IRS Publication 4557 checklist for outsourced teams

The June 2024 revision tells practitioners to implement multi-factor authentication for anyone accessing customer information, encrypt sensitive files and emails, install anti-malware software on all devices and back up sensitive data to a secure external source that is not connected full time to a network.

It also points to Publication 5708 for building a written information security plan and tells firms to report data theft or loss to the appropriate IRS Stakeholder Liaison.

Copy each recommendation into your outsourcing agreement as a requirement, and ask for evidence: MFA screenshots, endpoint software lists and backup test records. Put a named contact on the vendor side who must tell you about an incident the same day.

• Which devices will touch client data, and who manages them?
• How are backups kept offline, and when were they last restored?
• Who on the vendor side reports incidents to you?

Every PDF emailed to a provider is one more copy to encrypt, back up and eventually delete. Letting the outsourced team work inside the client’s HelloBooks books, with role-based access and an audit trail, keeps most of that data in one place.