The IRS publishes real security requirements for tax professionals who e-file — and “I didn’t know that applied to us” isn’t a defense if a client’s data gets exposed.
Not sure if your firm actually meets IRS security expectations? Contact us for a free assessment — no pressure, no obligation.
What the Requirements Actually Cover
The IRS’s guidance for authorized e-file providers (built around the FTC Safeguards Rule) expects a written information security plan, not just good intentions. That means documented policies covering data encryption, access controls, employee training, and a plan for what happens if client data is compromised — the kind of documentation regulators and cyber insurers increasingly expect to actually see, not just hear described.
The Practical Pieces
- Encryption for client PII — Social Security numbers, financial account details, and tax records at rest and in transit.
- Multi-factor authentication on every system that touches client tax data.
- A written incident response plan specifically for a data breach involving taxpayer information, including notification obligations.
- Regular security awareness training for staff who handle client data during filing.
Why This Sneaks Up on Firms
Many small and mid-size accounting firms have never had this explained to them plainly — they know they need “good security” in a general sense, but haven’t seen the actual written-plan requirement or realized it applies to them specifically as e-file providers. It’s not optional guidance; it’s a documented expectation tied to e-file authorization.
Can You Do This Yourself?
The individual security controls, yes. Where firms usually need help is pulling it together into an actual written information security plan that reflects what you really do — not a generic downloaded template that doesn’t match your systems.
The Bottom Line
IRS e-file security best practices are part of what’s included in LME Services IT for accounting firms. Schedule a free consultation and we’ll tell you honestly where your firm stands against these requirements.