IRS Publication 1075 Guide: Safeguarding Federal Tax Information

Any agency or contractor that receives federal tax information from the IRS must protect it to the standard set in IRS Publication 1075, and the IRS Office of Safeguards checks that it does. Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies, turns the safeguarding duties in Internal Revenue Code section 6103(p)(4) into physical, personnel and technical controls built on NIST SP 800-53 Rev. 5. It reaches state revenue, child support, benefits and workforce agencies, the federal bodies that receive return information, and every contractor, cloud provider and subcontractor that touches the data for them. This guide explains what the publication requires, how the Safeguard Security Report and review cycle work, where identity and non-human identity controls sit, and how to build evidence that survives a review. It is written for security leads, CISOs and compliance owners in agencies and for the vendors that serve them. Status was checked on irs.gov on 24 October 2026.

Key takeaways

• The current edition is Rev. 11-2021. The IRS Safeguards pages, reviewed in 2026, still point to the November 2021 revision; a 2026 revision has been published only as an early release draft marked not for filing.
• Report suspected incidents within 24 hours. Possible unauthorised inspection or disclosure of FTI goes to TIGTA and, at the same time, to the Office of Safeguards, without waiting for an internal investigation.
• The Safeguard Security Report is the contract. You need an approved SSR at least 90 days before receiving FTI and an annual update on a due date fixed by your agency group.
• MFA is required for every account that can reach FTI. Publication 1075 requires multi-factor authentication for privileged and non-privileged accounts at Authenticator Assurance Level 2.
• Contractors and cloud need advance notice. Agencies must notify the IRS 45 days before signing an agreement that gives a contractor access to FTI, and FTI may only be processed and stored in the United States and its territories.

What it is and who it applies to

Federal tax information (FTI) is federal tax returns and return information that an agency holds or controls and that is covered by the confidentiality rules of IRC section 6103. Publication 1075 treats FTI as Sensitive But Unclassified, notes that it may contain personally identifiable information, and makes clear that information derived from FTI is still FTI. An agency may not mask FTI to get around section 6103.

• Legal basis: IRC section 6103(p)(4) sets six safeguard conditions an agency must meet as a condition of receiving FTI. Publication 1075 organises its physical requirements against them: recordkeeping, secure storage, restricting access, other safeguards, reporting and disposal (sections 2.A to 2.F).
• Who it applies to: federal, state and local agencies that receive information from the IRS, plus their agents and contractors. Typical recipients are state tax departments, child support enforcement agencies, human services and benefits agencies, and federal agencies with statutory access.
• Who enforces it: the IRS Office of Safeguards reviews agencies, issues findings and tracks corrective actions. The Treasury Inspector General for Tax Administration (TIGTA) investigates unauthorised access and disclosure.
• Penalties: IRC section 7213 makes unauthorised disclosure a felony, section 7213A makes unauthorised inspection a misdemeanour punishable by fine, imprisonment or both, and section 7431 lets taxpayers sue for civil damages. These apply to individuals, which is why training and access lists matter so much.

Current status: the November 2021 revision superseded the 2016 edition and took effect six months after publication. In 2026 the IRS posted an early release draft of a new revision. According to its summary of changes, the draft adds tribal child support agencies, Taxpayer First Act section 2004 contractor requirements, definitions for artificial intelligence and cloud service provider, a new AI section, and a revised control set, and it records that the Secure Data Transfer programme was retired in December 2025. Until the IRS publishes the final revision, treat Rev. 11-2021 as the binding text and the draft as a signal of direction.

Structure and key requirements

Publication 1075 has four main parts and a set of exhibits. Section 4 is the largest: it restates NIST SP 800-53 Rev. 5 controls with IRS-specific parameters, so most technical questions are answered there.

Specific values worth knowing

Review findings are rated Limited, Moderate, Significant or Critical, and reviews may be on-site, remote or hybrid. The IRS also publishes Safeguard Computer Security Evaluation Matrices (SCSEMs), technology-specific test checklists that reviewers use and that agencies should run against their own systems before a review.

Identity and NHI requirements

Most FTI exposure happens through accounts, not through broken encryption. Publication 1075 has a strong human identity core, and the same controls must be applied to the service accounts, batch jobs, integration credentials and API keys that move FTI between systems.

• Multi-factor authentication: IA-2 requires MFA for all privileged and non-privileged accounts at AAL2 under NIST SP 800-63. Inventory every access path to FTI (VPN, VDI, web portals, database clients, cloud consoles) and confirm none bypasses MFA. See the MFA Guide.
• Need to know and the authorised access list: access must be limited to people whose duties require it, with the authorised access list reviewed monthly or after a security event or personnel change. Map this to AC-2 account management and AC-6 least privilege in your identity tooling, not a spreadsheet alone.
• Personnel screening: background investigations apply to employees and contractors with FTI access, with reinvestigation every five years in Rev. 11-2021 (PS-3). The 2026 draft says enrolment in the FBI Next Generation Identification service satisfies reinvestigation.
• Service accounts and integration credentials: nightly file transfers, matching programmes, data warehouse loads and report servers usually run under non-interactive accounts that cannot do MFA. Give each one a named owner, scope it to the specific FTI data sets, store its secret in a vault, rotate it, and log its use so you can show the reviewer that the exception is controlled. See the Service Account Security Guide and the Secrets Management Guide.
• Privileged administrators: database, storage and backup administrators can usually read FTI regardless of application roles. Put them on the authorised access list, require MFA, and record sessions where possible. See the Privileged Access Management Guide.
• AI tools: the 2026 draft adds an AI definition and a dedicated AI section. Until the final text is out, treat any AI assistant, copilot or agent that can read FTI as a system that needs SSR disclosure, an owner, scoped credentials and logging, and do not paste FTI into tools outside the approved boundary.

Implementation steps

1. Map the FTI data flow. Trace FTI from the IRS transfer mechanism into every system, file share, report, backup, printer and contractor environment. The Office of Safeguards confirms the data flow early in a review, so this map is the basis for everything else.
2. Define the boundary and label it. Decide which systems are in scope, separate FTI from other data where you can, and remove copies you do not need. Fewer FTI systems means fewer SCSEMs to pass.
3. Build the account and credential inventory. List every human and non-human account that can reach in-scope systems, with owner, purpose, privilege level, MFA status and last use. Reconcile it against the authorised access list.
4. Close identity gaps first. Enforce MFA on all interactive access, vault and rotate service account secrets, disable dormant accounts and remove shared logins. These are the findings reviewers raise most often and the controls attackers abuse first.
5. Run the SCSEMs yourself. Download the current SCSEM package for each in-scope technology, test in a non-production copy first, record results and fix failures before the review. Keep a rollback plan for hardening changes that break batch jobs.
6. Notify before you change. Send 45-day notifications before contractor agreements and follow the publication's notification requirements for new technologies such as cloud. Do not move FTI first and notify later.
7. Write and submit the SSR. Describe each control as implemented, attach supporting evidence mapped to SSR responses, obtain the Head of Agency certification, and submit by your group due date.
8. Exercise incident reporting. Run the annual tabletop with the TIGTA and Office of Safeguards contacts, and confirm staff know the hotline numbers, the mailbox and that reports must not contain FTI. See the Tabletop Exercise Guide.

Decision guidance: on-premises, cloud or contractor

• On-premises: fewest notifications, but you carry the physical controls (two barriers, visitor logs, media disposal) yourself.
• Cloud: shifts physical controls to the provider, but FTI must stay in the United States and its territories, the provider's personnel with FTI access fall under the same requirements, and you must notify the IRS in advance. Check whether the provider's authorisation and contract language cover Publication 1075 obligations before you design anything. See the FedRAMP Guide.
• Contractor processing: needs statutory authority to re-disclose, a 45-day notice, Exhibit 7 contract language, US-location certification for staff and systems, and removal of data within 7 calendar days of termination.
• Small agencies: often benefit most from shrinking the boundary, for example by keeping FTI in one system and exporting only non-FTI results. Large agencies with many programmes should run one FTI identity inventory across programmes rather than one per programme.

Evidence and assessment

A Safeguard review tests what you said in the SSR. Treat the SSR as a living document, as the IRS describes it, and keep evidence current all year.

Submit through the IRS-designated secure channel or the [email protected] mailbox and reuse the accepted template returned with last year's acceptance letter. The IRS notes there is no SSR waiver process and that notifications are separate from the SSR.

Detection and measurement

• What to log: authentication to every in-scope system, queries and exports against FTI tables, privileged sessions, service account use from unexpected hosts, and transfers out of the boundary (AU-6 review).
• Metrics: percentage of FTI accounts with MFA (target 100 per cent); service accounts with a named owner and rotated secret; days from leaver to account disablement; open CAP items past due; SCSEM pass rate per technology; time from detection to TIGTA report in exercises (target well under 24 hours).

Mapping to other frameworks

Because section 4 is built on NIST SP 800-53 Rev. 5, controls you already run for FISMA or FedRAMP usually transfer, but Publication 1075 sets its own parameters and adds tax-specific duties. See the NIST SP 800-53 Guide.

Criminal justice agencies that also hold CJIS data, and state systems assessed under state cloud programmes, should map once and reuse evidence, while keeping the stricter parameter where two programmes differ.

Common pitfalls

• Delaying the report to investigate: the publication says not to wait for an internal investigation. Teams that try to confirm scope first miss the 24-hour window.
• FTI that leaks out of the boundary: extracts in shared drives, test databases loaded with live data, email attachments and reports printed to unprotected multifunction devices. The data flow map is the cure.
• Service accounts treated as out of scope: a file transfer or ETL account with broad database rights and a password unchanged for years is a common finding and a common attack path. Valid account abuse (MITRE ATT&CK T1078) needs no exploit.
• Third-party remote access not governed: support tools and vendor connections can reach systems that hold sensitive government data. In the BeyondTrust breach at the US Treasury, a stolen API key for a remote support service gave an attacker access to Treasury workstations. Include support platforms and their keys in the FTI boundary. See the Third-Party Access Guide.
• Cloud or contractor moves without notice: moving FTI to a new provider or contractor before notifying the IRS creates a finding before any control is tested.
• Stale SSR: copying last year's text without recording environment changes. Reviewers compare the SSR with what they find.

Practitioner checklist

• Confirm which revision of Publication 1075 applies and track the 2026 draft for changes to your controls.
• Maintain a current FTI data flow map covering systems, backups, printers, contractors and cloud.
• Enforce MFA at AAL2 on every interactive path to FTI and document any non-interactive exceptions.
• Inventory service accounts and API keys with FTI access; assign owners, vault secrets and rotate them.
• Review the authorised access list monthly and disable leavers the same day.
• Run the current SCSEMs before each review and fix failures in a tested change window.
• Send 45-day notifications before contractor agreements and confirm US-only processing.
• Publish the TIGTA and Office of Safeguards contacts in the incident plan and exercise the 24-hour report annually.
• Submit the SSR update by your group due date with Head of Agency certification.
• Track CAP items to closure with evidence and report semi-annually.

Standards and references

• IRS: Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies
• IRS: Safeguards Program
• IRS: Safeguard Security Report
• IRS: 45 Day Notifications
• IRS: Computer Security Compliance References and Related Topics (SCSEMs)
• IRS: Publication 1075 early release draft (2026 revision)
• NIST: SP 800-53 Rev. 5
• MITRE ATT&CK: Valid Accounts

This guide summarises IRS Publication 1075 as published on irs.gov at 24 October 2026 and is not legal advice. Related NHI Mgmt Group resources: NIST SP 800-53 Guide · FedRAMP Guide · Service Account Security Guide · Incident Response Guide · Identity Security Regulatory Map