How to Create a 2027 Comprehensive Written Information Security Plan (IRS WISP) for Your Business

Dissertation Title: Comparative Data Security Requirements for Tax Preparers Utilizing PII and IRS WISP in Paper Versus Electronic Tax Filing

Abstract

With the increasing scrutiny of data privacy and security, tax preparers are obligated to protect Personally Identifiable Information (PII) through robust data protection measures. This dissertation examines the security requirements under a Written Information Security Plan (IRS WISP) for tax preparers using two contrasting methods: completing and filing paper tax returns versus completing and electronically filing tax returns to the IRS. The analysis explores how IRS WISP requirements, informed by PII considerations, influence the security policies and practices for each filing method, aiming to identify the most effective approach for safeguarding taxpayer information in a rapidly digitalizing field.

Chapter 1: Introduction

1.1 Background

The security of sensitive taxpayer information is paramount for tax preparers, who handle PII as part of their daily responsibilities. As identity theft and cyber threats continue to rise, federal and state regulations mandate that tax professionals implement data protection policies under a IRS WISP. Tax preparers must therefore assess their filing methods in the context of security requirements. This study contrasts the obligations associated with paper-based filing with those required for electronic filing, each presenting unique risks and requirements.

1.2 Research Objectives

The objective of this dissertation is to:

1. Identify the distinct IRS WISP requirements for tax preparers using paper versus electronic filing methods.
2. Analyze the differences in security measures needed to satisfy PII protection standards for each filing approach.
3. Recommend best practices for tax preparers seeking to achieve optimal security compliance.

Chapter 2: Literature Review

2.1 PII and Its Importance in Tax Preparation

PII refers to any data that can identify an individual, including names, Social Security numbers, and financial information. For tax preparers, protecting PII is not only a matter of compliance but also essential for maintaining client trust. Regulatory frameworks, including the IRS’s guidelines and federal data privacy laws, underscore the importance of IRS WISP in mitigating the risks associated with handling PII.

2.2 Overview of IRS WISP Requirements

A IRS WISP outlines administrative, technical, and physical security measures to protect sensitive information. In the tax preparation field, IRS WISP compliance includes risk assessments, incident response protocols, and employee training. While core IRS WISP requirements apply universally, the security practices can vary significantly based on whether the tax preparer uses paper or electronic methods for tax filing.

Chapter 3: Methodology

This study employs a comparative approach, analyzing data security requirements under IRS WISP for paper-based versus electronic tax filing. It includes a detailed examination of the security protocols necessary for both approaches, informed by IRS guidelines and IRS WISP regulatory standards.

Chapter 4: Analysis of Paper-Based Filing Requirements

4.1 Physical Security and Storage

For tax preparers who complete and store paper tax returns, IRS WISP requires robust physical security measures:

• Secure Storage: Paper documents containing PII must be stored in locked file cabinets, accessible only to authorized personnel.
• Access Control: Office access should be restricted, with clear protocols to monitor and control who can access sensitive files.
• Record Management and Disposal: Old tax returns and other PII-containing documents should be shredded or otherwise securely destroyed after the legally required retention period.

4.2 Data Transmission and Mailing

Mailing paper tax returns to the IRS introduces additional security challenges. IRS WISP-compliant practices include:

• Sealed and Labeled Envelopes: To reduce the risk of interception, returns should be sealed and properly labeled.
• Certified or Tracked Mailing: Sending documents through certified or tracked mail ensures that they are monitored until delivery.
• Mail Receipt Protocols: When handling sensitive information through mail, recipients should have procedures for securing documents as soon as they arrive.

4.3 Risks and Limitations of Paper Filing

While paper-based filing reduces cyber risks, it remains vulnerable to physical security breaches, such as theft, fire, or loss. Additionally, tax preparers must track all physical access to records, which can be resource-intensive and challenging to enforce.

Chapter 5: Analysis of Electronic Filing Requirements

5.1 Technical Security and Encryption

For tax preparers using electronic filing, IRS WISP standards focus heavily on digital safeguards:

• Encryption: Tax returns should be encrypted during transmission to protect PII from interception or tampering.
• Anti-Virus and Anti-Malware Software: IRS WISP guidelines require the use of updated software to detect and block potential threats.
• Two-Factor Authentication (2FA): Implementing 2FA for systems accessing taxpayer data enhances access control and protects against unauthorized logins.

5.2 Incident Response and Data Breach Protocols

Electronic filing requires strict incident response procedures, as stipulated in a IRS WISP:

• Breach Notification Protocols: In the event of a data breach, tax preparers must notify affected clients and relevant authorities promptly.
• Data Backup and Recovery: IRS WISP compliance includes maintaining secure backups of electronic tax returns to prevent data loss.

5.3 Risks and Advantages of Electronic Filing

Electronic filing poses cyber risks, such as hacking, phishing, or ransomware attacks. However, it allows for secure data backups, access control through 2FA, and efficient breach response. These advantages make it an increasingly preferred choice, especially when balanced with robust IRS WISP-compliant security measures.

Chapter 6: Comparative Analysis

6.1 Security Obligations under IRS WISP

The IRS WISP obligations differ between paper and electronic filing. Paper filing requires physical safeguards, while electronic filing demands technical controls. Both methods require careful access control and employee training.

6.2 Efficiency and Compliance

Electronic filing, when adequately secured, can enhance efficiency and streamline compliance with IRS WISP standards. However, it requires a higher investment in technology and continuous monitoring.

6.3 Cost Implications

Paper filing may incur lower upfront costs, but it is resource-intensive in terms of physical storage and access management. Electronic filing demands investments in cybersecurity but can result in long-term cost savings and increased security.

Chapter 7: Recommendations for Tax Preparers

1. Integrated IRS WISP for Dual Filing Methods: For tax preparers handling both paper and electronic returns, a comprehensive IRS WISP should integrate both physical and technical safeguards.
2. Enhanced Employee Training: All employees should be trained on PII protection, incident response, and IRS WISP protocols specific to the filing method.
3. Prioritize Cybersecurity Investments: For those opting for electronic filing, prioritize investments in encryption, access control, and regular system updates.

Chapter 8: Conclusion

As tax preparers navigate PII protection requirements, selecting a filing method that aligns with their capabilities and risk tolerance is crucial. While paper filing may suit smaller firms with limited cybersecurity infrastructure, electronic filing offers enhanced efficiency and robust data security features. Regardless of the chosen method, adherence to IRS WISP standards ensures that tax preparers can uphold PII protection obligations effectively.

References

1. Internal Revenue Service. “Safeguarding Taxpayer Data.” Publication 4557.
2. Massachusetts Data Security Regulations, 201 CMR 17.00.
3. National Institute of Standards and Technology (NIST). "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations."