Section 8. SAFEGUARDS AND RECORD KEEPING REQUIREMENTS

1. All FTI obtained under Section 6103(l)(7) of the Code, namely information received from the IRS and the Social Security Administration, is subject to safeguarding, record keeping, and reporting requirements of Section 6103(p)(4) of the Code. Information on the implementation of these statutory requirements may be found in IRS Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies (as revised). Visit www.irs.gov and search for the keyword “Safeguards.” The FTI does not lose its character as FTI simply because the accuracy of the data has been “verified” by a third party. Rather, agencies should look to the source of the data as the determinant of whether information must be treated as FTI. If the IRS has provided data from its records, then the data is FTI. If a third party provides data from their records, the data provided is not considered to be FTI. The third party cannot simply attest to the accuracy of the data submitted but must provide data from their own records in order for the data to be considered “independently verified” and thus not subject to the safeguard requirements. Since FTI must be safeguarded in accordance with the provisions of Section 6103(p)(4) of the Code, it is necessary to accurately categorize the information as to its source.

2. If the FTI becomes a part of the agency’s case file regarding a specific taxpayer, because physical separation is impractical, the entire case file must be safeguarded. These files should be clearly labeled to indicate that FTI is included, and care should be taken to remove all such FTI, when appropriate, to preclude access by unauthorized persons.

3. All computers and computer systems which process, store, or transmit FTI must meet or exceed standards identified in IRS Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies (as revised).

4. Each agency receiving FTI pursuant to Section 6103(l)(7) of the Code must submit a Safeguard Security Report (SSR) at least 90 days prior to the initial scheduled receipt of FTI and must be current with their SSR filing requirement at the time of agreement Reestablishments/Renewals. The most current template may be requested by sending an e-mail to SafeguardReports@irs.gov . The SSR shall detail the security afforded to the FTI, the individuals who may request and have access to the FTI, the flow of the FTI once the agency has received it, as well as other information which will give a comprehensive picture of the need for, the use of, and the disposal of the FTI. The IRS Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies (as revised), provides additional information about the SSR and may be obtained by sending an e-mail to SafeguardReports@irs.gov , or by visiting http://www.irs.gov , search keyword: Safeguards.

5. The agency must update and submit the SSR annually to encompass any changes that impact the protection of FTI. Example changes include but are not limited to:

from an embedded IT operation

DIFSLA TY 2025 8

The following information must be updated in the SSR to reflect updates or changes regarding the agency or regarding safeguarding procedures within the reporting period:

SSR Update Submission Date

The SSR submission and all associated attachments must be sent annually to identify changes to safeguarding procedures, including:

changes that have occurred during the applicable reporting period.

Federal Agencies

All State Agencies and Territories

6. Pursuant to Section 6103(p)(4) of the Code, the IRS has the authority to ensure compliance with applicable laws and regulations through the conduct of safeguard reviews of all recipient agencies at the federal, state, and local levels.

7. Procedures for submitting Safeguards Report files using IRS approved secure file transfer method are detailed in Publication 1075 and summarized in Attachment 5 of this publication.

DIFSLA TY 2025 9