IRS spotlights requirement to have a written information security plan

January 28, 2020

By Susan C. Allen, CPA/CITP, CGMA, Durham, N.C. for The Tax Adviser
Editor: Valrie Chambers, CPA, Ph.D.

Data security continues to be a hot topic for tax professionals — and the IRS. That is because tax practitioners and their clients continue to be frequent targets of data breaches. Although the IRS has implemented many successful tactics to fight tax refund fraud, more work is needed, especially as cyberthieves continue to become more sophisticated. The IRS is partnering with the practitioner community to combat this epidemic.

The IRS's Protect Your Clients; Protect Yourself campaign (visit for more information) raises practitioners' awareness of their responsibilities and the common-sense steps they can take to protect their clients from identity theft and, in turn, their tax practice and livelihood. Steps such as protecting email accounts with strong passwords, implementing two-factor authentication, and having anti-phishing security tools are imperative. Review IRS Publication 4557, Safeguarding Taxpayer Data, available at, for additional best practices.

Practitioner requirement to develop a written information security plan

According to the Gramm-Leach-Bliley Act (GLBA) safeguards rule, tax preparers must implement security plans to protect client data. Failure to do so may result in a Federal Trade Commission (FTC) investigation.

Although the GLBA, also known as the Financial Services Modernization Act of 1999, P.L. 106-102, has been around for quite some time, many practitioners have been unaware they are required to develop a written information security plan that describes how their firm is prepared to protect clients' nonpublic personal information.

The IRS, aware of the confusion in the profession, boosted its efforts to remind practitioners of this responsibility, issuing several recent email alerts to the practitioner community.Additionally, in mid-October 2019, when practitioners were starting to renew their preparer tax identification numbers (PTINs), they noticed a statement on data security responsibilities added to the renewal process. Practitioners were instructed to check a box to confirm their awareness of their responsibility to have a data security plan and to provide data and system security protections for all taxpayer information.

In response to many recent requests from members, the AICPA Tax Section developed a GLBA information security plan template (available at that Tax Section members can download and customize to comply with the safeguards rule contained in the GLBA.

Click here to continue reading.

View all News