The pubs that they make ref to, 4600 and 4557, lay out what you can do to protect taxpayer info. They do say that the safeguards are what you MAY implement. You have to asses your situation and decide what you have to do. If you are a small guy like me with no employees, then locking doors, backing-up, password emails, strong anti-virus, firewall and network protection is enough. It states that IF you use a outside testing service, not you must use one. Largers firms have to better protect due to more people involved.