2027 EFIN PTIN IRS WISP Data Security

What extra requirements for a EFIN holder for data standards with also with a PTIN

As a tax professional holding both an Electronic Filing Identification Number (EFIN) and a Preparer Tax Identification Number (PTIN), you are subject to specific data security requirements to protect taxpayer information. While both identifiers necessitate adherence to data protection standards, the obligations associated with each have distinct focuses.

EFIN Data Security Requirements:

An EFIN authorizes you to electronically file tax returns with the IRS. To maintain this authorization, you must:

• Develop a Written Information Security Plan (IRS WISP): The IRS mandates that all tax professionals create and implement a IRS WISP to safeguard taxpayer data. This plan should address administrative, technical, and physical safeguards tailored to your firm's size and complexity. The IRS provides guidance on creating a IRS WISP in Publication 5708.

Internal Revenue Service

• Monitor EFIN Usage: Regularly review your EFIN status to ensure it is not being misused. The IRS recommends checking the number of returns filed under your EFIN to detect any unauthorized activity.

Internal Revenue Service

• Implement the "Security Six": Adopt essential security measures, including:
  • Anti-virus software
  • Firewalls
  • Two-factor authentication
  • Backup software/services
  • Drive encryption
  • Virtual private networks (VPNs)

These measures are detailed in IRS Publication 4557, "Safeguarding Taxpayer Data."

Internal Revenue Service

PTIN Data Security Requirements:

A PTIN is required for anyone who prepares or assists in preparing federal tax returns for compensation. When applying for or renewing your PTIN, you must acknowledge your awareness of data security responsibilities:

• Acknowledge Data Security Responsibilities: The PTIN application includes a statement confirming your legal obligation to have a data security plan and to provide data and system security protections for all taxpayer information. This acknowledgment reinforces the necessity of implementing a IRS WISP and adhering to data protection protocols.

CSEA

Additional Considerations:

While both EFIN and PTIN holders are required to implement data security measures, the emphasis for EFIN holders is on the secure electronic transmission of tax returns, necessitating robust technical safeguards. For PTIN holders, the focus is on the ethical and legal responsibilities of handling taxpayer information, underscoring the importance of a comprehensive data security plan.

By fulfilling these requirements, you not only comply with federal regulations but also enhance the trust and confidence your clients place in your services.