E-file security, privacy and business standards mandate

The IRS has mandated six  security, privacy, and business standards supplement the Gramm-Leach-Bliley Act to better serve taxpayers and protect their information collected, processed and stored by online providers of individual income tax returns. The first five standards continue to apply to online providers, while standard number 6, "Reporting of Security Incidents", is now mandated for all providers.

Individual income tax returns generally refer to the 1040 family of returns. Refer to IRS Publication 3112, IRS e-file Application and Participation PDF, for definition of online provider.

The security and privacy objectives of these standards are: setting minimum encryption standards for transmission of taxpayer information over the internet and authentication of web site owner/operator's identity beyond that offered by standard version SSL certificates; periodic external vulnerability scan of the taxpayer data environment; protection against bulk-filing of fraudulent income tax returns; and the ability to timely isolate and investigate potentially compromised taxpayer information.

These standards also address certain business and customer service objectives such as instant access to web site owner/operator's contact information, and online provider's written commitment to maintaining physical, electronic, and procedural safeguards of taxpayer information that comply with applicable law and federal standards.

Compliance with these standards is mandatory effective January 1, 2010. However, there will be a one-year enforcement grace period. The grace period expires December 31, 2010.

1. Extended validation SSL certificate

2. External vulnerability scan

Online providers of individual income tax returns shall contract with an independent third-party vendor to run weekly external network vulnerability scans of all their "system components" in accordance with the applicable requirements of the Payment Card Industry Data Security Standards (PCIDSS). All scans shall be performed by a scanning vendor certified by the Payment Card Industry Security Standards Council and listed on their current list of Approved Scanning Vendors (ASV). In addition, online providers of individual income tax returns whose systems are hosted shall ensure that their host complies with all applicable requirements of the PCIDSS.

For the purposes of this standard, "system components" is defined as any network component, server, or application that is included in or connected to the taxpayer data environment. The taxpayer data environment is that part of the network that possesses taxpayer data or sensitive authentication data.

If scan reports reveal vulnerabilities, action shall be taken to address the vulnerabilities in line with the scan report's recommendations. Retain weekly scan reports for at least one year. The ASV and the host (if present) shall be in the United States.

3. Information privacy and safeguard policies

This standard applies to authorized IRS e-file providers participating in online filing of individual income tax returns that own or operate a website through which taxpayer information is collected, transmitted, processed or stored. These providers shall have written information privacy and safeguard policies consistent with the applicable government and industry guidelines including the following statement: "we maintain physical, electronic and procedural safeguards that comply with applicable law and federal standards". In addition, providers' compliance with these policies shall be certified by a privacy seal vendor acceptable to the IRS.

4. Protection against bulk filing of fraudulent income tax returns

This standard applies to online providers of individual income tax returns that own or operate a website through which taxpayer information is collected, transmitted, processed or stored. These online providers shall implement effective technologies to protect their website against bulk filing of fraudulent income tax returns. Taxpayer information shall not be collected, transmitted, processed or stored otherwise.

5. Public domain name registration

This standard applies to online providers of individual income tax returns that own or operate a website through which taxpayer information is collected, transmitted, processed or stored. These online providers shall have their website's domain name registered with a domain name registrar that is in the United States and accredited by the Internet Corporation for Assigned Names and Numbers (ICANN). The domain name shall be locked and not be private.

6. Reporting of security incidents

Providers of individual income tax returns shall report security incidents to the IRS as soon as possible but not later than the next business day after confirmation of the incident. For the purposes of this standard, an event that can result in an unauthorized disclosure, misuse, modification, or destruction of taxpayer information (e.g., breach) shall be considered a reportable security incident.

Providers with multiple roles must follow instructions for submitting incident reports at Instructions for reporting security incidents.

Those that are EROs only must contact their local stakeholder liaison by following the instructions at Data theft information for tax professionals.

In addition, if the online provider's website is the proximate cause of the incident, the online provider shall cease collecting taxpayer information via their website immediately upon detection of the incident and until the underlying causes of the incident are successfully resolved.

Important notice:

In July 2007, the IRS issued an e-file rule requiring all authorized IRS e-file providers to submit to the IRS the Uniform Resource Locator (URL) of websites they own or operate through which taxpayer information is collected, transmitted, processed or stored. This requirement remains mandatory for all authorized IRS e-file providers. See instructions for submitting the URL information.

For additional information see the Frequently asked questions (FAQs).