Do tax pros have to run external network scans?

Hello!

I am reading Pub 1345 and I am confused. On page 8 it says:
"External Vulnerability Scan. Online Providers of individual income tax returns must contract with an independent third-party vendor to run weekly external network vulnerability scans of all their “system components” in accordance with the applicable requirements of the Payment Card Industry Data Security Standards (PCIDSS)."

I want to make sure I am reading this correctly. Does the tax pro have to do this weekly vulnerability scan using an approved vendor? Or maybe is the client portal provider the one who has to do the scan?

If it's the tax pro who has to do this weekly scan, what company are you using?

Thank you for your help.

Hello!

I am reading Pub 1345 and I am confused. On page 8 it says:
"External Vulnerability Scan. Online Providers of individual income tax returns must contract with an independent third-party vendor to run weekly external network vulnerability scans of all their “system components” in accordance with the applicable requirements of the Payment Card Industry Data Security Standards (PCIDSS)."

I want to make sure I am reading this correctly. Does the tax pro have to do this weekly vulnerability scan using an approved vendor? Or maybe is the client portal provider the one who has to do the scan?

If it's the tax pro who has to do this weekly scan, what company are you using?

Thank you for your help.

Online providers wording is key here. Are you an online provider? Does your client enter their sensitive information into a web hosted form?

That's the confusion. I have a secure client portal, hosted by TaxDome. I also provide a PDF that some clients fill out and send it to me through the portal.

Pub 1345 refers to e-file definitions to define "Online Provider". Per Pub 3112 (IRS E-File Application and Participation), an Online Provider is a service like TurboTax:

Online Provider – allows taxpayers to self-prepare returns by entering return data directly on commercially
available software, software downloaded from an Internet site and prepared off-line, or through an online Internet
site. Online Provider is a secondary role; therefore, the business must also choose another Provider Option such
as Software Developer, Transmitter or Intermediate Service Provider. Even though an ERO may use an Internet
website to obtain information from taxpayers to originate the electronic submission of returns, the ERO is not an
Online Provider