2027 IRS Pub 1345 - Six Supplement Standards

Publication 1345 (Rev. 10-2024), page 4

These standards also address certain business and customer service objectives, such as instant payment options, access to website owner/operator’s contact information, and Online Provider’s written commitment to maintaining physical, electronic, and procedural safeguards of taxpayer information that comply with applicable law and federal standards.

• Extended Validation SSL Certificate

Online Providers of individual income tax returns must have a valid and current Extended Validation Secure Socket Layer (SSL) certificate using TLS 1.2 or later and minimum 2048-bit RSA/128-bit AES.

• External Vulnerability Scan

Online Providers of individual income tax returns must contract with an independent third-party vendor to run weekly external network vulnerability scans of all their “system components” in accordance with the applicable requirements of the Payment Card Industry Data Security Standards (PCIDSS). All scans must be performed by a scanning vendor certified by the Payment Card Industry Security Standards Council and listed on their current list of Approved Scanning Vendors (ASV). In addition, Online Providers of individual income tax returns whose systems are hosted must ensure that their host complies with all applicable requirements of the PCIDSS.

For the purposes of this standard, “system components” is defined as any network component, server, or application that is included in or connected to the taxpayer data environment. The taxpayer data environment is that part of the network that has taxpayer data or sensitive authentication data.

If scan reports reveal vulnerabilities, action must be taken to address the vulnerabilities in line with the scan report’s recommendations. Retain weekly scan reports for at least one year. The ASV and the host (if present) must be in the United States.

• Information Privacy and Safeguard Policies

This standard applies to Authorized IRS e-file Providers participating in Online Filing of individual income tax returns that own or operate a website through which taxpayer information is collected, transmitted, processed or stored. These Providers must have a written information privacy and safeguard policy consistent with the applicable government and industry guidelines and including the following statement: “we maintain physical, electronic and procedural safeguards that comply with applicable law and federal standards.”

In addition, Providers’ compliance with these policies must be certified by a privacy seal vendor acceptable to the IRS.  

• Protection Against Bulk Filing of Fraudulent Income Tax Returns

This standard applies to Online Providers of individual income tax returns that own or operate a website through which taxpayer information is collected, transmitted, processed or stored. These Online Providers must implement effective technologies to protect their website against bulk filing of fraudulent income tax returns. Taxpayer information must not be collected, transmitted, processed or stored otherwise.

• Public Domain Name Registration

This standard applies to Online Providers of individual income tax returns that own or operate a website through which taxpayer information is collected, transmitted, processed or stored. These Online Providers must have their website’s domain name registered with a domain name registrar that is in the United States and accredited by the Internet Corporation for Assigned Names and Numbers (ICANN). The domain name must be locked and not be private.

• Reporting of Security Incidents

Authorized IRS e-file Providers of individual income tax returns must report security incidents to the IRS as soon as possible but not later than the next business day after confirmation of the incident. For the purposes of this standard, an event that can result in an unauthorized disclosure, misuse, modification, or destruction of taxpayer information (e.g., breach) must be considered a reportable security incident.

Providers with multiple roles must follow instructions for submitting incident reports at “Instructions for Reporting Security Incidents.”

Those that are EROs only must contact their local stakeholder liaison by following the instructions at “Data Theft Information for Tax Professionals.”

In addition, if the Provider’s website is the cause of the incident, the Provider must cease collecting taxpayer information via their website immediately upon detection of the incident and until the underlying causes of the incident are successfully resolved.

The six IRS-mandated security, privacy, and business standards with the requested columns:

IRS "6" Mandated Standards	Yes	No	N/A	Firm	Data Security Coordinator	Date
1. Extended Validation SSL Certificate
2. External Vulnerability Scan (PCIDSS Compliance)
3. Information Privacy and Safeguard Policies
4. Protection Against Bulk Filing of Fraudulent Income Tax Returns
5. Public Domain Name Registration
6. Reporting of Security Incidents
IRS "6" Mandated Standards	Yes	No	N/A	Firm	Data Security Coordinator	Date
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.

Each row corresponds to one of the six standards, allowing for a Yes, No, or N/A response. Fill in the Firm, Data Security Coordinator, and Date columns as needed for tracking and compliance verification.