What Is IRS Publication 4557 and What Does It Require of Accounting Firms?

IRS Publication 4557 is the IRS’s practical data-security guide for tax professionals. For accounting firms, the clearest way to understand it is as a 5-part operational framework: maintain a written security plan, implement core safeguards, restrict and monitor access to taxpayer data, train staff and secure day-to-day workflows, and be prepared to report and recover from a data incident. Publication 4557 itself is guidance rather than a standalone law, but it is built around compliance with the FTC Safeguards Rule and related IRS expectations for firms that handle taxpayer data.

For accounting firms in New Jersey, IRS Publication 4557 should be viewed as an operational guide for protecting client data, supporting compliance, and reducing the risk of disruption during tax season and other deadline-driven periods.

What IRS Publication 4557 Actually Is

Publication 4557, Safeguarding Taxpayer Data: A Guide for Your Business, is an IRS resource for tax professionals. The current version from the IRS as of this writing is Rev. 5-2024. Its structure makes clear that it is more than a broad awareness piece. It covers basic security steps, spotting data theft, monitoring EFIN and PTIN activity, phishing, reporting a breach, recovering from a data loss, and understanding and complying with the FTC Safeguards Rule.

The important nuance for accounting firms is this: Publication 4557 explains what firms should do, but the underlying legal obligation comes from the FTC Safeguards Rule and related data-protection expectations. In practice, accounting firms should treat Publication 4557 as a guide for how security controls and documentation should work inside real operations.

The 5 Practical Requirements Accounting Firms Should Take from Publication 4557

Most accounting firms should read Publication 4557 as creating 5 practical expectations for day-to-day operations.

Maintain a Written Security Plan, Not Just Ad Hoc Safeguards

IRS guidance says tax professionals are required by law to have a Written Information Security Plan (WISP). That plan should designate responsibility, identify and assess risks, evaluate safeguards, implement and monitor controls, and address service-provider handling of customer information.

Implement Core Security Controls Across the Firm

Publication 4557 calls for anti-malware and anti-virus protection, strong unique passwords, multi-factor authentication, encryption of sensitive files and emails, secure backups and recovery planning, limited access to taxpayer data, destruction of retired devices, and audit trails showing who performed an action, when it occurred, and what changed.

Secure the Firm’s Actual Operating Environment, Including Remote Work

Publication 4557 goes beyond software. It addresses clean desk practices, secure wireless configuration, VPN use for remote access, drive encryption, inventories of devices and software that store client data, and the secure disposal of hard drives, printers, phones, and paper records.

Monitor for Misuse, Fraud, and Warning Signs

Publication 4557 tells firms to check E-File Applications and PTIN accounts weekly, watch for phishing, and look for indicators of theft such as rejected returns, IRS authentication letters received by clients who have not yet filed, refunds clients did not request, or transcripts they never ordered.

Be Ready to Report and Recover from an Incident Quickly

Publication 4557 tells tax practitioners to report data losses or thefts immediately, contact applicable agencies, involve law enforcement where appropriate, and bring in security experts and insurers. For accounting firms, that means incident response cannot be improvised after a breach.

As a practical matter, firms should review, update, and test their written plans at least once per year, and again whenever there is a significant change in systems, staffing, vendors, or firm operations.

Where Accounting Firms Usually Misread Publication 4557

A common mistake is treating Publication 4557 like a generic cybersecurity checklist for small businesses. It is more specific than that. It is written for tax professionals and repeatedly ties technical controls to the handling of taxpayer data, EFIN and PTIN activity, e-filing risk, phishing aimed at tax practitioners, and breach reporting obligations that are unique to the tax-preparer environment.

For an accounting firm, that means the publication should be applied to real workflows: how tax returns are prepared, reviewed, transmitted, stored, backed up, and accessed by partners, managers, and staff; how direct deposit information is checked before e-filing; how remote users connect during busy season; and how client data is protected across email, cloud platforms, printers, laptops, and archived files.

Why Generic MSP Interpretation Often Falls Short

This is also where generic MSP support often misses the mark. A provider may install antivirus, enable MFA in a few places, and call the environment “secure,” while still leaving the firm exposed on documentation, access control, EFIN and PTIN oversight, secure backup design, remote-work discipline, or incident response readiness.

Accounting firms need controls and documentation built around real operations under deadline pressure, not a generic small-business security template. That is why many firms rely on managed IT services combined with cybersecurity protections tailored to accounting workflows, data sensitivity, and compliance expectations.

Why This Matters for Accounting Firms in New Jersey

For firms in New Jersey with 10 to 50 employees, that distinction matters. When a firm handles tax returns, financial statements, personally identifiable information, and client communications under hard filing deadlines, downtime is never acceptable. A security control that looks fine in theory can still fail in practice if it does not match how the firm actually works during peak tax periods.

That is why Publication 4557 should be read operationally, not just technically.

Real-World Perspective from Inside a Regional Accounting Firm

Total Cover IT Founder David Quick spent 17 years as the internal IT Director for a mid-sized regional accounting firm in New Jersey, supporting the firm as it grew from approximately 50 employees to more than 80.

During that time, David was responsible for:

• Designing, implementing, and maintaining the firm’s entire IT infrastructure
• Supporting specialized practice management and time and billing systems, workflow management tools, and various accounting, audit, and tax-related applications
• Minimizing downtime, especially during peak tax seasons
• Leading a full headquarters office relocation, including the migration and reassembly of core IT infrastructure, with minimal disruption

That experience matters because Publication 4557 is not just about checking compliance boxes. In a real accounting firm, the publication’s recommendations have to work inside deadline-driven operations where staff need reliable access to tax software, document systems, email, and client data without creating avoidable security risk.

Related Resources for Accounting Firms

This article is part of our Resources for Accounting Firms series covering IT costs, security requirements, compliance expectations, and operational risk.

View all resources for accounting firms

FAQ

What is IRS Publication 4557?

IRS Publication 4557 is the IRS’s data-security guide for tax professionals. It explains practical steps accounting firms should take to safeguard taxpayer data, reduce cyber risk, and support compliance expectations.

Does IRS Publication 4557 create a legal requirement by itself?

Publication 4557 is guidance, not a standalone law. However, it is closely tied to underlying obligations such as the FTC Safeguards Rule and other expectations that apply to firms handling taxpayer information.

What does Publication 4557 expect accounting firms to do?

In practical terms, firms should maintain a written security plan, implement core safeguards, restrict and monitor access to taxpayer data, train staff on secure workflows, and be prepared to report and recover from incidents.

Why do generic IT approaches often fall short for Publication 4557?

Generic IT support often focuses on basic tools rather than documentation, workflow-specific controls, incident readiness, and tax-season operational realities. Accounting firms need a more specialized approach that aligns security with how the firm actually operates.