Tax & Technology Conference - Virtual-Securing Confidentiality Safeguarding Client Data Under IRS Rules

Securing Confidentiality Safeguarding Client Data Under IRS Rules - Course Presentation

Pdf Summary

The presentation explains how tax and accounting professionals can protect confidential taxpayer information and meet IRS and FTC Safeguards Rule expectations. Its central recommendation is to create and maintain a Written Information Security Plan (WISP), guided by IRS Publication 4557 and Publication 5708.<br /><br />A WISP should assign responsibility to a Data Security Coordinator, assess risks, inventory sensitive data, devices, accounts, and authorized users, and document safeguards, retention practices, employee responsibilities, and incident-response procedures. Firms should review the plan at least annually and whenever significant business or regulatory changes occur.<br /><br />Recommended technical safeguards include current software, centrally managed antivirus and anti-malware, firewalls, encryption for stored and transmitted data, strong unique passwords, password managers, multi-factor authentication, secure remote access, and least-privilege access controls. Staff training, phishing simulations, sender verification, and procedures for confirming payment or sensitive-data requests help counter phishing, social engineering, and business email compromise.<br /><br />The presentation also stresses secure backups and recovery planning. It recommends automated, encrypted, tested backups, off-site storage, and the 3-2-1 approach: maintain three copies of data on two types of media, with one copy off-site.<br /><br />Firms should monitor EFIN and PTIN activity, watch for signs of compromise, and respond promptly to suspected breaches. Response measures include containing access, assessing affected systems and data, notifying appropriate authorities and affected parties, consulting cybersecurity and insurance professionals, and restoring operations through a tested continuity plan.<br /><br />Overall, effective protection requires layered safeguards, clear accountability, regular risk reviews, and continuous improvement as threats and business needs evolve.

Keywords

taxpayer information security

Written Information Security Plan

WISP

IRS Publication 4557

FTC Safeguards Rule

data security coordinator

multi-factor authentication

encrypted backups

phishing prevention

business email compromise