Hello, my name is Jason.

This podcast is part one of a two-part series from the IRS Safeguards office on updates to Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies.

Publication 1075 is your guide for tax information security.

Complying with it ensures that you are diligently protecting the sensitive federal taxpayer information with which you are entrusted.

This podcast, part one, covers three of seven key changes featured in the September 2016 revision that’s now on IRS.gov.

We’ll cover the remaining four changes in part 2.

The first three changes are:

One: Background Investigation Minimum Requirements

Two: Voluntary Termination of Receipt of Federal Tax Information, or FTI and

Three: Offsite Storage Requirements.

The most significant change to Publication 1075 concerns background investigations.

It outlines the need for the agency to develop a written background investigation policy and procedure, which must be specific in four areas:

One: Favorably adjudicated background investigations are required for all state employees and authorized contractors before permitting access to FTI,

Two: Reinvestigations must be conducted within 10 years from the date of the previous background investigation for each employee and contractor,

Three: Written background investigation policies and procedures and a sample of completed investigations must be made available for inspection upon request and

Four: Unfavorable criteria, determined by each agency, must be identified for each minimum check that would make an employee or contractor unsuitable for access to FTI.

Background Investigations for employees, contractor and sub-contractors with access to FTI must include:

FBI fingerprinting,

A check of local law enforcement agencies where the subject has lived, worked and/or attended school within the last five years and

Citizenship/residency verification.

All states must develop, publish and implement a background investigation policy and procedure within 1 year including FBI fingerprint checks) for all state and contract personnel to be granted access to FTI within 90 days of the revised September 2016 Publication 1075 release.

States lacking legislative authority to implement FBI fingerprint checks must submit a legislative proposal to support FBI fingerprint checks by [date].

The second key change is to Voluntary Termination of Receipt of FTI

When your agency no longer requires FTI, you need to notify Safeguards by sending an email to SafeguardReports@IRS.gov.

Your email must include:

Copies of notifications to the FTI source stating that FTI will no longer be requested and.

A letter from the Head of Agency certifying that all residual FTI has been destroyed.

Of course, sometimes you can’t destroy FTI because statutes may require you to retain it for a designated period.

After requesting termination you are still required to retain the FTI.

So you must include the copies of the notifications to the source requesting termination.

Since you cannot destroy the FTI, you will also need to ensure the authorized agency or contractor is retaining FTI in compliance with Publication 1075 security standards.

The authorized retainer is subject to periodic Safeguard Reviews and must submit an annual SSR for each year of the retention period.

Only after the retention period expires can you provide a letter from the Head of Agency certifying that all residual FTI has been destroyed.

The third key change to Publication 1075 relates to Offsite Storage Requirements.

Media containing FTI sent to an off-site storage facility must be properly secured, labeled, and protected from access by unauthorized individuals at all times.

If your agency is authorized to have contractors, they can’t store media on open shelving unless it’s located in a restricted area and is accessible only to individuals with authorized FTI access.

The agency must ensure that contractor-operated off-site storage facilities maintaining FTI on open shelving comply with all safeguarding requirements detailed in Publication 1075.

Any facility maintaining FTI is subject to IRS safeguard reviews.

If your agency does not have statutory authority to contract for services that involve the disclosure of specific FTI - for example, state Child Support Enforcement - you may release media containing FTI to a contractor- operated, off-site storage facility only if the following three conditions are met:

One: The media are encrypted and labeled as containing FTI

Two: The media are locked in a turtle case or security container and

Three: The agency retains the key to the container.

This concludes part one of our two-part podcast on updates to Publication 1075.

It’s a good idea to review the entire publication to ensure you are familiar and comply with all of its requirements.

If your agency has questions, send them to us at SafeguardReports@IRS.gov.

You can also get more information at IRS,gov using the search term, Safeguards.

Thanks for listening.