IRS Publication 1075 Guide: Protecting Federal Tax Data

Introduction: What is IRS Publication 1075?

IRS Publication 1075, officially titled Tax Information Security Guidelines for Federal, State and Local Agencies, is a comprehensive security standard issued by the Internal Revenue Service. It establishes strict managerial, operational, and technical security safeguards that outside government agencies and their contractors must implement when handling confidential federal tax data.

Under federal law, the IRS often shares tax returns and return information with other government entities—such as state departments of revenue, child support enforcement programs, and public assistance agencies—to help verify program eligibility or enforce state tax laws. However, this data sharing comes with a legal mandate: any agency that receives this sensitive data must protect it with the same rigorous security standards used by the IRS itself.

Publication 1075 provides the complete compliance roadmap for safeguarding this information. It bridges federal tax law with modern cybersecurity standards, ensuring that citizen tax records remain protected against data breaches, unauthorized snooping, and cyberattacks.

Who Should Read This Publication?

Unlike standard tax booklets written for individual taxpayers, Publication 1075 is an institutional security manual. The primary audience includes:

• State and Local Government Agencies: Departments of Revenue, health and human service administrators, Medicaid agencies, and child support enforcement offices that receive IRS data.
• Federal Partner Agencies: Federal departments, such as the Department of Health and Human Services or the Social Security Administration, that receive federal tax information under statutory agreements.
• Government Contractors and Cloud Providers: Third-party IT vendors, cloud service providers (CSPs), software developers, and consultants who design, manage, or host systems processing tax data.
• Chief Information Security Officers (CISOs) and Auditors: IT directors, security architects, compliance officers, and internal auditors responsible for building and verifying secure computing environments.
• Cybersecurity and Privacy Students: Learners studying how regulatory frameworks translate federal privacy laws into practical technical controls.

Key Topics Covered in Publication 1075

Publication 1075 covers all facets of data protection, aligning closely with National Institute of Standards and Technology (NIST) guidelines. Key topics include:

• Statutory Confidentiality Provisions: The legal framework under Internal Revenue Code Section 6103 and the civil and criminal penalties for unauthorized data disclosure.
• Technical Access Controls: Rules regarding user identification, password complexity, multi-factor authentication, and role-based permissions.
• Physical and Environmental Security: The physical protections required for buildings, server rooms, and paper records, including the “two-barrier” rule.
• Data Encryption and Media Sanitization: Standards for encrypting data at rest and in transit, as well as procedures for securely destroying digital and paper records.
• Personnel Security: Requirements for background investigations, employee fingerprinting, and annual disclosure awareness training.
• Compliance Monitoring and Audits: Reporting obligations such as Safeguard Security Reports (SSRs) and on-site triennial audits conducted by the IRS Office of Safeguards.

Detailed Breakdown of Main Concepts

1. Defining Federal Tax Information (FTI) and IRC Section 6103

At the center of Publication 1075 is a specialized category of data known as Federal Tax Information (FTI). FTI consists of any tax return or return information received directly from the IRS or through an authorized secondary source. This includes names, addresses, Social Security Numbers, reported income, deductions, tax liabilities, and audit status.

Internal Revenue Code Section 6103 mandates that federal tax returns and return information are strictly confidential by law. Unauthorized inspection (often called “snooping”) or unauthorized disclosure of FTI is a federal crime punishable by fines, imprisonment, and immediate termination of employment, in addition to civil damages.

2. The NIST Security Controls Baseline

Publication 1075 aligns its technical requirements with the NIST Special Publication 800-53 security controls, specifically tailored to a “Moderate” impact baseline. This alignment ensures that government agencies follow proven cybersecurity best practices.

Agencies must implement comprehensive system access controls, strict session timeouts, and continuous security monitoring. Furthermore, systems must maintain detailed audit trails that track whenever FTI is accessed, modified, exported, or deleted, allowing investigators to trace any unauthorized activity.

3. Strict Encryption and Cryptographic Standards

Protecting data while it moves across networks and while it sits on hard drives is a core requirement of Publication 1075. Agencies are required to use cryptographic tools that comply with Federal Information Processing Standards (FIPS 140-2 or FIPS 140-3).

All FTI must be encrypted at rest (on servers, databases, and portable media) and encrypted in transit across networks using modern transport layer security protocols. Plaintext transmission of tax information over open networks or unencrypted emails is strictly prohibited.

4. Physical Security and the “Two-Barrier Rule”

Cybersecurity is only half the battle; physical access must be just as tightly guarded. Publication 1075 requires agencies to establish a secure perimeter around any physical area where FTI is handled or stored, whether in paper form or on digital servers.

A central requirement is the “Two-Barrier Rule.” FTI must be protected by at least two distinct physical barriers to prevent unauthorized entry. For example, paper files might be locked inside a heavy file cabinet (barrier one) that sits inside a locked office with card-key access (barrier two). Data centers housing FTI servers similarly require perimeter building security combined with biometric or keycard-locked server cages.

5. Personnel Screening and Awareness Training

Because insider threats pose a significant risk to confidential data, Publication 1075 establishes strict personnel vetting rules. Every employee, contractor, or intern who may have access to FTI must undergo an extensive background investigation prior to receiving system access.

This vetting includes FBI fingerprint background checks, local law enforcement checks, and verification of citizenship or legal residency. In addition, all personnel must complete certified FTI disclosure awareness training upon hiring and once every year thereafter, signing an acknowledgment that they understand the criminal penalties for data misuse.

6. Incident Response and Mandatory Breach Reporting

Publication 1075 requires every participating agency to maintain a documented incident response capability. If an agency experiences a confirmed or suspected security breach involving FTI—or if an employee inspects a tax record without a business need—the agency must act immediately.

The agency is legally required to notify the Treasury Inspector General for Tax Administration (TIGTA) and the IRS Office of Safeguards within 24 hours of discovering the incident. The agency must then provide ongoing status reports detailing containment, remediation, and corrective actions taken.

Practical Examples and Scenarios

Scenario 1: State Child Support Enforcement Agency

A state child support agency receives wage and tax data directly from the IRS to locate non-custodial parents and verify their income. To comply with Publication 1075, the agency restricts access to this data so that only caseworkers assigned to those specific active cases can view the tax records.

The agency configures its computer network to log every time a worker views a case file, enforces multi-factor authentication, and automatically locks screens after 15 minutes of inactivity. When a caseworker prints a report containing FTI, it must be stored in a locked drawer inside a badge-access office to satisfy the two-barrier rule.

Scenario 2: Cloud Modernization for a State Revenue Department

A state department of revenue decides to migrate its core tax processing system to a commercial cloud provider. Under Publication 1075, the agency cannot simply purchase standard commercial cloud hosting.

The agency must select a cloud service provider that meets government security baselines, sign a specialized contract rider acknowledging IRS safeguard rules, and ensure that all FTI is encrypted using FIPS-validated keys managed solely by the state. Most importantly, all physical servers, system backups, and technical support personnel must reside entirely within the borders of the United States.

Comparison: FTI Protection Controls at a Glance

Security Domain	Publication 1075 Requirement	Practical Application
Physical Storage	Two-barrier protection rule	Locked safe inside a locked, badge-access room
Data Encryption	FIPS-validated cryptographic modules	End-to-end encryption for stored databases and network transit
Personnel Vetting	Comprehensive background checks	FBI fingerprint checks and re-investigations every 5 years
Breach Reporting	Mandatory 24-hour escalation	Immediate notification to TIGTA and IRS Safeguards
Data Location	Strict offshore restrictions	No foreign hosting, routing, or offshore IT support allowed

How This Publication Relates to Specific Forms and Documents

Publication 1075 connects with several key administrative documents, reporting templates, and legal statutes:

• Safeguard Security Report (SSR): An annual comprehensive report that agencies must submit to the IRS Office of Safeguards describing their current security posture, system architecture, and planned changes.
• Form 14607 (Information for Safeguard Reviews): A detailed questionnaire that agencies complete before the IRS conducts an on-site security inspection.
• Form 14757 (Safeguard Review Finding and Corrective Action Plan): The official corrective action plan (CAP) used by agencies to document how they resolve security weaknesses identified during an IRS audit.
• Internal Revenue Code Sections 7213, 7213A, and 7431: The federal statutory provisions that impose felony criminal penalties, misdemeanor snooping penalties, and civil financial damages for unauthorized FTI inspection or disclosure.
• NIST Special Publication 800-53: The federal government security control catalog that forms the technical foundation for the publication’s standards.

Common Misunderstandings Clarified

Because Publication 1075 involves complex institutional regulations, common misconceptions frequently arise:

• “Publication 1075 is a guide for filing personal tax returns.” This publication has nothing to do with tax deductions or individual return preparation. It is strictly an enterprise cybersecurity and compliance manual for government agencies.
• “All data collected by a state tax agency is FTI.” Only data that originates from the IRS or is verified through IRS sources is considered Federal Tax Information. Tax returns filed directly by a taxpayer with a state revenue agency are governed by state privacy laws, though many states choose to apply Publication 1075 rules to all records.
• “Agencies can outsource technical support to international vendors.” Under Publication 1075, off-shoring FTI is strictly forbidden. All data centers, backup facilities, system administrators, and help-desk personnel with access to FTI must be located physically within the United States.
• “Commercial off-the-shelf security is automatically sufficient.” Standard commercial security setups often fall short of Publication 1075 standards. Requirements like two-barrier physical security, strict FIPS cryptographic validation, and specialized background checks go far beyond standard commercial practices.

Why This Publication Matters for Taxpayers

For the average American, the federal tax return is one of the most revealing financial documents in existence. It discloses your income, employer, dependents, investments, charitable gifts, and medical circumstances. If this information were leaked or stolen, taxpayers would face severe risks of identity theft and financial fraud.

Publication 1075 matters because it serves as the primary federal safeguard protecting your confidential data once it leaves the IRS. By holding state agencies, federal partners, and private contractors to strict security standards, it ensures that your private financial life remains confidential and safe from misuse.

Frequently Asked Questions

What is the penalty for an employee who snoops on tax records?

Under IRC Section 7213A, unauthorized inspection of tax return information is a federal misdemeanor punishable by up to one year in prison, a $1,000 fine, and immediate termination of employment. If the employee willfully discloses the information, IRC Section 7213 elevates the crime to a felony with up to five years in prison and a $5,000 fine.

How often does the IRS conduct on-site inspections of agencies?

The IRS Office of Safeguards conducts on-site or virtual safeguard reviews of recipient agencies once every three years. Agencies must also submit an updated Safeguard Security Report (SSR) annually.

Can government agencies store Federal Tax Information in the cloud?

Yes, but only if the cloud environment meets rigorous conditions. The cloud service provider must satisfy NIST Moderate requirements, use FIPS-validated encryption, ensure data is stored solely in the United States, and permit the IRS to audit the environment.

What should an agency do if an employee loses a laptop containing FTI?

The agency must immediately enact its incident response plan, notify local agency security teams, and report the incident to both TIGTA and the IRS Office of Safeguards within 24 hours of discovery.

Does Publication 1075 apply to private companies?

It applies to private companies only if they act as contractors, service providers, or software vendors for a government agency that processes or stores FTI. In those cases, the contract must include mandatory IRS safeguard language binding the company to Publication 1075 rules.

What is media sanitization under Publication 1075?

Media sanitization refers to the complete, irreversible destruction of FTI stored on physical or electronic media. Hard drives must be degaussed or physically shredded, and paper records must be incinerated or cross-cut shredded to specifications that prevent document reconstruction.

Conclusion: Key Takeaways

IRS Publication 1075 is the authoritative data protection standard for agencies handling federal tax data. When reviewing its requirements, keep these central points in mind:

• Internal Revenue Code Section 6103 requires absolute confidentiality for Federal Tax Information (FTI) shared with outside government bodies.
• Technical systems handling FTI must implement the NIST SP 800-53 Moderate security control baseline, including multi-factor authentication and detailed audit logging.
• All electronic FTI must be encrypted at rest and in transit using FIPS-validated cryptographic modules.
• Physical storage must follow the strict two-barrier protection rule to safeguard data against unauthorized entry.
• All personnel handling FTI must pass comprehensive background checks, complete annual security training, and immediately report data breaches to TIGTA and the IRS within 24 hours.