# IRS Publication 4557 and the WISP: the email controls tax professionals need

URL: https://iblockspam.com/blog/irs-publication-4557-email-security-tax-professionals
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Phishing & threats
Author: iBlockSpam Team

> What IRS Publication 4557 and the WISP requirement expect from tax professionals' email: MFA, encrypted client files, phishing defenses, logging and a breach plan.

## Short answer

IRS Publication 4557 tells tax professionals to protect email with strong passwords and multi-factor authentication, encrypt or password-protect client files, scan mail for malware, treat unexpected IRS and client emails as suspect, and report data theft. Paid preparers must also keep a written information security plan (WISP) under the FTC Safeguards Rule; Publication 5708 has a sample.

Tax professionals hold exactly what identity thieves want, and most of it arrives by email: W-2s, prior-year returns, bank details and scanned IDs. IRS Publication 4557 sets out the safeguards the IRS expects, and the FTC Safeguards Rule makes a written security plan a legal requirement. This guide pulls out the email controls in both, so you can put them in your plan and actually run them.

It complements our guide to the [FTC Safeguards Rule and email security](https://iblockspam.com/blog/ftc-safeguards-rule-email-security), which covers the rule itself in detail. This is general information, not legal advice.

## What is IRS Publication 4557?

[Publication 4557, Safeguarding Taxpayer Data](https://www.irs.gov/pub/irs-pdf/p4557.pdf), is the IRS's security guide for tax professionals. The current revision at the time of writing (October 2026) is Rev. 6-2024. It covers basic security steps, phishing, data theft warning signs, reporting a data loss and how to comply with the FTC Safeguards Rule.

It's blunt about why it matters: "Protecting taxpayer data is the law." It notes that under the Safeguards Rule, "tax return preparers must create and enact security plans to protect client data," and that "failure to do so may result in an FTC investigation."

## What is the WISP requirement?

A WISP is a written information security plan. [Publication 5708](https://www.irs.gov/pub/irs-pdf/p5708.pdf), prepared by the Security Summit (the IRS, state tax agencies and the tax industry), explains it:

- "Under the GLBA and Safeguards Rule, tax and accounting professionals are considered financial institutions, regardless of size."
- "A requirement of the Safeguards Rule is implementing and maintaining a WISP. Your WISP must be written and accessible."

The plan should fit your practice. Publication 5708 says "a sole practitioner can use a more abbreviated and simplified plan than a 10-partner accounting firm," and includes a sample template you can adapt.

The requirement also appears when you renew your PTIN. Line 11 of [Form W-12](https://www.irs.gov/pub/irs-pdf/fw12.pdf) (Rev. October 2025) asks you to confirm: "I am aware that paid tax return preparers are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information."

The legal source is the FTC's [16 CFR Part 314](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314). Firms holding information on fewer than 5,000 consumers are exempt from four requirements, such as the written risk assessment and penetration testing, but not from MFA, encryption, training or breach notification.

## Which email controls does Publication 4557 expect?

Publication 4557 doesn't have a single "email" chapter. Its email advice is spread across several sections. Here it is in one place:

| Area | What Publication 4557 says | How to put it into practice |
|---|---|---|
| Account security | Use strong passwords and multi-factor authentication, "not only for your tax software, but other products such as email accounts" | MFA on every mailbox, including shared and seasonal staff accounts |
| Separate accounts | "Use separate personal and business email accounts" | No client data in personal mailboxes |
| Malware scanning | "Use security software to help protect systems from malware and scan emails for viruses" | Inbound filtering with attachment scanning |
| Phishing sites | "Install an anti-phishing tool bar to help identify known phishing sites" | Link protection in your filter, mail platform or browser |
| Unknown senders | "Never open or download attachments from unknown senders, including potential clients; make contact first by phone" | Phone new clients before opening their first file |
| Sending client files | "Send only password-protected and encrypted documents if you must share files with clients via email or use Secure File Transfer Protocol (SFTP)" | A client portal, or encrypted files with the password sent separately |
| Sensitive files | "Encrypt all sensitive files/emails, especially those with the taxpayer's personally identifiable information" | Encryption at rest and in transit |
| Public wi-fi | "Avoid accessing business emails or information from public wi-fi connections" | VPN and MFA for remote work |
| Reporting | If IRS-related, forward suspicious email to phishing@irs.gov | Teach staff how to forward with headers |

## What phishing does Publication 4557 warn about?

The publication says "all employees in your office must be educated on the dangers of phishing scams." It singles out spear phishing, "where the thief specifically targets you or your firm, perhaps seeing your email address from the office website."

According to Publication 4557, the sender may pose as:

- your tax software provider or data storage provider,
- the IRS or IRS e-Services,
- a prospective client,
- your bank, or
- a colleague "whose email was compromised."

Messages usually have "an urgent subject line," such as "Update Your Account Now," and aim to get you to open a link to a fake sign-in page or an attachment carrying malware such as a keystroke logger. Our guides on [how to spot a phishing email](https://iblockspam.com/blog/how-to-spot-a-phishing-email) and [fake Microsoft login pages](https://iblockspam.com/blog/fake-microsoft-login-phishing) show what these look like.

The publication also lists warning signs that you've already been breached, including "tax professionals or clients responding to emails that practitioner did not send." That's a classic sign of a hijacked mailbox. See [signs your email account is compromised](https://iblockspam.com/blog/signs-email-account-compromised).

## What does the sample WISP say about email?

The sample plan in Publication 5708 turns the advice into firm policy. Three parts matter most for email:

1. **Electronic exchange of PII.** "PII will not be in any unprotected format, such as e-mailed in plain text, rich text, html, or other e-mail formats unless encryption or password protection is present." Passwords "MUST be communicated to the receiving party via a method other than what is used to send the data." A password-protected portal is allowed once approved.
2. **User access control.** The firm uses MFA, and "all users will have unique passwords"; there are no shared accounts.
3. **Monitoring.** "Event Logging will remain enabled on all systems containing PII," and logs are reviewed "at random intervals not to exceed 90 days."

Its rules of behavior, based on [NIST IR 7621](https://csrc.nist.gov/pubs/ir/7621/r1/final), add: don't click a link or open an attachment you weren't expecting; call the sender to check; and don't send sensitive business information to personal email addresses.

## How do you add email controls to your WISP?

Work through this checklist and record each decision, who owns it and when it was last checked:

1. **Turn on MFA** for every mailbox, admin account, tax software login and cloud storage account. List any exception and who approved it.
2. **Remove shared logins.** Give seasonal staff their own accounts, and disable them when the season ends.
3. **Filter inbound mail** for spam, malware, phishing and spoofing, and decide who reviews held messages. See [dangerous email attachment types](https://iblockspam.com/blog/dangerous-email-attachment-types) for file types worth blocking.
4. **Protect your own domain** with SPF, DKIM and DMARC, so criminals can't easily send mail that appears to come from your firm. Check it with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker).
5. **Choose a secure way to exchange files**, such as a client portal, and write down when encrypted email is acceptable.
6. **Turn on logging** for mailbox sign-ins and admin actions, and schedule a review at least every 90 days, as the sample plan suggests. Look for [malicious inbox rules and auto-forwarding](https://iblockspam.com/blog/malicious-inbox-rules-auto-forwarding).
7. **Train staff before each filing season** on phishing, fake client documents and bank-change requests. Our [security awareness training guide](https://iblockspam.com/blog/email-security-awareness-training-small-business) covers the essentials.
8. **Write a breach plan.** Publication 4557 says to report client data theft to your local IRS stakeholder liaison, contact the states where you file returns, and bring in a security expert and your insurer. Our guide on [what to do after clicking a phishing link](https://iblockspam.com/blog/what-to-do-after-clicking-phishing-link) covers the first hour.
9. **Review your email providers.** The Safeguards Rule requires you to select capable service providers and require safeguards by contract. Ask where mail is processed and how long it's kept.

## How should staff report IRS phishing?

The IRS asks you to send suspicious IRS-themed messages to phishing@irs.gov. Its [reporting page](https://www.irs.gov/help/report-fraud/report-fake-irs-treasury-or-tax-related-emails-and-messages) says to "forward as attachment" or send the email headers, because a plain forward "strips important data to identify and stop the scammer." It also says: "Don't reply, click links or open attachments."

Put those steps in your WISP and on a card next to each desk. Our [guide to reporting phishing](https://iblockspam.com/blog/report-phishing-email) covers other places to report, and the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) helps you read the headers before you send them.

## Where does an email filter fit?

Publication 4557 expects you to scan email for malware and guard against phishing, and the Safeguards Rule expects safeguards for the risks your assessment finds. An inbound filter is one of those safeguards. It isn't a WISP, and it doesn't make a practice compliant.

iBlockSpam filters inbound mail for spam, viruses, malware, phishing and spoofing at the MX level, in front of Microsoft 365, Google Workspace or your own server. Attachment-type filters and an Office macro filter can hold file types your clients never need to send. Every user gets a personal quarantine with scheduled digests, so a held client document can be found and released in the busy weeks. Message history is kept for 30 days, and mail is processed in the United States. See our page for [accounting firms](https://iblockspam.com/solutions/accounting-firms).

## Next steps

1. Download [Publication 4557](https://www.irs.gov/pub/irs-pdf/p4557.pdf) and [Publication 5708](https://www.irs.gov/pub/irs-pdf/p5708.pdf), and start your WISP from the sample template.
2. Turn on MFA for every mailbox before the next filing season.
3. Run the free [Email Health Check](https://iblockspam.com/tools/email-health-check) on your firm's domain to find SPF, DKIM and DMARC gaps.
4. Read the [FTC Safeguards Rule and email security](https://iblockspam.com/blog/ftc-safeguards-rule-email-security) guide for the rule's requirements, including breach notification.

Browse more guides on [email threats](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### Is a WISP legally required for tax preparers?

The IRS says so. Publication 5708 states that under the Gramm-Leach-Bliley Act and the FTC Safeguards Rule, tax and accounting professionals are financial institutions regardless of size, and that the law requires a written information security plan. The PTIN application, Form W-12, asks preparers to confirm they're aware of this requirement.

### Can I email tax returns to clients?

Publication 4557 says to send only password-protected and encrypted documents if you must share files by email, or to use secure file transfer instead. The sample WISP in Publication 5708 adds that the password must go by a different channel, such as a phone call or text, never in the same email.

### What should I do with a phishing email pretending to be the IRS?

Don't reply, click links or open attachments. Forward it to phishing@irs.gov as an attachment, or send the full headers, because the IRS says a plain forward strips data it needs. Then delete it, and warn colleagues if it looked convincing.

### Does Publication 4557 require a spam filter?

It doesn't name spam filters. It recommends security software that scans emails for viruses and anti-phishing tools that identify known phishing sites. An inbound email filter is one way to meet that expectation, alongside MFA, encryption and training. Record the choice and its reasons in your WISP.

### Do small tax practices with few clients need a WISP?

Yes. Publication 5708 says tax professionals are financial institutions regardless of size, and that a sole practitioner can use a shorter, simpler plan than a ten-partner firm. Under the Safeguards Rule, firms with fewer than 5,000 consumers skip four requirements, such as the written risk assessment, but not MFA, encryption or training.

## Sources

- [IRS Publication 4557: Safeguarding Taxpayer Data (Rev. 6-2024)](https://www.irs.gov/pub/irs-pdf/p4557.pdf)
- [IRS Publication 5708: Creating a Written Information Security Plan for your Tax & Accounting Practice (Rev. 8-2024)](https://www.irs.gov/pub/irs-pdf/p5708.pdf)
- [IRS Form W-12: PTIN Application and Renewal (Rev. October 2025)](https://www.irs.gov/pub/irs-pdf/fw12.pdf)
- [eCFR: 16 CFR Part 314, Standards for Safeguarding Customer Information](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314)
- [FTC: FTC Safeguards Rule, What Your Business Needs to Know](https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know)
- [IRS: Report fake IRS, Treasury or tax-related emails and messages](https://www.irs.gov/help/report-fraud/report-fake-irs-treasury-or-tax-related-emails-and-messages)
- [NIST IR 7621 Rev. 1: Small Business Information Security, The Fundamentals](https://csrc.nist.gov/pubs/ir/7621/r1/final)

## Free tools for this guide

- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [MTA-STS Checker](https://iblockspam.com/tools/mta-sts-checker): Fetch and validate your MTA-STS policy, match it to your MX hosts and check TLS-RPT.

---

Source: iBlockSpam, https://iblockspam.com/blog/irs-publication-4557-email-security-tax-professionals (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt