IRS Publication 1075 - Tax Information Security Guidelines
IRS requirements for safeguarding Federal Tax Information (FTI). Applies to all agencies, contractors, and agents receiving FTI from the IRS.
What IRS Pub 1075 draws on
This framework pulls on all three pillars — which is why running them as three separate tools means reconciling three sets of evidence at audit time.
Compliance
Security
What your auditor cites,
and what produces the evidence
The regulator's text is quoted below in italic, exactly as written. What follows each one is what the platform records, detects, or proves — not a claim about your compliance status, which no tool can confer.
Audit Events
Systems processing FTI MUST audit successful and unsuccessful system access attempts and account management events.
Authorisation is configured in the database; proving it holds is what this requirement actually needs. Vulnerability scanning surfaces excessive privilege and role sprawl, default and weak credentials, and stale or orphaned accounts — including privilege inherited through nested roles, which is where least-privilege reviews usually go wrong. Real-time SQL auditing then shows which of those grants were exercised, so an access review reflects observed use rather than intent.
Content of Audit Records
Audit records MUST contain: type of event, when occurred, where occurred, source of event, outcome, and identity.
A record of processing is only as good as the layer producing it. Real-time SQL auditing captures every statement against the data — the identity, the session, the client, the objects touched, the outcome — with no nightly batch window where activity goes unrecorded. Classification is what makes that a record of *regulated* data rather than a log of everything: it tells you which tables are in scope, so the register describes the processing you actually have to declare. Policy templates then produce it in the shape the framework asks for, instead of leaving you to assemble it from raw logs the week before an inspection.
Audit Review and Reporting
Organization MUST review and analyze audit records weekly for unusual, unexpected, or suspicious activity.
Rules catch what you already thought of. Behavioural models baseline every user and application against their own history and their peer group, then score deviations in real time — so a service account reading tables it has never touched surfaces without anyone having written a rule for it first. That is what makes monitoring hold up as access patterns change, instead of decaying into a ruleset nobody maintains.
Protection of Audit Information
Audit records containing FTI MUST be protected from unauthorized access and retained for 7 years.
A requirement like this is about the record surviving the person who would rather it did not, which means the audit trail has to be protected as carefully as the data. File activity monitoring hashes the datafiles, the transaction logs, the backups, and the audit trail itself with XXH3, then baselines them — so an alteration or a deletion is evident rather than inferred, and it is attributed to the session and OS user behind it. Because the same platform holds the query trail, a destructive statement and the file-level change it produced are two views of one event rather than two investigations.
What IRS Pub 1075 covers
IRC Sec. 6103(b), applied by Publication 1075
Federal tax information — returns and return information received from the IRS or from a secondary source.
In scope
- Returns and return information
- Taxpayer identity, income, payments and assessments
- Anything the IRS derived from a return
- Any data created by the agency FROM federal tax information
What falls outside
Information the agency obtained independently of the IRS is not FTI, even where it is identical in content. Provenance decides it, not the value.
The derived-data rule is what surprises agencies: a report built from FTI is itself FTI, so the safeguards travel into every downstream system rather than stopping at the intake.
IRS Publication 1075 · as at 2026-08
How IRS Pub 1075 is enforced
Every figure below is the ceiling the instrument publishes about itself, not a prediction of what anything would cost. Enforced by The IRS Office of Safeguards, with prosecution by the Department of Justice.
Publication 1075 is unusual in this list because the sanction lands almost entirely on people. Disclosure of federal tax information without statutory authority is a felony; inspection without authority is a separate misdemeanour. Conviction carries mandatory dismissal for a federal officer or employee, and the taxpayer can sue for damages separately.
Unauthorised disclosure includes disclosure through gross negligence, not only deliberate acts.
Who is personally on the hook
- Who can be charged
- Any officer, employee, or contractor of an agency that receives federal tax information
- For what
- disclosing federal tax information without statutory authority, including through gross negligence — and separately, inspecting it without authority
- Maximum
- Disclosure: a felony carrying up to USD 5,000, 5 years, or both, plus mandatory dismissal from office on conviction. Inspection: a misdemeanour carrying up to USD 1,000 and 1 year, also with dismissal
- Brought by
- The US Department of Justice
- Provision
- 26 U.S.C. Sec. 7213 and Sec. 7213A
Uncapped exposure that sits outside this instrument
These come from company law rather than from IRS Pub 1075, and they are not penalties — they are liability for a loss, which is why nothing caps them at a published maximum.
Duty of oversight
Delaware, and followed in most US corporate jurisdictions. It is a rule of company law, not of any privacy or security statute.
Triggered by. A sustained or systematic failure by the board to establish a reporting system for a mission-critical risk — or, having one, consciously disregarding what it reported. The second limb is what a documented, unremediated finding goes to.
Who. Directors, in their personal capacity, in a derivative action brought on behalf of the company.
This is liability for the loss the company suffered, not a statutory penalty, so nothing caps it at a published maximum. A bad-faith finding also takes the conduct outside the exculpation and indemnification the charter would otherwise provide.
In re Caremark Int’l Deriv. Litig. (Del. Ch. 1996); Marchand v. Barnhill (Del. 2019); In re Boeing Co. Deriv. Litig. (Del. Ch. 2021).
Who the instrument makes accountable
Publication 1075 requires an agency to designate an official responsible for safeguards and to file a Safeguard Security Report. Conviction under 26 U.S.C. Sec. 7213 carries mandatory dismissal, so the sign-off and the consequence attach to the same person.
The insurance position
Criminal exposure here is never insurable and never indemnifiable. Public-entity policies commonly cover notification and remediation costs after an unauthorised disclosure.
How this class of policy is commonly written. Only your own policy answers what it covers.
Enforcement data reviewed August 2026. Several figures are indexed annually and move.
Built for IRS Pub 1075,
not configured for it afterwards
Federal Tax Information Monitoring
Track all access to databases containing FTI
IRS 1075 Audit Report
7-year compliant audit trail with weekly review evidence
FTI Data Patterns
Detect SSN, EIN, and federal tax information
FTI Access Anomaly Detection
Alert on suspicious access patterns to tax data
Other Government frameworks
Walk into the IRS Pub 1075 audit knowing the answer
228 cited requirements across 57 frameworks are mapped to the controls that evidence them. A fixed-fee gap assessment tells you which of them you can already prove today.