IR-2020-184, August 18, 2020<\/p>\n\n\n\n
WASHINGTON \u2014 The Internal Revenue Service and Security Summit<\/a> partners today reminded tax professionals that federal law requires them to have a written information security plan.<\/p>\n\n\n\n Amid continuing security threats during COVID-19, the IRS, state tax administrators and the nation’s tax industry \u2212 working together as the Security Summit \u2212 also recommended practitioners create an emergency response plan should they experience a data theft. Contacting the IRS is step one in the plan to quickly protect tax professionals and their clients.<\/p>\n\n\n\n Making a plan for protecting data and reporting theft is the last of a five-part series called Working Virtually: Protecting Tax Data at Home and at Work. The special Security Summit initiative spotlights basic security steps for all practitioners, but especially those working remotely or social distancing in response to COVID-19.<\/p>\n\n\n\n “COVID-19 has changed the way many of us work, and more tax professionals are working from home. With these changes, there are new risks from cybercriminals. Our special Security Summit series was designed to give you critical information protect your clients and protect your business,” said IRS Commissioner Chuck Rettig.<\/p>\n\n\n\n “We all have a role in protecting taxpayer data, and the tax professional community is a critical part of that effort,” Rettig added. “It’s more important than ever to take appropriate security precautions, protect remote work sites, use two-factor authentication and plan ahead for all possibilities.”<\/p>\n\n\n\n Federal law administered by the Federal Trade Commission requires all “professional tax preparers” to create and maintain a written information security plan that is appropriate to the firm’s size and complexity.<\/p>\n\n\n\n In addition, the FTC-required information security plan must be appropriate to the nature and scope of the company’s activities and the sensitivity of the customer information it handles. A plan for a sole tax practitioner would differ from a multi-partner, global firm.<\/p>\n\n\n\n Tax professionals working from home must ensure that client data is protected just as it would in an office setting.<\/p>\n\n\n\n Please note: <\/strong>The FTC currently is re-evaluating the Safeguards Rule and has proposed new regulations. Be alert to any changes in the Safeguards Rule and its effect on the tax preparation community.<\/p>\n\n\n\n IRS Publication 4557, Safeguarding Taxpayer Data (PDF)<\/a>, details critical security measures that all tax professionals should enact. The publication also includes information on how to comply with the FTC Safeguards Rule, including a checklist of items for a prospective data security plan. Tax professionals are asked to focus on key areas such as employee management and training; information systems; and detecting and managing system failures.<\/p>\n\n\n\n The IRS also may treat a violation of the FTC Safeguards Rule as a violation of IRS Revenue Procedure 2007-40, which sets the rules for tax professionals participating as an Authorized IRS e-file Provider.<\/p>\n\n\n\n Tax professionals who experience a data theft should report the crime to the IRS immediately so that actions can be taken to protect taxpayers \u2013 and the firm. The Security Summit partners recommend practitioners create a response plan so that actions can be taken quickly, and contact information is readily available.<\/p>\n\n\n\n If a client or the firm are the victim of data theft, immediately<\/strong>:<\/p>\n\n\n\n Find more information at Data Theft Information for Tax Professionals<\/a>.<\/p>\n\n\n\n In addition to trying to steal client data, thieves may try to steal a tax practitioner’s identity as well, using their PTINs, EFINs and CAF numbers to file fraudulent returns or steal even more information. Thieves may even try to impersonate the tax practitioner to obtain tax transcripts or other tax records.<\/p>\n\n\n\n Practitioners should routinely check their IRS e-Services e-file Application to see a weekly count of tax returns filed with their Electronic Filing Identification Numbers or EFIN. Excessive filings are a sign of data theft. E-file applications also should be kept up to date.<\/p>\n\n\n\n Circular 230 practitioners also can review weekly the number of tax returns filed using their Preparer Tax Identification Number or PTIN. Again, excessive filings are a sign of data theft.<\/p>\n\n\n\n Preparers with Centralized Authorization File, or CAF numbers, that enable third party access to tax information or representation should keep those records updated. Practitioners should notify the IRS when they no longer need third-party authorization for clients.<\/p>\n\n\n\n Tax professionals also can get help with security recommendations by reviewing the recently revised IRS Publication 4557, Safeguarding Taxpayer Data (PDF)<\/a>, and Small Business Information Security: The Fundamentals (PDF)<\/a> by the National Institute of Standards and Technology.<\/p>\n\n\n\n Publication 5293, Data Security Resource Guide for Tax Professionals (PDF)<\/a>, provides a compilation data theft information available on IRS.gov. Also, tax professionals should stay connected to the IRS through subscriptions to\u00a0e-News for Tax Professionals<\/a>\u00a0and\u00a0Social Media<\/a>\u00a0or visit Identity Theft Central at\u00a0IRS.gov\/identitytheft<\/a>. https:\/\/www.irs.gov\/newsroom\/working-virtually-make-a-plan-for-protecting-data-and-reporting-theft-part-5-of-security-summit-tips-for-tax-professionals<\/a><\/p>\n","protected":false},"excerpt":{"rendered":" IR-2020-184, August 18, 2020 WASHINGTON \u2014 The Internal Revenue Service and Security Summit partners today reminded tax professionals that federal law requires them to have a written information security plan. Amid continuing […]<\/p>\n","protected":false},"author":88892,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-835","post","type-post","status-publish","format-standard","hentry","category-general"],"yoast_head":"\nTax Pros: Create a Security Plan to meet FTC requirement<\/h2>\n\n\n\n
According to the FTC, each company, as part of its plan, must:<\/h3>\n\n\n\n
Create a Data Theft Response Plan; Report Data Thefts to the IRS<\/h2>\n\n\n\n
Additional resources<\/h2>\n\n\n\n