What data security steps are recommended for storing tax documents?

Here’s what HIVE AI had to say about “What data security steps are recommended for storing tax documents?”:
Recommended data security steps for storing tax documents

Deploy core safeguards (“Security Six”)

• Activate and auto-update antivirus on all systems that store or access tax data
• Use a properly configured firewall to block unauthorized inbound/outbound traffic
• Enable two-factor/multi-factor authentication (2FA/MFA) on tax software, email, cloud storage, VPN, and admin accounts
• Run routine, tested backups of critical files and systems
• Enable full-disk/drive encryption on desktops, laptops, servers, and external drives
• Use a Virtual Private Network (VPN) for any remote access to office resources or when working on untrusted networks

Secure storage practices for digital tax records

• Maintain encrypted backups to external media or reputable cloud storage; keep at least one offline/offsite copy and encrypt before uploading to the cloud
• Use drive encryption to lock files and devices; require strong passphrases to decrypt
• Keep an inventory of devices and software that store or process taxpayer data
• Limit or disable internet access for devices that hold stored taxpayer data (e.g., archive servers, backup NAS)
• Avoid attaching USB/external drives with client data to public computers; install software only from official sources
• Sanitize devices before disposal; use tools with “shredder”/secure erase functionality and physically destroy media when decommissioned
  2

Mobile devices and removable media

• Avoid storing tax data on mobile devices when possible; if needed, require full device encryption for internal and removable storage
• Use FIPS 140-validated crypto modules; bind removable media to a specific device so encrypted data can’t be decrypted offline
• Restrict access to storage so only the assigned user can decrypt
  

Access controls and account management

• Limit access to taxpayer information to staff with a business need; enforce least-privilege permissions
• Require strong, unique passwords for every user; prohibit password sharing; enforce periodic changes
• Require MFA for all accounts that can access customer information
• Auto-lock computers with password-activated screen savers after inactivity
• Train staff on secure handling (locking rooms/cabinets, no posting passwords, mobile device protections)
  

Paper records and physical security

• Store paper files away from public areas and client traffic
• Use locked cabinets for retained documents; protect e-file reports/acknowledgments
• Prohibit volunteers/staff from keeping copies unless permitted by law and policy; shred or burn unneeded sensitive documents
  4

Email and file transfer

• Prefer secure portals for exchanging documents
• If email is necessary, use encrypted, password-protected attachments; exclude sensitive data (e.g., full TIN, full name) from subject lines and email bodies
• Confirm recipient identities before enabling email exchange; provide clear consent when using email for encrypted files
  

Phishing and cloud-account protections

• Turn on MFA for tax preparation and storage providers to protect accounts even if passwords leak
• Keep anti-malware/adaptive protections auto-updated to address new exploits
• Encrypt drives and perform regular backups to mitigate ransomware risk
  

Data labeling and leakage prevention

• Implement data loss prevention practices across data in motion, at rest, and in use
• Consider consistent markers for sensitive tax data (e.g., prefix files or headers with “FTI_” for federal tax information) to reinforce handling and monitoring controls
  

Records management, redundancy, and integrity

• Label records, provide a secure storage environment, keep offsite backups, and periodically test recovery and data integrity
• If using third parties for storage/reformatting, ensure quality controls maintain integrity, accuracy, and reliability of records
  

Programmatic security planning for tax practices

• Create and maintain a written data security plan addressing employee management/training, information systems, and detection/response to system failures
• Use the IRS “Taxes-Security-Together” Checklist to validate core controls and incident response readiness
  

When working virtually

• Apply the “Security Six” while working from home or on the road: updated AV, firewalls, MFA, backups, drive encryption, and VPN for secure connections
  

Sources

1 – IRS – Publication 5433 Working Virtually Part 1 – Security Six 📄 Summarize
2 – IRS – Publication 4557 Safeguarding Taxpayer Data A Guide for Your Business 📄 Summarize
3 – IRS.gov – Protecting federal tax information (FTI) within a mobile device environment 📄 Summarize
4 – IRS – Publication 4299 Privacy, Confidentiality, and Civil Rights – A Public Trust 📄 Summarize
5 – Announcement 2024-16 📄 Summarize
6 – IRS Newsroom – IR-2022-143 📄 Summarize
7 – IRS.gov – Preventing data leakage 📄 Summarize
8 – Rev. Proc. 2098-25 📄 Summarize
9 – IRS.gov – Tax Security 2.0 The Taxes-Security-Together Checklist 📄 Summarize

---

Try Your AI Tax Assistant for Free!

Ready to transform your practice with agentic AI in tax? See firsthand how our cutting-edge AI tax tools can revolutionize your approach to tax research and planning.