Attempting to log into H&R Block's website to file my taxes, as I've done for the last several years in a row, I'm now being prompted to "Update your account settings so they meet new IRS requirements." Specifically, I'm now required to replace my (already secure, never-been-compromised, contains-no-dictionary-words-or-commonly-used-sequences) password with one that meets their new overly-complex criteria (I'll never remember/guess anything that meets them all), and also add two additional security question/answer pairs (the one I had previously chosen is the only one of those they offer that has an answer that I'll remember and nobody else knows or could learn through research on me).
Ok, my ranting aside, this question is not about what password requirements and other account security features a service provider should use (there's plenty of that on InfoSec.SE). I just want to know where I can review these "new IRS requirements" that H&R block refers to, so I can check whether or not it's legit.
If the new requirements actually do exist, please include a direct link to them if possible (e.g. a link to something on irs.gov, as opposed to an article on a news site reporting about the requirements).