{"id":14381,"date":"2019-01-16T08:00:06","date_gmt":"2019-01-16T14:00:06","guid":{"rendered":"https:\/\/taxprocenter.proconnect.intuit.com\/?p=14381"},"modified":"2020-05-20T14:49:51","modified_gmt":"2020-05-20T19:49:51","slug":"how-to-update-your-tax-firms-data-safeguards-based-on-irs-pub-4557","status":"publish","type":"post","link":"https:\/\/accountants.intuit.com\/taxprocenter\/practice-management\/how-to-update-your-tax-firms-data-safeguards-based-on-irs-pub-4557\/","title":{"rendered":"How to Update Your Tax Firm’s Data Safeguards Based on IRS Pub 4557"},"content":{"rendered":"

Protecting taxpayer information isn\u2019t just good for clients and good for business \u2013 it\u2019s also the law. Part of tax season readiness should include a review and update of your firm\u2019s plan to safeguard taxpayer data.<\/p>\n

The\u00a0Gramm-Leach-Bliley Act<\/a> requires that tax professionals create and implement a data security plan. Here are some of the important updates to Publication 4557, Safeguarding Taxpayer Data,<\/i> and related actions tax professionals should take today to protect taxpayer data.<\/p>\n

Create a Written Security Plan.<\/b> Create a data security plan using IRS Publication 4557 and Small Business Information Security \u2013 The Fundamentals<\/a> by the National Institute of Standards and Technology. The IRS also may treat a violation of the FTC Safeguards Rule as a violation of IRS Revenue Procedure 2007-40<\/a>, which sets the rules for tax professionals participating as an authorized IRS e-file provider.<\/p>\n

Use Strong, Unique Passwords and Change Them Regularly.<\/b> It is critical that all tax practitioners establish strong, unique passwords<\/a> for all accounts, whether it\u2019s to access a device, tax software products, cloud storage, wireless networks or encryption technology. The IRS recommends a minimum of eight characters; longer is better. Use a combination of letters, numbers and symbols such as XYZ, 567, or !@#. Use a password manager program to track passwords, but protect it with a strong password.<\/p>\n

Use Multi-Factor Authentication (MFA).<\/b> Whenever it is an option for a password-protected account, users also should opt for a multi-factor authentication process. Many email providers now offer customers two-factor authentication protections<\/a> to access email accounts. Tax professionals should always use this option to prevent their accounts from being taken over by cybercriminals, and putting their clients and colleagues at risk. Two-factor authentication helps by adding an extra layer of protection. Often, two-factor authentication means the returning user must enter credentials (username and password) plus take another step such as entering a security code sent via text to a mobile phone. The idea is that a thief may be able to steal your username and password, but it\u2019s highly unlikely they also would have your mobile phone to receive a security code and complete the process.<\/p>\n

Drive Encryption.<\/b> Use drive encryption to lock all files on your computer and on all devices. Drive encryption makes stored data unreadable by hackers until the user enters a password, at boot up or login, to access the drive data. Microsoft operating systems include encryption tools that may be configured to protect stored data. For example, Microsoft BitLocker Drive Encryption<\/a> is an encryption feature available for recent Windows operating system.<\/p>\n

Secure Wireless Networks.<\/b> Take protective steps when setting up your router and wireless network. Change default administrative password of your wireless router; use a strong, unique password. Reduce the wireless range so you are not broadcasting further than you need. Choose a router name (Service Set Identifier – SSID) that is not personally or professionally identifying, and disable the SSID broadcast so that it cannot be seen by those who have no need to use your network. Use Wi-Fi Protected Access 2 (WPA-2) with the Advanced Encryption Standard (AES) for encryption.<\/p>\n

Anti-Virus Security Software.<\/b> Use anti-virus security software on all workstations, educate staff about phishing emails and scams, and watch for suspicious activity that might indicate a hack or data theft.<\/p>\n

Educate Yourself.<\/b> There are a number of resources to help navigate tax-related rules and regulations related to protecting data.<\/p>\n