- ClassificationCategoryData Protection & PrivacyDomainPrivacyFramework FamilyOther
- Regulatory ContextTypeGuidanceLegal InstrumentGuidanceSectorGovernment SectorIndustryGovernment & Public Sector
- Region / PublisherRegionNorth AmericaRegion DetailUnited StatesPublisherInternal Revenue Service, Office of Safeguards
- VersioningVersionRev. 11-2021 (supersedes November 2016)Effective DateSix months after publication of Rev. 11-2021 (the publication states no calendar date)Issue DateNovember 2021 (Rev. 11-2021)
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
Publication 1075 is a U.S. government publication. It is free to download from IRS.gov.
Framework text is licensed by its publisher and is included only where stated above.
- IRS Publication 1075 (Rev. 11-2021) sets the safeguard requirements for Federal Tax Information held by agencies and their contractors.
- Conforming to it meets the safeguard requirements of IRC section 6103(p)(4), a condition of receiving FTI.
- It applies to any agency, agent, contractor, or subcontractor that legally receives FTI, whatever the amount or medium.
- Unauthorized disclosure is a felony under IRC section 7213, unauthorized inspection a misdemeanor under section 7213A.
- The IRS has posted an early-release draft, Rev. 12-2026, that would supersede the current edition once final.
Overview
IRS Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies (Rev. 11-2021), is the Internal Revenue Service Office of Safeguards' set of requirements for protecting Federal Tax Information (FTI). Agencies and their contractors must meet it as a condition of receiving FTI under Internal Revenue Code (IRC) § 6103, and the IRS states that conforming to it meets the safeguard requirements of IRC § 6103(p)(4). Rev. 11-2021 supersedes the November 2016 edition and takes effect six months after publication. The IRS has posted an early-release draft, Rev. 12-2026, that would supersede it once final.
The publication applies to any agency, agent, contractor or sub-contractor that legally receives FTI from the IRS or from a secondary source such as the Social Security Administration under IRC § 6103 or an IRS-approved exchange agreement. It covers all FTI, whatever the amount or the medium, and it applies to consolidated data centers and contractors with access to FTI. Unauthorized disclosure is a felony under IRC § 7213, unauthorized inspection is a misdemeanor under IRC § 7213A, and IRC § 7431 provides civil damages to the taxpayer.
The publication has four main parts: Section 1.0 on FTI, reviews and other requirements, Section 2.0 on physical security organized by the six safeguard areas of IRC § 6103(p)(4), Section 3.0 on cybersecurity requirements, and Section 4.0 with the NIST SP 800-53 Revision 5 security and privacy controls and IRS-defined parameters. Agencies show compliance through the annual Safeguard Security Report (SSR), safeguard reviews and the Corrective Action Plan (CAP).
Why does it matter?
Publication 1075 ties the receipt of FTI to demonstrated safeguards: the receiving agency must show, to the satisfaction of the IRS, the ability to protect the confidentiality of the information, and the IRS checks it through reports and reviews (Section 1.1). Rules about incident reporting, contractors and location are specific and time-bound.
Key benefits include:
- Criminal and civil exposure
IRC §§ 7213, 7213A and 7431 attach felony, misdemeanor and civil damages consequences to unlawful disclosure or inspection (Introduction).
- A 24-hour incident clock
A possible improper inspection or disclosure of FTI is reported to the Treasury Inspector General for Tax Administration (TIGTA) immediately and no later than 24 hours after identification, and to the Office of Safeguards at the same time (Sections 1.8.2 and 1.8.3).
- 45 days of advance notice
Cloud computing, disclosure to a contractor, re-disclosure to a sub-contractor, tax modeling and use of FTI in pre-production need notification at least 45 days before implementation (Section 2.E.6, Table 6).
- FTI stays onshore
FTI cannot be accessed by personnel outside the United States, received, processed or stored on offshore systems, or sent offshore for disposal (Section 2.C.7).
- Fixed review cycles
The SSR is updated every year, headquarters and contractor facilities are inspected at least every 18 months and field offices at least every three years (Sections 2.E.4.3 and 2.D.3).
How does it work?
An agency requests FTI under the IRC § 6103 provision that authorizes it, and may use it only for that authorized use (Sections 1.1 and 1.2). It sends an SSR to the Office of Safeguards at least 90 days before the scheduled or requested receipt of FTI, then updates the SSR annually on the due dates in Table 4 (Sections 1.1, 2.E.4.3 and 2.E.4.4). The request and any agreement are kept for at least five years.
The Office of Safeguards reviews agencies on site, remotely or in a hybrid form (Section 1.6). After a review the agency receives a Safeguard Review Report with a Corrective Action Plan, updates the CAP semi-annually until findings are closed, and submits a mitigation plan within seven days of the closing conference for any critical finding (Sections 1.6.3 and 2.E.5). The cybersecurity assessment uses Safeguards Computer Security Evaluation Matrices and reviews the agency's FTI inventory (Section 3.2).
Physical and organizational safeguards follow IRC § 6103(p)(4): recordkeeping (2.A), secure storage (2.B), restricting access (2.C), other safeguards such as training and internal inspections (2.D), reporting (2.E) and disposal (2.F). Technical controls in Section 4.0 follow NIST SP 800-53 Revision 5, with values the IRS defines, and Section 3.3 adds technology-specific rules such as cloud computing.
Key Elements
- FTI and authorized use (Sections 1.1, 1.2 and Key Definitions)
Federal tax returns and return information, used only for the purpose of the IRC § 6103 provision that authorized the disclosure.
- Reviews and reports (Sections 1.6, 2.E.4 and 2.E.5)
Annual SSR, safeguard reviews, Safeguard Review Report and Corrective Action Plan.
- Incident reporting (Section 1.8)
A written incident policy, TIGTA contact within 24 hours, a data incident report to Safeguards and notice to impacted individuals.
- Contractors (Sections 1.9.4 and 2.E.6.2)
Notice before disclosure to a contractor, written approval for sub-contractors, and privacy requirements in contracts and agreements.
- Physical security (Sections 2.A to 2.C)
FTI logs, minimum protection standards, restricted areas, visitor logs, authorized access lists and offshore restrictions.
- Personnel (Sections 2.C.3 and 2.D.2)
Favorably adjudicated background investigation with FBI fingerprinting before access, reinvestigation within five years for state agencies, and initial and annual disclosure awareness training.
- Cybersecurity and disposal (Sections 3.0, 4.0 and 2.F)
NIST SP 800-53 Revision 5 controls, FedRAMP-authorized cloud only, and destruction of FTI by burning or shredding and media sanitization.
What does it cover?
Publication 1075 applies to federal, state and local agencies, and to agents, contractors and sub-contractors where federal statute allows, that receive FTI. All IT systems and components that receive, access, store, process, protect or transmit FTI are in scope, including contractor systems, networking components and cloud environments (Section 3.2). The same protection applies to FTI on paper and in electronic form (Introduction).
What are its objectives?
The Introduction states the purpose: protect the confidentiality of FTI so the public keeps confidence in the tax system. Its provisions pursue these outcomes:
FTI is used only for the authorized purpose and disclosed only to authorized persons (Sections 1.1 and 1.2).
Agencies show their safeguards to the IRS through the SSR and safeguard reviews (Sections 1.6 and 2.E).
Improper inspections and disclosures are reported without delay (Section 1.8.2).
Contractors and cloud providers receive FTI only after notice to the IRS (Section 2.E.6).
Systems that hold FTI meet NIST SP 800-53 Revision 5 controls as the IRS defines them (Section 4.0).
Framework in Context
Publication 1075 implements the safeguard requirements of IRC § 6103(p)(4). Rev. 11-2021 adapts NIST SP 800-63 digital identity requirements and Treasury Directive 85-01 requirements, shown as IRS-defined parameters in Section 4.0. The Office of Safeguards is responsible for all interpretations and may supplement or modify requirements between editions through guidance posted on its website. The draft Rev. 12-2026 is posted as an early-release draft and is not for reliance until published.
Common Framework Mappings
Section 4.0 of Publication 1075 is built on NIST SP 800-53 Revision 5, so mappings to NIST SP 800-53 are direct, with IRS-defined parameter values. The other frameworks below are control-level aids. The Office of Safeguards assesses compliance through its own reviews (Section 3.2), so a mapping does not replace them.
Mapped frameworks include:
CIS Controls
COBIT
FedRAMP
FISMA
HIPAA
ISO/IEC 27001
NIST Cybersecurity Framework
NIST SP 800-53
PCI DSS
SOC 2
How SmartSuite Supports IRS Pub 1075
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Compliance Management, IT Asset Management (ITAM), Third Party Risk Management, Cyber & IT Risk and Internal Audit Management to hold the FTI inventory, personnel and training records, contractor notifications, incident reports, inspection plans, the SSR and the CAP that Sections 1 to 3 require. SmartSuite records the agency's own safeguard program; it does not change where an agency may host FTI under Section 3.3.1.
FTI System Inventory
Record every system, component, contractor environment and location that receives, accesses, stores, processes or transmits FTI (Section 3.2).
Authorized Use and FTI Logs
Keep the IRC § 6103 authority, the authorized purposes and the receipt logs required for the SSR (Sections 1.2 and 2.A.2).
Personnel Access and Training
Track background investigations, the five-year reinvestigation and initial and annual disclosure awareness training (Sections 2.C.3 and 2.D.2.1).
45-Day Notification Tracker
Log cloud, contractor, sub-contractor, tax modeling and pre-production notifications with the planned date and approval status (Section 2.E.6).
Incident Reporting
Run each incident through the TIGTA 24-hour contact, the Office of Safeguards data incident report and notice to impacted individuals (Section 1.8).
SSR, Inspection and CAP Tracker
Schedule the annual SSR, the three-year internal inspection plan and the semi-annual CAP updates with owners and evidence (Sections 2.D.3, 2.E.4 and 2.E.5).
Related frameworks
The FBI CJIS Security Policy v6.1 sets minimum security requirements for agencies and contractors that access or handle Criminal Justice Information.
FedRAMP Rev5 is the legacy FedRAMP certification type: NIST SP 800-53 Rev. 5 baselines, 3PAO assessment and agency authorization for cloud services used by U.S. agencies.
FISMA (Pub. L. 113-283, 2014) makes U.S. federal agency heads responsible for securing their systems, with OMB oversight, DHS directives, NIST standards and annual IG evaluation.
The GLBA Safeguards Rule (16 CFR Part 314) requires non-bank financial institutions under FTC jurisdiction to run a written information security program and report large breaches to the FTC.
NIST SP 800-53 Rev. 5 is the NIST catalog of security and privacy controls in 20 families, mandatory for federal systems under OMB A-130 and FISMA; Release 5.2.0 issued August 27, 2025.
Frequently Asked Questions For IRS Publication 1075 (Tax Information Security Guidelines)
Federal, state and local agencies, and their agents, contractors and sub-contractors, that receive Federal Tax Information from the IRS or a secondary source such as the Social Security Administration under IRC § 6103 or an IRS-approved exchange agreement (Introduction). It applies to all FTI regardless of amount or medium. The agency is responsible for making its consolidated data centers and contractors implement the requirements.
Rev. 11-2021, which supersedes the November 2016 edition and took effect six months after its publication date. The Safeguards program page lists it as current. The IRS has posted an early-release draft, Rev. 12-2026, that says it would supersede Rev. 11-2021, but a draft is not for reliance until the final edition is published.
Whoever discovers a possible improper inspection or disclosure contacts the local TIGTA Field Division immediately, and no later than 24 hours after identification (Section 1.8.2). The agency notifies the Office of Safeguards at the same time with a data incident report (Section 1.8.3). The agency also needs a written incident management policy.
At least 45 days before implementing cloud computing, disclosing FTI to a contractor, re-disclosing to a sub-contractor, using FTI in tax modeling or using it in a pre-production environment. Re-disclosure, tax modeling and pre-production use also need approval (Section 2.E.6, Table 6). A cloud environment must be FedRAMP authorized and keep FTI and access onshore (Section 3.3.1).
A Safeguard Security Report at least 90 days before first receiving FTI, then an annual update on the due date for its reporting period (Sections 1.1 and 2.E.4). After a safeguard review it updates the Corrective Action Plan semi-annually until findings close (Section 2.E.5). Internal inspection reports are kept at least five years (Section 2.D.3).
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.