The Safeguards Rule is about your email, not your portal

Most accounting firms we talk to answered the Safeguards Rule by buying a client portal. Good. Then tax season arrived and half of the W-2s came in as email attachments anyway, because clients do what is easy. The rule doesn’t care where you wanted the document to go; it cares what happened to it.

What the rule actually says about email

16 CFR 314.4(c)(3) requires encryption of customer information in transit over external networks and at rest. 314.4(c)(5) requires multi-factor authentication. 314.4(c)(8) requires logging of authorized users’ activity. None of those is satisfied by “our clients are supposed to use the portal”.

What the PTIN question asks

The IRS PTIN renewal asks preparers to confirm they are aware of their data security responsibilities and have a written information security plan. Publication 4557 describes what the plan should contain, and email encryption is on the list; Publication 5708 is the template. Checking the box without a plan is the kind of thing that becomes a problem the day a client’s refund is stolen.

The four controls

1. Enforced encryption in transit with a fallback for recipients who can’t negotiate TLS.
2. Tax-document detection that encrypts W-2s, 1099s, 1040s and SSNs automatically, because the person who forgets the button is the one who causes the incident.
3. MFA on every account, including seasonal staff.
4. A retained, searchable record of what was sent, to whom, and how it was protected.

You don’t have to leave Gmail or Microsoft 365

All four can be added to the account you already have. That is what PXCMail for accounting is, and the WISP template with the email section completed comes with it. If you want to write the rest of the plan yourself, a WISP in a weekend walks through the nine elements.

Sources

• 16 CFR 314.4, Elements of an information security program, (c)(3), (c)(5) and (c)(8) — requires encryption in transit and at rest, multi-factor authentication, and logging of authorized users’ activity.
• IRS Publication 4557, Safeguarding Taxpayer Data — describes the safeguards the IRS expects tax professionals to have, including encrypted email.
• IRS Publication 5708, Creating a Written Information Security Plan — the IRS template for the WISP confirmed at PTIN renewal.