IRS Publication 1075

No changes recorded yet — we are watching, and nothing has been published.

1. 2022-12-31 Taxpayer First Act section 2004 (IRC 6103(p)(9)) contractor safeguard and on-site review requirements take effect for agencies

1. —
   Publication 1075 (Rev. 11-2021) Major versionCurrent

   Revised and superseded the November 2016 edition, aligning the controls with NIST SP 800-53 Rev. 5; effective 6 months after publication. source

   More

   • The publication was reformatted and all sections renumbered.
   • Privacy controls from SP 800-53 Rev. 4 Appendix J are now integrated into the control set.
   • Digital identity requirements from NIST SP 800-63 were adapted into the revision.
   • Many instances of "should" were changed to "must".
   • Safeguard reviews can be on-site, remote or hybrid.

Publication 1075 binds agencies that receive FTI under IRC section 6103, and their contractors with access to it.

Recipients

Federal, state and local agencies that receive FTI from the IRS or from a secondary source such as SSA or the Bureau of the Fiscal Service. source

Condition of receipt

A receiving agency must show the IRS it can protect the confidentiality of FTI before it receives it, and may use FTI only for the authorized purpose. source

Contractors

Since 31 December 2022, agencies must require contractors, sub-contractors and other agents to have the IRC 6103(p)(4) safeguards in place and must review them on site. source

Contractor notice

Agencies must give the IRS 45 days' notice before contractors or sub-contractors get access to FTI. source

Control baseline

The cybersecurity requirements follow NIST SP 800-53 Rev. 5 security and privacy controls, with IRS-defined parameters. source

Agencies file an annual Safeguard Security Report with the IRS, which conducts its own safeguard reviews.

Safeguard Security Report

The SSR is submitted annually, with due dates set by state or agency group; federal agencies report on the calendar year by 31 January. source

IRS safeguard reviews

IRS Disclosure Enforcement Specialists and Cybersecurity Reviewers evaluate the agency's controls on site, remotely or in a hybrid review. source

Internal inspections

Agencies inspect field offices at least every three years, and headquarters, computer facilities and contractors with FTI access at least every 18 months. source

Contractor certification

Agencies certify annually to the Office of Safeguards that each contractor, sub-contractor or agent complies. source

The IRS can suspend or terminate FTI disclosures to an agency, and unauthorized disclosure or inspection carries criminal and civil sanctions.

Suspension

IRC 6103(p)(4) authorizes the IRS to suspend or terminate FTI disclosures to a recipient that misuses FTI or whose safeguards are inadequate. source

Incident reporting

A possible improper inspection or disclosure of FTI must be reported to TIGTA immediately, and no later than 24 hours after it is identified. source

Civil damages

Under IRC 7431 a taxpayer may sue for damages over knowing or negligent unauthorized inspection or disclosure of their return information. source

1. Standard Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies (Rev. 11-2021)
2. Guidance IRS Safeguards Program
3. Template Safeguard Security Report (SSR)
4. Guidance Encryption requirements of Publication 1075
5. Guidance Taxpayer First Act section 2004 (TFA 2004)

1. NIST SP 800-53

   NIST SP 800-53 is the control catalog; Publication 1075 applies its Rev. 5 controls, with IRS-defined values, to agencies holding Federal Tax Information.

2. CJIS Security Policy

   The CJIS Security Policy protects criminal justice information; Publication 1075 protects Federal Tax Information.

3. FedRAMP

   FedRAMP certifies cloud services for federal use; Publication 1075 sets FTI-specific requirements for agencies and their contractors, including in cloud environments.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 19 September 2026. Subscribe to IRS Publication 1075 (RSS)