- Requests appearing to come from partners
- Password reset scams
- Cloud-storage invitations
- MFA fatigue attacks
- Urgent banking changes
- Client requests to bypass secure processes
- Lost devices
- Accidental disclosure
Security awareness becomes stronger when employees understand how it connects to their daily work.
From IRS Guidance to Leadership Evidence
Guidance creates direction. Evidence creates confidence.
Protecting Taxpayer Information Includes the Entire Information Lifecycle
One of the most useful ideas embedded throughout Publication 4557 is that information protection extends beyond the moment a tax return is prepared.
Leadership should understand taxpayer information across its entire lifecycle.
Collection
How does information arrive?
Portal?
Email?
Paper?
Upload?
Third-party application?
Storage
Where does it live?
Workstations?
Servers?
Cloud applications?
Mobile devices?
Backups?
Paper files?
Use
Who needs access?
For what purpose?
For how long?
Transmission
How does the information move between:
- Client and firm
- Employee and employee
- Firm and third party
- Office and remote worker
Retention
How long is the information maintained?
Who makes the decision?
Disposal
What happens when:
- A device is retired
- A printer is replaced
- A storage drive is discarded
- Paper files are destroyed
- A cloud application is no longer used
Thinking about the lifecycle helps leadership see where information can become exposed.
See the Whole Risk
This is where Publication 4557 connects directly to the MTS operating system.
An IRS recommendation may appear technical.
MTS asks what it means to the business.
Consider secure access.
Operational Risk
Can people access the tools they need without unnecessary disruption?
Legal Risk
Could inappropriate access create responsibilities requiring qualified professional guidance?
Reputational Risk
Could exposure damage client confidence?
Regulatory Risk
Could weak controls fail to meet expected responsibilities?
One safeguard.
Four business perspectives.
That is See the Whole Risk.
Publication 4557 Is Also About Response and Recovery
A cybersecurity program that focuses only on prevention is incomplete.
Publication 4557 includes guidance around:
- Reporting data loss
- Responding to a data theft
- Determining how an intrusion occurred
- Correcting problems before resuming operations
- Maintaining backups
- Developing continuity planning
This is important because no responsible advisor should promise that an incident will never happen.
The stronger question is:
“If something happens, how prepared are we to respond?”
Preparation reduces confusion.
It creates roles.
It identifies outside resources.
It improves communication.
It helps leadership make decisions with facts instead of panic.
That reflects the MTS principle:
Guide Through the Storm.
Three Questions Your Firm Should Be Able to Answer Before Tax Season
1. What would stop us from preparing and filing returns?
Identify the technology and operational dependencies.
2. Who owns the first decisions if we suspect a security incident?
Do not wait until the event to determine ownership.
3. What evidence proves our most important safeguards work?
Pick your highest-risk controls and verify them.
Those three questions will tell leadership more about readiness than a stack of completed checklists.
A Practical Three-Finding Review
Tax firm leaders do not need 60 security findings at once.
Use the MTS Three-Finding Rule.
Start with the three issues that matter most.
For each one, document:
Finding
What evidence did we observe?
Business Meaning
Why does leadership care?
Cyber Liability
Operational?
Legal?
Reputational?
Regulatory?
Recommendation
What should happen next?
Leadership Decision
Accept?
Defer?
Decline?
Investigate?
Owner and Review Date
Who owns the next step and when do we revisit it?
That makes security manageable.
What Publication 4557 Does Not Replace
Publication 4557 is guidance.
It does not replace:
- Qualified legal advice
- An organization-specific risk assessment
- Appropriate cybersecurity expertise
- Actual implementation
- Independent verification
- Business continuity planning
- Executive decision-making
- Ongoing risk management
That distinction matters.
Reading a guide does not automatically create protection.
The guide helps leadership understand what deserves attention.
The organization still has to act.
Frequently Asked Questions
What is IRS Publication 4557?
IRS Publication 4557 is Safeguarding Taxpayer Data: A Guide for Your Business. It provides data-security guidance for tax professionals, including basic security practices, recognizing signs of data theft, reporting incidents, recovering from data loss, and understanding responsibilities related to protecting taxpayer information.
Is Publication 4557 only for large tax firms?
No.
The IRS states that data security is necessary for tax professionals ranging from large firms to sole practitioners and Authorized IRS e-File Providers.
The practical implementation may differ based on the organization’s size and environment.
Does Publication 4557 require a WISP?
Publication 4557 explains that professional tax preparers are subject to the FTC Safeguards Rule and directs firms to IRS Publication 5708 for information on creating a Written Information Security Plan.
Questions about specific legal applicability should be reviewed with qualified legal or regulatory professionals.
Does Publication 4557 recommend multifactor authentication?
Yes.
The publication identifies multifactor authentication as an important protection for accounts and customer information.
MTS recommends leadership go beyond simply confirming that MFA exists and verify where it is implemented and where important exceptions remain.
Does Publication 4557 discuss employee security training?
Yes.
Employee education and security awareness are recurring themes in the publication.
MTS views training as part of the security system, not merely a documentation requirement.
Does Publication 4557 discuss backups?
Yes.
The publication addresses protecting stored taxpayer information, maintaining backups, and recovery after data loss.
MTS distinguishes between having backups and knowing whether the business can recover.
Why should tax firms monitor EFIN and PTIN activity?
Publication 4557 explains that monitoring return activity associated with EFINs and eligible PTIN accounts can help identify misuse.
The larger principle is that monitoring replaces assumption with evidence.
Is following Publication 4557 enough to eliminate Cyber Liability?
No.
No publication or security framework eliminates all business risk.
The goal is to understand responsibilities, implement appropriate safeguards, verify them, prepare for incidents, and make informed decisions about remaining exposure.
The MTS Perspective
Tax professionals do not need another document to make cybersecurity feel harder.
They need clarity.
Publication 4557 contains useful guidance.
The real value comes when the firm turns that guidance into:
Ownership.
Implementation.
Evidence.
Business understanding.
Leadership decisions.
MTS does not want leadership asking only:
“Did we complete the checklist?”
We want leadership asking:
“Can we show what we have, explain why it matters, and prove the safeguards we depend on are working?”
That is a much stronger position.
Create Clarity Before Action.
Teach Before We Act.
Guide Through the Storm.
See the Whole Risk.
Because protecting taxpayer information is not a paperwork exercise.
It is part of protecting the business.
Your Next Step
Choose three safeguards from your current security program.
For each one, ask:
Who owns it?
Where is it implemented?
What evidence proves it works?
What happens if it fails?
When will we review it again?
Do not start by buying anything.
Start by determining what is actually true.
If your leadership team wants help connecting those answers to the firm’s larger risk picture, MTS’s 26-minute Cyber Liability Assessment is designed to begin that conversation.
The objective is not another technical checklist.
It is to help leadership understand:
- Where the firm may be exposed
- What matters most
- What can wait
- What needs further investigation
- What decision should happen next
Clarity first. Action second.
Continue Through the Cyber Liability Knowledge Center
Previous Chapter:
Why Is Meeting the FTC Safeguards Rule Only the Starting Point for an Accounting Firm?
Start Here:
What Is Cyber Liability, and How Is It Different from Cybersecurity?
Next Chapter:
How Does a Cyber Liability Assessment Help Business Leaders Make Better Decisions?
Related chapters:
- What Are the Four Business Risks Every Accounting Firm Should Understand Before Investing in Cybersecurity?
- Why Doesn’t Traditional IT Support Fully Address Cyber Liability?
- What Should Managed IT Actually Do to Reduce an Accounting Firm’s Business Risk?
- What Should the First 90 Days of Reducing Cyber Liability Look Like?
Explore MTS services:
