Protect Federal Tax Information and meet IRS 1075 with less effort

IRS Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies, is the IRS rulebook for protecting Federal Tax Information (FTI). It explains how agencies meet the safeguarding requirements of Internal Revenue Code § 6103(p)(4), covering recordkeeping, secure storage, restricted access, reporting, disposal and a tailored set of NIST SP 800-53 Revision 5 security and privacy controls. The current edition is Rev. 11-2021.

Any federal, state or local agency that receives FTI from the IRS or a secondary source must comply, as a condition of receiving the data. The requirements also flow down to contractors and sub-contractors that access FTI on an agency's behalf, such as IT outsourcers, cloud providers and print or mail vendors, usually through the safeguarding contract language set out in Exhibit 7 of the publication.

Unauthorised disclosure of FTI is a felony under IRC § 7213, punishable by a fine of up to $5,000, up to five years in prison, or both. Unauthorised inspection is a misdemeanour under IRC § 7213A, with a fine of up to $1,000, up to one year in prison, or both. Taxpayers can also sue for civil damages under IRC § 7431, and the IRS can suspend or terminate an agency's access to FTI.

There is no certificate for Publication 1075. Agencies demonstrate compliance by submitting an annual Safeguard Security Report (SSR) to the IRS Office of Safeguards, running internal inspections, and undergoing safeguard reviews, which can be on-site, remote or hybrid. Findings are documented in a Safeguard Review Report and tracked through a Corrective Action Plan (CAP), which agencies update and submit semi-annually.

Section 4.0 of Publication 1075 is built on NIST SP 800-53 Revision 5. It selects controls across 20 control families, such as access control, audit and accountability, and incident response, and adds IRS-defined parameters and requirements specific to FTI. Organisations already aligned to NIST 800-53 or FedRAMP will find much of the technical work overlaps, but still need to meet the IRS-specific values and the physical and reporting requirements.

IRS 1075 is a mandatory US government requirement tied to a specific data type, FTI, while ISO 27001 is a voluntary certifiable standard and SOC 2 is an attestation report. Many controls overlap, including access control, logging, encryption, training and incident response, so evidence for one can support the others. However, neither ISO 27001 nor SOC 2 satisfies Publication 1075 on its own, because of its IRS-specific parameters and reporting duties.

Agencies must report a possible improper inspection or disclosure of FTI immediately, and no later than 24 hours after discovery, to both the Treasury Inspector General for Tax Administration (TIGTA) and the IRS Office of Safeguards. Section 1.8 of Publication 1075 sets out the notification process, and agencies must also test their incident response capability annually, for example through tabletop exercises.

IRS Publication 1075 is mapped in OneClickComply's control library and is available on request. Its requirements map to controls you may already run for ISO 27001, SOC 2 or NIST frameworks, so automated evidence, policies and monitoring can be reused. Get in touch to discuss adding it to your workspace. OneClickComply does not issue IRS approvals; the IRS Office of Safeguards assesses compliance.