IRS Releases Publication 1075 (11/2016), Tax Information Security Guidelines for Federal, State and Local Agencies

Safeguards for Protecting Federal Tax Returns and Return Information

Changes for September 2016 Revision

Provide America's taxpayers top-quality service by helping them understand and meet their tax responsibilities and enforce the law with integrity and fairness to all.

Office of Safeguards Mission Statement

The Mission of the Office of Safeguards is to promote taxpayer confidence in the integrity of the tax system by ensuring the confidentiality of IRS information provided to federal, state, and local agencies. Safeguards verifies compliance with IRC 6103(p)(4) safeguard requirements through the identification and mitigation of any risk of loss, breach, or misuse of Federal Tax Information held by external government agencies.

Changes for September 2016 Revision

This publication revises and supersedes Publication 1075 (October 2014) and is effective September 30, 2016. Feedback for Publication 1075 is highly encouraged. Please send any comments to SafeguardReports@irs.gov. Following are the highlighted changes:

1.1 General

To foster a tax system based on voluntary compliance, the public must maintain a high degree of confidence that the personal and financial information furnished to the Internal Revenue Service (IRS) is protected against unauthorized use, inspection, or disclosure.

The IRS must administer the disclosure provisions of the Internal Revenue Code (IRC) according to the spirit and intent of these laws, ever mindful of the public trust. The IRC defines and protects the confidential relationship between the taxpayer and the IRS and makes it a crime to violate this confidence. IRC 7213 prescribes criminal penalties, making it a felony offense for federal and state employees and others who illegally disclose federal tax returns and return information. Additionally, IRC 7213A makes the unauthorized inspection of Federal Tax Information (FTI) a misdemeanor, punishable by fines, imprisonment, or both. And finally, IRC 7431 prescribes civil damages for unauthorized inspection or disclosure, and upon criminal indictment or information under IRC 7213 or 7213(A), notification to the taxpayer that an unauthorized inspection or disclosure has occurred.

The concerns of citizens and Congress regarding individual rights to privacy require the IRS to continuously assess disclosure practices and the safeguards used to protect the confidential information entrusted. While the sanctions of the IRC are designed to protect the privacy of taxpayers, the IRS recognizes the importance of cooperating to the fullest extent permitted by law with other federal, state, and local authorities in their administration and enforcement of laws.

Those agencies or agents that legally receive FTI directly from either the IRS or from secondary sources (e.g., Social Security Administration [SSA]), pursuant to IRC 6103 or by an IRS-approved exchange agreement must have adequate programs in place to protect the data received. Furthermore, as agencies procure contractor services, it becomes equally important that contractors protect that information from unauthorized use, access, and disclosure.

Safeguards reports and related communications in possession of federal, state and local agencies are considered the property of the IRS and may not be disclosed to anyone outside the agency and are subject to disclosure restrictions under federal law and IRS rules and regulations. This includes, but is not limited to, Preliminary Findings Report (PFR); Safeguard Review Report (SRR); Safeguard Security Report (SSR) and Corrective Action Plan (CAP).

Release of any IRS Safeguards document requires the express permission of the Internal Revenue Service. Requests received through Sunshine and/or Information Sharing/Open Records provisions must be referred to the federal Freedom of Information Act (FOIA) statute for processing. State and local agencies receiving such requests should refer the requestor to the instructions to file a FOIA request with the IRS. Federal agencies should follow established procedures which require consultation before citing FOIA exemptions on IRS agency records, or directly refer the FOIA request to IRS for processing.

The intent of this requirement is to address any public request for sensitive information and prevent disclosure of data that would put FTI at risk. The agency may still distribute these reports internally and within other state agencies, auditors or oversight panels as required to either take corrective actions or report status without further IRS approval.

Additional guidance may be found at, https://http://www.irs.gov/uac/IRS-Freedom-of-Information, and questions should be referred to the Safeguards mailbox at Safeguardreports@irs.gov.

1.2 Overview of Publication 1075

This publication provides guidance to ensure the policies, practices, controls, and safeguards employed by recipient agencies, agents, or contractors adequately protect the confidentiality of FTI.

Enterprise security policies address the purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance to implement all applicable security controls. This document contains the managerial, operational, and technical security controls that must be implemented as a condition of receipt of FTI.

The guidelines outlined herein apply to all FTI, no matter the amount or the media in which it is recorded. FTI must be afforded the same levels of protection regardless of it residing on paper or electronic form. Systematic, procedural, or manual security policies must minimize circumvention.

A mutual interest exists in our responsibility to ensure that FTI is disclosed only to persons authorized and used only as authorized by statute or regulation. The IRS is confident of your diligence in this area and believes that this publication will be a helpful resource.

Conforming to these guidelines meets the safeguard requirements of IRC 6103(p)(4) and makes our joint efforts beneficial.

Requirements throughout this document apply to all organizational segments of an agency receiving FTI. It is the agency's responsibility to ensure all functions within the agency, including consolidated data centers and contractors (where allowed by federal statute) with access to FTI, understand and implement the requirements in this publication.

This publication provides the preliminary steps to consider before submitting a request to receive FTI, requirements for proper protection, expectations from the IRS, and considerations that may be helpful in establishing a program to protect FTI. The exhibits in this publication are provided for additional guidance.

The Office of Safeguards is responsible for all interpretations of safeguarding requirements. Publication 1075 requirements may be supplemented or modified between editions of Publication 1075 via guidance issued by the Office of Safeguards and posted on the Office of Safeguards website.

1.3 Access Safeguards Resources

The Office of Safeguards maintains Publication 1075, templates, guidance, and frequently asked questions online at http://www.irs.gov/uac/Safeguards-Program. Agencies are highly encouraged to regularly visit the website for updates.

1.3.1 Website Resources

The website contains many resources to assist agencies with meeting Publication 1075 requirements. Examples of the website's features include:

The Safeguards Mailbox is a repository for information and communication to the Office of Safeguards relative to Safeguarding requirements and Publication 1075. The Mailbox is located at SafeguardReports@irs.gov. Below are items that are appropriate for submission to the Mailbox:

This section establishes a baseline of key terms used throughout this publication. For additional definitions of terms and phrases, refer to Glossary and Key Terms.

1.4.1 Federal Tax Information (FTI)

Safeguarding FTI is critically important to continuously protect taxpayer confidentiality as required by IRC 6103. FTI is a term of art and consists of federal tax returns and return information (and information derived from it) that is in the agency's possession or control which is covered by the confidentiality protections of the IRC and subject to the IRC 6103(p)(4) safeguarding requirements including IRS oversight. FTI is categorized as Sensitive But Unclassified information and may contain personally identifiable information (PII).

FTI includes return or return information received directly from the IRS or obtained through an authorized secondary source, such as Social Security Administration (SSA), Federal Office of Child Support Enforcement (OCSE), Bureau of the Fiscal Service (BFS),or Centers for Medicare and Medicaid Services (CMS), or another entity acting on behalf of the IRS pursuant to an IRC 6103(p)(2)(B) Agreement.

FTI includes any information created by the recipient that is derived from federal return or return information received from the IRS or obtained through a secondary source.

FTI may not be masked to change the character of information to circumvent IRC 6103 confidentiality requirements.

1.4.2 Return and Return Information

IRC 6103(b)(1) defines a return as any tax or information return, estimated tax declaration, or refund claim (including amendments, supplements, supporting schedules, attachments, or lists) required by or permitted under the IRC and filed with the IRS by, on behalf of, or with respect to any person or entity. Examples of returns include forms filed on paper or electronically, such as Forms 1040, 941, 1120, and other informational forms, such as 1099 or W-2*. Forms include supporting schedules, attachments, or lists that are supplemental to or part of such a return.

* Refer to IRS.gov for a complete catalog of IRS forms.

Return information, in general, is any information collected or generated by the IRS with regard to any person's liability or possible liability under the IRC. IRC 6103(b)(2)(A) defines return information very broadly. It includes but is not limited to:

FTI may include Personally Identifiable Information (PII). FTI may include the following PII elements:

Copies of tax returns or return information provided to the agency directly by the taxpayer or his/her representative (e.g. Form 1040, etc.) or obtained from public information files (e.g. federal tax lien on file with the county clerk, Offers in Compromise available for public inspection; court records, etc.) is not protected FTI that is subject to the safeguarding requirements of IRC 6103(p)(4). If the agency independently verifies FTI provided by the IRS or a secondary source with the taxpayer or a third party source, the verified information is not FTI as long as the IRS source information is replaced or overwritten with the newly provided information.

1.4.5 Unauthorized Access

Unauthorized access occurs when an entity or individual knowingly or due to gross negligence receives or has access to FTI without authority, as defined in IRC 6103.

Access to FTI is permitted only to individuals who require the FTI to perform their official duties and as authorized under the IRC. FTI must never be indiscriminately disseminated, even within the recipient agency, body, or commission. Agencies must evaluate the need for FTI before the data is requested or disseminated.

1.4.6 Unauthorized Disclosure

An unauthorized disclosure occurs when an entity or individual with authorization to receive FTI knowingly or with gross negligence discloses FTI to another entity or individual who does not have authority, as defined in IRC 6103 and IRC 6104(c).

An unauthorized disclosure has occurred when FTI is knowingly or due to gross negligence provided to an individual who does not have the statutory right to have access to it under the IRC. Even without willfulness or gross negligence FTI is not to be disclosed to entities or individuals who are not authorized by IRC 6103 to have it.

Subject to the disclosure provisions of IRC 6103, agencies may need to disclose FTI to outside entities (e.g., for prosecution, appeals, or collection processes) as long as the receiving entity has a need-to-know and the individual recipient has authority under IRC 6103 to receive it. If the individual does not have a need-to-know, this constitutes an unauthorized disclosure.

1.4.7 Need to Know

Under need-to-know restrictions, even if an entity or an individual has the authority to access FTI, one would not be given access to such information if it were not necessary to perform his or her official duties with regard to the purpose for which IRC 6103 provides the FTI is to be used.

Limiting access to individuals on a need-to-know basis reduces opportunities to "browse" or improperly view FTI. Restricting access to designated personnel minimizes improper access or disclosure. When FTI must be provided to clerical, computer operators, or others, these should only be provided the FTI that is essential to accomplish their official duties.

2.0 Federal Tax Information and Reviews

2.1 General

IRC 6103 is a confidentiality statute and generally prohibits the disclosure of FTI (see Exhibit 1, USC Title 26, IRC 6103, for general rules and definitions). Exceptions to the general rule authorize disclosure of FTI to certain federal, state, and local agencies. Generally, these disclosures are made by the IRS in response to written requests signed by the head of the requesting agency or an authorized delegate. FTI so disclosed may be used by the receiving agency solely for the purpose described in the exception authorizing the disclosure. The statutes providing authorization to disclose FTI contain specific conditions that may require different procedures in maintaining and using the information. These conditions are outlined under specific sections in this publication.

As a condition of receiving FTI, the receiving agency must show, to the satisfaction of the IRS, the ability to protect the confidentiality of that information. Certain safeguards must be implemented to prevent unauthorized access and use. Besides written requests, the IRS may require formal agreements that specify, among other things, how the information will be protected. An agency must ensure its safeguards will be ready for immediate implementation upon receipt of FTI. Copies of the initial and subsequent requests for data and any formal agreement must be retained by the agency a minimum of five years as a part of its recordkeeping system.

Agencies must always maintain the latest SSR on file. The initial request for FTI must be followed by submitting an SSR to the IRS at least 45 days before the scheduled or requested receipt of FTI (see Section 7.0, Reporting Requirements--6103(p)(4)(E)). The SSR must include processing and safeguard procedures for all FTI received and distinguish between agency programs and functional organizations using FTI. Multiple organizations, divisions or programs within a federal agency using FTI should be consolidated into a single report for that agency at the direction of the Office of Safeguards.

Agencies entering into an agreement to disclose FTI to agents or contractors requires advance notice to the Office of Safeguards (see Section 7.4, 45 Day Notification Reporting Requirements and Section 11.3, Disclosing FTI to Contractors.)

Agencies must exercise care in outlining their safeguard program. Reports that lack clarity or sufficient information will be returned to the submitting agency for additional documentation.

2.2 Authorized Use of FTI

Any agency that receives FTI for an authorized use may not use that information in any manner or for any purpose not consistent with that authorized use. If an agency needs FTI for a different authorized use under a different provision of IRC 6103, a separate request must be sent to the Office of Disclosure.

An unauthorized secondary use of FTI is specifically prohibited and may result in discontinuation of disclosures to the agency and imposition of civil or criminal penalties on the responsible officials.

The Office of Safeguards conducts "need and use" verification reviews as part of the safeguard review and always considers whether the agency's use is in conformance with the governing provisions allowing the disclosure of FTI. The agency must describe the purpose(s) for which FTI is collected, used, maintained, and shared.

2.3 Secure Data Transfer

The IRS established a Secure Data Transfer (SDT) program to provide encrypted electronic transmission of FTI between the IRS and trading partners. For support with establishing an IRS SDT account, please submit an SDT Customer Support Request. Complete information on establishing an SDT account is available in the SDT Handbook. The SDT Handbook is available from a local IRS governmental liaison or a request to the Safeguards mailbox.

In addition to installing the SDT software, each agency must also have an IdenTrust Certificate installed. After the initial installation, agencies are required to renew the IdenTrust Certificate every two years. Refer to the ACES (Access Certificates for Electronic Services) IdenTrust website for additional information.

Only the following types of documents will be accepted via SDT:

2.4 State Tax Agency Limitations

FTI may be obtained per IRC 6103(d) by state tax agencies only to the extent the information is needed for, and is reasonably expected to be used for, state tax administration. An agency's records must include some account of the result of its use of FTI (e.g., disposition of closed cases and summary of revenues generated) or include reasons why the information was not used. If any agency continually receives FTI that it is unable to use for any reason, it must contact the IRS official liaison and discuss the need to stop the receipt of this FTI.

State tax agencies using FTI to conduct statistical analysis, tax modeling, or revenue projections must notify the IRS by submitting a signed Need and Use Justification for Use of Federal Tax Information form and following the established guidelines.

Annually, the agency must provide updated information in the SSR regarding its modeling activities that include FTI. In the SSR, the agency must describe:

The agency must:

Because of the diverse purposes that authorized disclosures may be made to an agency and the division of responsibilities among different components of an agency, FTI may be received and used by several quasi-independent units within the agency's organizational structure. Where there is such a dispersal of FTI, the agency must centralize safeguarding responsibilities to the greatest extent practical and establish and maintain uniform safeguard standards consistent with IRS guidelines. The official(s) assigned these responsibilities must hold a position high enough in the agency's organizational structure to ensure compliance with the agency safeguard standards and procedures.

The selected official(s), or point(s) of contact (POC(s)) must also be responsible for ensuring that internal inspections are conducted, for submitting required safeguard reports to the IRS, for properly reporting any data breach incidents, and for any necessary liaison with the IRS.

2.6 Safeguard Reviews

A safeguard review is an on-site evaluation of the use of FTI and the measures employed by the receiving agency and its agents (where authorized) to protect the data.

This includes all FTI received whether from the IRS or a secondary source such as SSA, BFS or another agency (see Section 1.4.1, Federal Tax Information). Safeguard reviews are conducted to determine the adequacy of safeguards as opposed to evaluating an agency's programs. Several factors will be considered when determining the need for and the frequency of reviews. Reviews are conducted by the IRS Office of Safeguards within the Office of Privacy, Governmental Liaison and Disclosure.

2.7 Conducting the Review

The IRS initiates the review by communication with an agency point of contact (POC). The preliminary discussion will be followed by a formal engagement letter to the agency head, which provides official notification of the planned safeguard review.

This engagement letter outlines what the review will encompass. Additional requests for specific information will be provided to the agency POC. These requests may include a list of records to be reviewed (e.g., training manuals, flowcharts, awareness program documentation, and organizational charts relating to the processing of FTI), the scope and purpose of the review, a list of the specific areas to be reviewed, and agency personnel to be interviewed.

Reviews cover the requirements of IRC 6103(p)(4) which can be found in:

The on-site review officially begins at the opening conference where procedures and parameters will be communicated. Observing actual operations is a required step in the review process. Sites to be reviewed will be based on the flow of the FTI through the agency, which may include field offices, consolidated data centers, off-site storage facilities, disaster recovery sites, and contractor sites both within and outside the state. Agency files may be spot-checked to determine if they contain FTI. The actual review is followed by a closing conference and issuance of a Preliminary Findings Report (PFR) where the agency is informed of findings identified during the review. A Safeguard Review Report (SRR) and Corrective Action Plan (CAP) will be issued within 45 days of the closing conference to document the on-site review findings. Requests for corrections to the SRR must be emailed to the SafeguardReports@irs.gov mailbox. The Office of Safeguards will respond with acknowledgement and determination.

Table 1 -- Safeguard Review Cycle

 ----------------------------------------------------------------------

Table 2 -- IT Testing Techniques

 ----------------------------------------------------------------------

2.8 Corrective Action Plan

The CAP must be updated and submitted semi-annually on the latest version to the Office of Safeguards (see Section 7.3, Corrective Action Plan) until all review findings are accepted and closed by the Office of Safeguards.

The CAP must include a brief explanation of actions already taken or planned to resolve the finding. For all outstanding findings, the agency must detail planned actions and associated milestones for resolution.

All findings must be addressed in a timely fashion. The Office of Safeguards will identify deadlines for resolution based upon the risk associated with each finding. Outstanding issues must be resolved and addressed in the next reporting cycle of the CAP.

2.9 Voluntary Termination of Receipt of FTI

2.9.1 Termination Documentation

When an agency no longer requires FTI, notify Safeguards at SafeguardReports@irs.gov by providing the following:

2.9.2 Archiving FTI Procedure (for agencies terminating receipt of FTI but required by statute to retain FTI for designated periods)

If residual FTI is required to be retained by statute for a designated period (e.g., 5 or 10 years), then agencies must:

3.1 General

Federal, state, and local agencies, bodies, commissions, and agents authorized under IRC 6103 to receive FTI are required by IRC 6103(p)(4)(A) to establish a permanent system of standardized records of requests made by or to them for disclosure of FTI. For additional guidance, see Exhibit 2, USC Title 26, IRC 6103(p)(4).

This recordkeeping must include internal requests among agency employees as well as requests outside of the agency. These records are required to track the movement of FTI. The records are to be maintained for five years or the agency's applicable records control schedule must be followed, whichever is longer. The Safeguards website contains guidance, job aids, helpful tools, and frequently asked questions to assist agencies in meeting safeguard requirements; see http://www.irs.gov/uac/Safeguards-Program.

The agency must establish, maintain, and update at least annually, an inventory that contains a listing of all programs and information systems identified as collecting, using, maintaining, or sharing FTI. Provide each update of the FTI inventory to the Chief Information Officer or information security official at least annually to support the establishment of information security requirements for all new or modified information systems containing FTI.

Records must be maintained in accordance with IRS audit log retention requirements for electronic and non-electronic files. For additional guidance, see Exhibit 9, Record Retention Schedules.

3.2 Electronic and Non-Electronic FTI Logs

The agency must establish a tracking system to identify and track the location of electronic and non-electronic FTI from receipt until it is destroyed. The FTI log may include tracking elements, such as:

If the authority to make further disclosures is present (e.g., agents/contractors), information disclosed outside the agency must be recorded on a separate list or log. The log must reflect to whom the disclosure was made, what was disclosed, and why and when it was disclosed. Agencies transmitting FTI from one mainframe computer to another, as in the case of the SSA sending FTI to state human services agencies, need only identify the bulk records transmitted. This identification will contain the approximate number of taxpayer records, the date of the transmissions, the best possible description of the records, and the name of the individual making/receiving the transmission.

Figure 1 -- Sample FTI Log

 ----------------------------------------------------------------------

3.4 Recordkeeping of Disclosures to State Auditors

When disclosures are made by a state tax agency to state auditors, recordkeeping requirements pertain only in instances where the auditors use FTI for further scrutiny and inclusion in their work papers. In instances where auditors read large volumes of records containing FTI, whether in paper or electronic format, the state tax agency need only identify bulk records examined. This identification will contain the approximate number of taxpayer records, the date of inspection, a description of the records, and the name of the individual(s) making the inspection. Recordkeeping log samples are provided in Section 3.2.

Disclosure of FTI to state auditors by child support enforcement and human services agencies is not authorized by statute. FTI in case files must be removed prior to access by the auditors

4.0 Secure Storage -- IRC 6103(p)(4)(B)

4.1 General

Security may be provided for a document, an item, or an area in a number of ways. These include but are not limited to locked containers of various types, vaults, locked rooms, locked rooms that have reinforced perimeters, locked buildings, guards, electronic security systems, fences, identification systems, and control measures.

How the required security is provided depends on the facility, the function of the activity, how the activity is organized, and what equipment is available. Proper planning and organization will enhance the security while balancing the costs.

The IRS has categorized federal tax and privacy information as moderate risk. The minimum protection standards (MPS) must be used as an aid in determining the method of safeguarding FTI. These controls are intended to protect FTI in paper and electronic form.

4.2 Minimum Protection Standards

Minimum protection standards (MPS) establish a uniform method of physically protecting data and systems as well as non-electronic forms of FTI. This method contains minimum standards that will be applied on a case-by-case basis. Because local factors may require additional security measures, management must analyze local circumstances to determine location, container, and other physical security needs at individual facilities. MPS have been designed to provide management with a basic framework of minimum security requirements.

The objective of these standards is to prevent unauthorized access to FTI. MPS thus requires two barriers. Example barriers under the concept of MPS are outlined in the following table. Each topic represents one barrier and should be used as a starting point to identify two barriers of MPS to protect FTI.

Table 3 -- Minimum Protection Standards

 ----------------------------------------------------------------------

Using a common situation as an example, often an agency desires or requires that security personnel or custodial service workers or landlords for non-government-owned facilities have access to locked buildings and rooms. This may be permitted as long as there is a second barrier to prevent access to FTI. A security guard, custodial services worker, or landlord may have access to a locked building or a locked room if FTI is in a locked security container. If FTI is in a locked room but not in a locked security container, the guard, janitor, or landlord may have a key to the building but not the room.

Additional controls have been integrated into this document that map to National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 4. These are identified in Section 9.3, NIST SP 800-53 Control Requirements. Per NIST guidelines, policies and procedures must be developed, documented, and disseminated, as necessary, to facilitate implementing physical and environmental protection controls.

For additional guidance, see Section 9.3.11.3, Physical Access Control (PE-3).

4.3 Restricted Area Access

Care must be taken to deny unauthorized access to areas containing FTI during duty and non-duty hours. This can be accomplished by creating restricted areas, security rooms, or locked rooms. Additionally, FTI in any form (computer printout, photocopies, tapes, notes) must be protected during non-duty hours. This can be done through a combination of methods, including secured or locked perimeter, secured area, or containerization.

A restricted area is an area where entry is limited to authorized personnel (individuals assigned to the area). All restricted areas either must meet secured area criteria or provisions must be made to store FTI in appropriate containers during non-duty hours. Using restricted areas is an effective method for eliminating unnecessary traffic through critical areas, thereby reducing the opportunity for unauthorized access or disclosure or theft of FTI. All of the following procedures must be implemented to qualify as a restricted area.

Restricted areas will be prominently posted and separated from non-restricted areas by physical barriers that control access. The number of entrances must be kept to a minimum and must have controlled access (e.g., electronic access control, key access, door monitor) to prevent unauthorized entry. The main entrance must be controlled by locating the desk of a responsible employee at the entrance to ensure that only authorized personnel with an official need may enter.

A restricted area visitor log must be maintained at a designated entrance to the restricted area, and all visitors (persons not assigned to the area) entering the area shall be directed to the designated entrance.

The visitor access log must require the visitor to provide the following information:

Each restricted area access log must be closed out at the end of each month and reviewed by management.

Figure 2 -- Sample Visitor Access Log

 -------------------------------------------------------------

4.3.1 Use of Authorized Access List

To facilitate the entry of employees who have a frequent and continuing need to enter a restricted area, but who are not assigned to the area, an Authorized Access List (AAL) can be maintained so long as MPS are enforced (see Section 4.2, Minimum Protection Standards).

Agency Employees: The AAL must contain the following:

Vendors and Non-Agency Personnel: The AAL must contain the following information:

If there is any doubt of the identity of the individual, the security monitor must verify the identity of the vendor/contractor individual against the AAL prior to allowing entry into the restricted area.

For additional guidance, see Section 9.3.11.2, Physical Access Authorizations (PE-2). Also, see Section 9.3.11.8, Delivery and Removal (PE-16), for guidance on controlling information system components entering and exiting the restricted area.

4.3.2 Controlling Access to Areas Containing FTI

Management or a designee shall maintain an authorized list of all personnel who have access to information system areas, where these systems contain FTI. This shall not apply to those areas within the facility officially designated as publicly accessible.

The agency shall issue appropriate authorization credentials, including badges, identification cards, or smart cards. In addition, a list shall be maintained that identifies those individuals who have authorized access to any systems where FTI is housed. Access authorizations and records maintained in electronic form are acceptable.

Each agency shall control physical access to the information system devices that display FTI information or where FTI is processed to prevent unauthorized individuals from observing the display output. For additional information, see Section 9.3.11.5, Access Control for Output Devices (PE-5).

The agency or designee shall monitor physical access to the information system where FTI is stored to detect and respond to physical security incidents. For additional information, see Section 9.3.11.6, Monitoring Physical Access (PE-6).

For all areas that process FTI, the agency shall position information system components within the facility to minimize potential damage from physical and environmental hazards and to minimize the opportunity for unauthorized access. For additional guidance, see Section 9.3.11.10, Location of Information System Components (PE-18).

Whenever cleaning and maintenance personnel are working in restricted areas containing FTI, the cleaning and maintenance activities must be performed in the presence of an authorized employee.

Allowing an individual to "piggyback" or "tailgate" into restricted locations must be prohibited and documented in agency policy. The agency must ensure that all individuals entering an area containing FTI do not bypass access controls or allow unauthorized entry of other individuals. Unauthorized access must be challenged by authorized individuals (e.g., those with access to FTI). Security personnel must be notified of piggyback/tailgate attempts.

4.3.3 Control and Safeguarding Keys and Combinations

All containers, rooms, buildings, and facilities containing FTI must be locked when not in actual use.

Access to a locked area, room, or container can be controlled only if the key or combination is controlled. Compromising a combination or losing a key negates the security provided by that lock. Combinations to locks must be changed annually or when an employee who knows the combination retires, terminates employment or transfers to another position.

Combinations must be given only to those who have a need to have access to the area, room, or container and must never be written on a sticky-note, calendar pad, or any other item (even though it is carried on one's person or hidden from view). An envelope containing the combination must be secured in a container with the same or a higher security classification as the highest classification of the material authorized for storage in the container or area the lock secures.

Keys must be issued only to individuals having a need to access an area, room, or container. Inventory records must be maintained on keys and must account for the total keys available and keys issued. The inventory must account for master keys and key duplicates. A annual reconciliation must be done on all key records. The number of keys or persons with knowledge of the combination to a secured area will be kept to a minimum. Keys and combinations will be given only to those individuals who have a frequent need to access the area.

4.3.4 Locking Systems for Secured Areas

The number of keys or persons with knowledge of the combination to a secured area will be kept to a minimum. Keys and combinations will be given only to those individuals who have a frequent need to access the area.

Access control systems (e.g., badge readers, smart cards, and biometrics) that provide the capability to audit access control attempts must maintain audit records with successful and failed access attempts to secure areas containing FTI or systems that process FTI. Agency personnel must review access control logs on a monthly basis. The access control log must contain the following elements:

Handling FTI must be such that the FTI does not become misplaced or available to unauthorized personnel.

Any time FTI is transported from one location to another, care must be taken to provide appropriate safeguards. When FTI is hand-carried by an individual in connection with a trip or in the course of daily activities, it must be kept with that individual and protected from unauthorized disclosures.

All shipments of paper or electronic FTI (including compact disk [CD], digital video disk [DVD], thumb drives, hard drives, tapes, and microfilm) must be documented on a transmittal form and monitored to ensure that each shipment is properly and timely received and acknowledged. All FTI transported through the mail or courier/messenger service must be double-sealed; that is, one envelope within another envelope. The inner envelope must be marked "confidential" with some indication that only the designated official or delegate is authorized to open it. The outermost envelope should not be labeled as FTI or provide any indication that the contents contains FTI, since that may actually increase risk to the contents. Using sealed boxes serves the same purpose as double-sealing and prevents anyone from viewing the contents thereof.

4.5 Physical Security of Computers, Electronic, and Removable Media

Computers and electronic media that receive, process, store, or transmit FTI must be in a secure area with restricted access. In situations when requirements of a secure area with restricted access cannot be maintained, such as home work sites, remote terminals or other office work sites, the equipment must receive the highest level of protection practical, including full disk encryption. All computers and mobile devices that contain FTI and reside at an alternate work site must employ encryption mechanisms to ensure that FTI may not be accessed if the computer is lost or stolen (see OMB M-06-16).

Basic security requirements must be met, such as keeping FTI locked up when not in use. When removable media contains FTI, it must be labeled as FTI.

All computers, electronic media, and removable media containing FTI, must be kept in a secured area under the immediate protection and control of an authorized employee or locked up. When not in use, the media must be promptly returned to a proper storage area/container.

Inventory records of electronic media must be maintained and reviewed semi-annually for control and accountability. Section 3.0, Recordkeeping Requirement, contains additional information. For additional guidance on log retention requirements, see Exhibit 9, Record Retention Schedules.

For physical security protections of transmission medium (e.g., cabling), see Section 9.3.11.4, Access Control for Transmission Medium (PE-4).

4.6 Media Off-Site Storage Requirements

Media containing FTI which is sent to an off-site storage facility, must be properly secured, labeled, and protected from access by unauthorized individuals at all times. The media may not be stored on open shelving, unless the shelving is in a restricted area (see Restricted Area Access, Section 4.3) accessible only to individuals with authorized access to FTI. The agency must ensure that contractor-operated off-site storage facilities maintaining FTI on open shelving comply with all safeguarding requirements (e.g., visitor access logs, internal inspections, contractor access restrictions, employee training, and the contract include Exhibit 7 safeguarding language). These facilities are subject to IRS safeguard reviews.

Agencies which do not have the statutory authority to contract for services that involve the disclosure of FTI (e.g. state Child Support Enforcement, Human Services and certain workforce agencies (not receiving data under 6103(d)), may not allow release media containing FTI to a contractor operated off-site storage facility unless the following conditions are met:

If the confidentiality of FTI can be adequately protected, telework sites, such as employee's homes or other non-traditional work sites can be used. FTI remains subject to the same safeguard requirements and the highest level of attainable security. All of the requirements of Section 4.5, Physical Security of Computers, Electronic, and Removable Media, apply to telework locations.

The agency must conduct periodic inspections of alternative work sites during the year to ensure that safeguards are adequate. The results of each inspection shall be fully documented. IRS reserves the right to visit alternative work sites while conducting safeguard reviews. Changes in safeguard procedures must be described in detail by the agency in the SSR. For additional information, see Section 7.2, Safeguard Security Report.

4.7.1 Equipment

The agency must retain ownership and control, for all hardware, software, and end-point equipment connecting to public communication networks, where these are resident at all alternate work sites. The use of virtual desktop infrastructure with non-agency-owned devices (including personally-owned devices) is an acceptable alternative, where all requirements in section 9.4.13 Virtual Desktop Infrastructure are met.

Employees must have a specific room or area in a room that has the appropriate space and facilities for the type of work done. Employees also must have a way to communicate with their managers or other members of the agency if security problems arise.

The agency must give employees locking file cabinets or desk drawers so that documents, disks, and tax returns may be properly secured when not in use. If agency furniture is not furnished to the employee, the agency must ensure that an adequate means of storage exists at the work site. The agency must provide "locking hardware" to secure automated data processing equipment to large objects, such as desks or tables. Smaller, agency-owned equipment must be locked in a filing cabinet or desk drawer when not in use.

4.7.2 Storing Data

FTI may be stored on hard disks only if agency-approved security access control devices (hardware/software) have been installed, are receiving regularly scheduled maintenance including upgrades, and are being used. Access controls must include password security, an audit trail, encryption, virus detection, and data overwriting capabilities.

4.7.3 Other Safeguards

Only agency-approved security access control devices and agency-approved software will be used. Copies of illegal and non-approved software will not be used. Electronic media that is to be reused must have files overwritten or degaussed.

The agency must maintain a policy for the security of alternative work sites. The agency must coordinate with the managing host system(s) and any networks and maintain documentation on the test. Before implementation, the agency will certify that the security controls are adequate for security needs. Additionally, the agency will promulgate rules and procedures to ensure that employees do not leave computers unprotected at any time. These rules must address brief absences while employees are away from the computer. The agency must provide specialized training in security, disclosure awareness, and ethics for all participating employees and managers. This training must cover situations that could occur as the result of an interruption of work by family, friends, or other sources.

5.0 Restricting Access--IRC 6103(p)(4)(C)

5.1 General

Agencies are required by IRC 6103(p)(4)(C) to restrict access to FTI only to persons whose duties or responsibilities require access (see Exhibit 2, USC Title 26, IRC 6103(p)(4), and Exhibit 4, Sanctions for Unauthorized Disclosure). To assist with this requirement, FTI must be clearly labeled "Federal Tax Information" and handled in such a manner that it does not become misplaced or available to unauthorized personnel. Additionally, warning banners advising of safeguarding requirements must be used for computer screens (see Exhibit 8, Warning Banner Examples).

To understand the key terms of unauthorized disclosure, unauthorized access, and need-to-know, see Section 1.4, Key Definitions.

5.1.1 Background Investigation Minimum Requirements

Determining the suitability of individuals who require access to U.S. government Sensitive But Unclassified (SBU) information, including FTI, is a key factor in ensuring adequate information security. Prior to granting access to FTI, and periodically thereafter, the Agency must complete a suitability background investigation which is favorably adjudicated by the Agency.

Federal agencies must conduct a suitability or security background investigation based on the position sensitivity of the individual's assigned position and risk designation associated with the investigative Tier established by the Federal Investigative Standards (FIS). Granting access to FTI requires a Tier 2 level investigation at a minimum.

A FIS Tier 2 standard background investigation meets the suitability investigative requirement for non-sensitive positions designated as moderate risk public trust (requested using Standard Form 85P). Investigations conducted at Tiers 2-5 meet the minimum standard for an employee or contractor access to FTI. Federal agencies may be asked to provide evidence that the required BI was conducted for each individual granted access to FTI. FIS standards require reinvestigation every five years at a minimum.

State and local agencies which are not required to implement the federal background investigation standards must establish a personnel security program that ensures a background investigation is completed at the appropriate level for any individual who will have access to FTI using the guidance below as the minimum standard and a reinvestigation conducted within 10 years at a minimum.

5.1.2 Implementing the Background Investigation Requirement

The requirements of Section 5.1.1 pertaining to initial and periodic background investigations for individuals before authorizing access to FTI is effective upon date of this publication. Implementation of the new standards, including the development of written policies and verification that all individuals with access to FTI have an appropriate level of investigation and initiating new required investigations to comply with the requirement may occur within one year.

Upon publication, agencies should initiate action to establish a written background investigation policy that conforms to the standards of Section 5.1.1. Agencies should also identify all employees or contractors who currently have access to FTI and have not completed the required personnel security screening and initiate a background investigation which meets these standards. Agencies should initiate a background investigation for all newly hired employees and contractors who will require access to FTI to perform assigned duties as soon as practicable upon notification of the requirement.

Federal agencies that completed a Moderate-Risk Background Investigation (MBI) or higher, for individuals with access to FTI, prior to the October 2014 implementation date of the FIS Tier 2 standard investigation, have met the minimum standard and no further investigation is needed so long as reinvestigation is timely scheduled. Individuals granted access to FTI based on a National Agency Check with Inquiries (NACI) is not sufficient and a Tier 2 investigation should be initiated for continued access to FTI.

Agency implementation efforts to achieve full compliance with the minimum background investigation requirement may vary based on based on state legislation, budget and labor relation hurdles. Some state agencies have published standards which meet or exceed these requirements while others may have minimal or no standards established for background investigations. The expectation is that all agencies receiving FTI will take the steps necessary towards full compliance with this requirement.

As a part of the annual Safeguard Security Report, (SSR), and during an agency on-site review, compliance with and efforts underway to achieve compliance will be evaluated. Any deficiencies will be documented in the agency's Corrective Action Plan, (CAP), and there will be an expectation that each agency response includes an update on progress and a plan to continue moving forward towards compliance.

5.2 Commingling of FTI

Commingling of FTI refers to having FTI and non-FTI data stored together, regardless of format. For example, commingling occurs when FTI is included in sentence of text in a paper notice or letter; a row or column containing FTI a database table; files stored on electronic media (some files containing FTI and some don't),or at a shared data center with some systems including FTI subject to access restrictions (and some don't). Any kind of commingling creates the need for additional controls, since the introduction of FTI requires the entire letter, data table, removable media, etc to be handled and protected as FTI.

It is recommended that FTI be kept physically and logically separate from other information to the maximum extent possible to avoid inadvertent disclosures and need for additional controls. Agencies should attempt to avoid maintaining FTI as part of their case files including any recordation or transcription in case notes or activity logs, whether paper or electronic.

In situations where physical separation is impractical, the file must be clearly labeled to indicate that FTI is included, and the file must be safeguarded.

All FTI must be removed prior to releasing files to an individual or agency without authorized access to FTI.

5.2.1 Commingling of Electronic Media

If FTI is recorded on electronic media (e.g., tapes) with other data, it must be protected as if it were entirely FTI. Such commingling of data on electronic media should be avoided, if practicable. FTI only loses its character when it is verified by a third party and overwritten in the agency's records.

When data processing equipment is used to process or store FTI and the information is mixed with agency data, access must be controlled by:

Examples of commingling include:

Some state disclosure statutes and administrative procedures permit access to state tax files by other agencies, organizations, or employees not involved in tax matters. As a general rule, IRC 6103(d) does not permit access to FTI by such employees, agencies, or other organizations. The IRC clearly provides that FTI will be furnished to state tax agencies only for tax administration purposes and made available only to designated state tax personnel and legal representatives or to the state audit agency for an audit of the tax agency. Questions about whether particular state employees are entitled to access FTI must be forwarded to the Disclosure Manager at the IRS Office that serves your location.^† Generally, the IRC does not permit state tax agencies to furnish FTI to other state agencies or to political subdivisions, such as cities or counties. State tax agencies may not furnish FTI to any other state or local agency, even where agreements have been made, informally or formally, for the reciprocal exchange of state tax information unless formally approved by the IRS. Also, non-government organizations, such as universities or public interest organizations performing research cannot have access to FTI.

^† Refer to http://www.irs.gov/uac/IRS-Disclosure-Offices for contact information.

Although state tax agencies are specifically addressed previously in this section, the restrictions on data access and non-disclosure to another agency or third party applies to all agencies authorized to receive FTI. Generally, statutes that authorize disclosure of FTI do not authorize further disclosures by the recipient agency. Unless IRC 6103 provides for further disclosures by the agency, the agency cannot make such disclosures or otherwise grant access to FTI to either employees of another component of the agency not involved with administering the program for which the FTI was specifically received or to another state agency for any purpose.

Agencies and subdivisions within an agency may be authorized to obtain the same FTI for different purposes, such as a state tax agency administering tax programs and a component human services agency administering benefit eligibility verification programs (IRC 6103(l)(7)) or child support enforcement programs (IRC 6103(l)(6)).

However, the IRC disclosure authority does not permit agencies or subdivisions of agencies to exchange or make subsequent disclosures of this information for another authorized purpose even within the agency. In addition, unless specifically authorized by the IRC, agencies are not permitted to allow access to FTI to agents, representatives, or contractors.

FTI cannot be accessed by agency employees, agents, representatives, or contractors located offshore--outside of the United States territories, embassies or military installations. Further, FTI may not be received, processed, stored, transmitted, or disposed of by information technology (IT) systems located offshore.

5.4 Controls over Processing

The agency must establish adequate controls to prevent disclosing FTI to other state agencies, tax or non-tax, or to political subdivisions, such as cities or counties, for any purpose, including tax administration, absent explicit written IRS authority granted under IRC 6103(p)(2)(B).

Processing of FTI in an electronic media format including removable media, microfilms, photo impressions, or the conversion to other formats (including tape reformatting or duplication, reproduction or conversion to digital images or hard copy printout) will be performed as indicated in the following environments.

5.4.1 Agency Owned and Operated Facility

Processing under this method will take place in a manner that will protect the confidentiality of the information on the electronic media. All safeguards outlined in this publication also must be followed and will be subject to IRS safeguard reviews.

5.4.2 Contractor or Agency Shared Facility -- Consolidated Data Centers

5.4.2.1 Agency Shared Facilities:

Recipients of FTI are allowed to use a shared facility but only in a manner that does not allow access to FTI by employees, agents, representatives, or contractors of other agencies using the shared facility.

For purposes of applying sections 6103(l), (m), and (n), the term agent includes contractors.

Access restrictions pursuant to the IRC authority by which the FTI is received continue to apply; for example, human services agencies administering benefit eligibility programs may not allow contractors, including consolidated data center contractors, access to any FTI.

The agency must include, as appropriate, the requirements specified in Exhibit 7, Safeguarding Contract Language, in accordance with IRC 6103(n).

In addition to the agency being subject to Safeguard reviews, all contractor and shared sites that receive, process, store or transmit FTI are subject to reviews.

These requirements also apply to releasing electronic media to a private contractor or other agency office, even if the purpose is merely to erase the old media for reuse.

5.4.2.2 Consolidated Data Centers:

Agencies using consolidated data centers must implement appropriate controls to ensure the protection of FTI, including a service level agreement (SLA) between the agency authorized to receive FTI and the consolidated data center. The SLA must cover the following:

5.4.3 Review Availability of Contractor Facilities:

As a part of the agency review process, all affiliated contractors who receive, transmit, process and store FTI on behalf of the agency are subject to review and testing.

The agency must include Exhibit 7, Safeguarding Contract Language, in accordance with IRC 6103(n) for all contracts. Agencies seeking to modify this language must secure approval from Safeguards in advance.

These requirements also apply to releasing electronic media to a private contractor or other agency office, even if the purpose is merely to erase the old media for reuse.

5.5 Child Support Agencies -- IRC 6103(l)(6), (l)(8), and (l)(10)

In general, no officer or employee of any state or local child support enforcement agency can make further disclosures of FTI.

However, limited information may be disclosed to agents or contractors of the agency for the purpose of, and to the extent necessary in, establishing and collecting child support obligations from and locating individuals owing such obligations.

The information that may be disclosed for this purpose to an agent or a contractor is limited to:

Forms 1099 and W-2 information are not authorized by statute to be disclosed to contractors under the child support enforcement program (IRC 6103(l)(6).

5.6 Human Services Agencies--IRC 6103(l)(7)

No officer or employee of any federal, state, or local agency administering certain programs under the Social Security Act, the Food Stamp Act of 1977, or Title 38, United States Code, or certain housing assistance programs is permitted to make further disclosures of FTI for any purpose. Human services agencies may not contract for services that involve the disclosure of FTI to contractors.

5.7 Deficit Reduction Agencies--IRC 6103(l)(10)

Agencies receiving FTI from the Bureau of Fiscal Service related to tax refund offsets are prohibited from making further disclosures of the FTI received unless authorized.

5.8 Centers for Medicare and Medicaid Services--IRC 6103(l)(12)(C)

The Administrator of the Centers for Medicare and Medicaid Services (CMS) is authorized under IRC 6103(l)(12)(C) to disclose FTI it receives from SSA to its agents for the purpose of, and to the extent necessary in, determining the extent that any Medicare beneficiary is covered under any group health plan. A contractual relationship must exist between CMS and the agent. The agent, however, is not authorized to make further disclosures of FTI for any purpose.

5.9 Disclosures under IRC 6103(l)(20)

Disclosures to officers, employees, and contractors of SSA and other specified agencies are authorized to receive specific tax information for the purpose of carrying out the Medicare Part B premium subsidy adjustment and Part D Base Beneficiary Premium Increase. These disclosures are subject to safeguard requirements. Any agency receiving FTI from SSA authorized by this provision is also subject to IRS safeguard requirements and review.

5.10 Disclosures under IRC 6103(l)(21)

Disclosures to officers, employees, and contractors of the U.S. Department of Health and Human Services (HHS) at the request of a taxpayer seeking financial assistance for health insurance affordability programs. HHS may release FTI to an Exchange established under the Affordable Care Act or a state agency administering eligibility determinations for Medicaid or Children's Health Insurance Programs for the purpose of establishing eligibility for participation in the Exchange, verifying the appropriate amount of any credits, and determining eligibility for participation in the state program. These disclosures are subject to safeguard requirements. Any agent or contractor is also subject to IRS safeguard requirements and review. IRC 6103(l)(21)(C) may allow the Office of Inspector General, HHS to have access to FTI maintained in the eligibility records of an Exchange or state entity administering these programs, under certain limited circumstances. This authority does not extend to independent state audit agencies which may not have access to FTI in eligibility records unless a contractual relationship is established which conforms to the disclosure requirements of IRC 6103.

5.11 Disclosures under IRC 6103(i)

Federal law enforcement agencies receiving FTI pursuant to court orders or by specific request under Section 6103(i) for purposes of investigation and prosecution of non-tax federal crimes, or to apprise of or investigate terrorist incidents, are subject to safeguard requirements and review.

The Department of Justice must report in its SSR the number of FTI records provided and to which federal law enforcement agency the data was shared for the calendar year processing period.

5.12 Disclosures under IRC 6103(m)(2)

Disclosures to agents of a federal agency under IRC 6103(m)(2) are authorized for the purposes of locating individuals in collecting or compromising a federal claim against the taxpayer in accordance with Sections 3711, 3717, and 3718 of Title 31. If the FTI is shared with agents or contractors, the agency and agent or contractor are all subject to IRS safeguarding requirements and reviews.

6.0 Other Safeguards--IRC 6103(p)(4)(D)

6.1 General

IRC 6103(p)(4)(D) requires that agencies receiving FTI to provide other safeguard measures, as appropriate, to ensure the confidentiality of the FTI. Agencies are required to provide a training program for their employees and contractors.

6.2 Training Requirements

Education and awareness are necessary to provide employees, contractors, and other persons with the information to protect FTI. There are multiple components to a successful training program. In this section, training requirements are consolidated to ensure agencies understand all of the requirements to comply with this publication.

Disclosure awareness training is described in detail within Section 6.3, Disclosure Awareness Training. Additional training requirements are located in various sections of the document and identified in the following table.

Table 4 -- Training Requirements

 ----------------------------------------------------------------------

Disclosure awareness training stipulates that:

The following resources are available from the IRS to assist your agency in meeting the federal safeguard requirements for disclosure awareness and the protection of FTI. Technical information is available to you on the Office of Safeguards website at https://http://www.irs.gov/uac/safeguards-program.

Some of the following products can be ordered from the IRS Distribution Center by calling 800-TAX-FORM (829-3676). Be sure to identify yourself as a (state) government employee, provide the publication number and quantity. All products will be delivered to the agency address you provide and to the attention of the person you specify. Please do not call the tax help number (800-829-4933). If you experience an ordering problem send an email to SafeguardReports@irs.gov mailbox.

Publication 1075, Tax Information Security Guidelines for Federal, State, and Local Agencies (Key publication explains the federal safeguard requirements)

Another measure IRS requires is internal inspections by the recipient agency. The purpose is to ensure that the security policies and procedures established by the agency to protect FTI are functioning, maintained and enforced. The agency must submit copies of these inspections to the IRS with the SSR (see Section 7.2, Safeguard Security Report). To provide an objective assessment, the inspection must be conducted by a function other than the using function.

To provide reasonable assurance that FTI is adequately safeguarded, the inspection must address the safeguard requirements the IRC and the IRS impose. The agency monitors and audits privacy controls and internal privacy policy to ensure effective implementation.

Agencies must establish a review cycle as follows:

Inspection reports, including a record of corrective actions, must be retained by the agency for a minimum of five years from the date the inspection was completed. IRS personnel may review these reports during an on-site safeguard review. A summary of the agency's findings and the actions taken to correct any deficiencies must be included with the SSR submitted to the IRS.

Key areas that must be addressed include recordkeeping, secure storage, limited access, disposal, and computer security.

6.4.1 Recordkeeping

Each agency and function within that agency shall maintain a log of all requests for FTI, including receipt and disposal of returns or return information. This includes any medium containing FTI, such as computer tapes, cartridges, CDs, or data received electronically.

6.4.2 Secure Storage

FTI (including tapes, cartridges, or other removable media) must be stored in a secure location, safe from unauthorized access.

6.4.3 Limited Access

Access to returns and return information (including tapes, cartridges, or other removable media) must be limited to only those employees, officers, and contractors who are authorized access by law or regulation and whose official duties require such access.

The physical and systemic barriers to unauthorized access must be reviewed and reported. An assessment of facility security features must be included in the report.

6.4.4 Disposal

Upon completion of use, agencies must ensure that the FTI is destroyed or returned to the IRS or the SSA according to the guidelines contained in Section 8.0, Disposing of FTI--IRC 6103(p)(4)(F).

6.4.5 Computer Systems Security

The agency's review of the adequacy of its computer security provisions must provide reasonable assurance that access to FTI is limited to personnel who have a need-to-know. This need-to-know must be enforced electronically as well as physically (see Internal Inspection Template on the Office of Safeguards website and Section 9.3.1, Access Control, and other portions of Section 9.0, Computer System Security, as applicable).

The review of the computer facility must include the evaluation of computer security and physical security controls.

6.5 Plan of Action and Milestones

The agency must implement a process for ensuring that a Plan of Action and Milestones (POA&M) is developed and monitored. The POA&M must include the corrective actions identified during the internal inspections and will identify the actions the agency plans to take to resolve these findings.

The POA&M pertains to findings identified by the agency during the internal inspections process and any other internal or external audit.

The CAP covers findings identified by the Office of Safeguards during the on-site safeguard review. While these findings may be similar, their inclusion in either the POA&M or CAP is dependent upon how they were identified and who (the agency or the Office of Safeguards) is monitoring the finding resolution. Based upon deficiencies noted during the agency's inspection, list all deficiencies and corrective actions along with reasonable time frames for the remediation to occur (refer to Section 7.3, Corrective Action Plan).

7.0 Reporting Requirements--6103(p)(4)(E)

7.1 General

IRC 6103(p)(4)(E) requires agencies receiving FTI to report on procedures established and used for ensuring the confidentiality of FTI that is received, processed, stored, or transmitted to or from the agency. The major components consisting of reporting requirements include the SSR, CAP and 45-day notification requirements.

Another measure IRS requires is internal inspections by the recipient agency. The purpose is to ensure that the security policies and procedures established by the agency to protect FTI are functioning, maintained and enforced. The agency must submit copies of these inspections to the IRS with the SSR (see Section 7.2, Safeguard Security Report). To provide an objective assessment, the inspection must be conducted by a function other than the using function.

7.1.1 Report Submission Instructions

Correspondence, reports, and attachments should be sent electronically to the Office of Safeguards using one of the following two methods:

The Office of Safeguards recommends that all required reports, when sent to the Office of Safeguards via email, be transmitted using IRS-approved encryption methods to protect sensitive information. Agencies are requested to adhere to the following guidelines to use encryption:

Please remember, while the attachment is encrypted, the content of the email message will not be encrypted, so it is important that any sensitive information be contained in the attachment (encrypted document).

7.2 Safeguard Security Reports

Agencies executing data exchange agreements involving access to FTI and subject to safeguarding requirements must provide evidence that adequate safeguard protections and controls are in place before IRS will authorize the release of FTI. The agency must submit an initial SSR for approval at least 90 days prior to the agency planned date for receipt of FTI.

7.2.1 Initial SSR Submission Instructions -- New Agency Responsibilities

In order to obtain initial IRS approval to receive FTI, an agency new to the Safeguard Program must have an approved SSR. To facilitate IRS approval, the agency is expected to:

Table 5 - Evidentiary Requirements for SSR approval before release of FTI

 ----------------------------------------------------------------------

Refer to the SSR template on the Office of Safeguards website for additional guidance and instructions for completing the document.

7.2.2 Agencies Requesting New FTI Data Streams

The following documents need to be on file or submitted by an agency currently receiving FTI with an approved SSR and seeking additional FTI under newly assigned program authority or expanded statutory authority under IRC 6103. To obtain IRS approval to for a a new FTI data stream, the agency must have established compliance with existing safeguarding standards and have available for IRS will review:

The agency must update and submit the SSR annually to encompass any changes that impact the protection of FTI. Example changes include, but are not limited to:

7.2.4 SSR Update Submission Dates

The SSR submission and all associated attachments must be sent annually to identify changes to safeguarding procedures. The annual update portion of the SSR should include a description of updates or changes that have occurred during the applicable reporting period. The CAP must also be submitted with the SSR (see Section 7.3, Corrective Action Plan, for additional CAP requirements).

Submission due dates are defined according to geographic locations or if the organization is a federal agency.

Table 6 - SSR Due Dates

 ----------------------------------------------------------------------

When extenuating circumstances exist, agencies may request an Annual SSR extension, in 30 day increments, for a maximum of 60 days. Extension requests should be submitted not later than (NLT) 30 days prior to the scheduled SSR due date. Request for extensions will not be considered after the scheduled SSR due date. A request for a second extension must be accompanied by a draft SSR.

Extension requests should be sent to the Office of Safeguards via Secure Data Transfer (SDT) or email to SafeguardReports@irs.gov, with the subject SSR extension request and reasons for the request. All extension requests will be evaluated on a case by case basis. Safeguards will provide an email response, approving or disapproving the request within 5 work days after receipt of the request.

7.3 Corrective Action Plan

The CAP represents the corrective actions described in the SRR. The IRS will provide each agency an SRR along with a CAP upon completion of an on-site review. The agency must develop the CAP to report on completed corrective actions as well as provide status updates to any unresolved or planned actions.

7.3.1 CAP Submission Instructions and Submission Dates

The agency must submit the CAP semi-annually, as an attachment to the SSR and on the CAP due date, which is six months from the scheduled SSR due date.

The CAP due dates are provided in the following chart.

Table 7 -- CAP Due Dates

 ------------------------------------------------------------

When extenuating circumstances exist, agencies may request an extension for no more than 30 days. Extension requests should be submitted not later than (NLT) 30 days prior to the scheduled CAP due date. Request for extensions will not be considered after the scheduled CAP due date. Extension requests should be sent to the Office of Safeguards via Secure Data Transfer (SDT) or email to SafeguardReports@irs.gov, with the subject CAP extension request and reasons for the request. All extension requests will be evaluated on a case by case basis. Safeguards will provide an email response, approving or disapproving the request within 5 work days after receipt of the request.

The CAP must be returned/submitted using the version sent by the Office of Safeguards with the SSR. The template should not be altered. The Planned Implementation Dates fields should not include any text; only numeric value and entered in mm/dd/yyyy format.

7.4 45-Day Notification Reporting Requirements

IRC 6103 limits the usage of FTI to only those purposes explicitly stated. Due to the security implications, higher risk of unauthorized disclosure and potential for unauthorized use of FTI based on specific activities conducted, the Office of Safeguards requires advanced notification (45 days) prior to implementing certain operations or technology capabilities that require additional uses of the FTI.

In addition to the initial receipt of FTI (see Section 2.1), the following circumstances or technology implementations require the agency to submit to the Office of Safeguards via the Office of Safeguards mailbox, at a minimum of 45 days ahead of the planned implementation, notification for the following activities that involve FTI:

Table 8 - 45-Day Notification Reporting Requirements

 ----------------------------------------------------------------------

7.4.1 Cloud Computing

Receiving, processing, storing, or transmitting FTI in a cloud environment requires prior notification to the Office of Safeguards. Refer to Section 9.4.1, Cloud Computing Environments, for guidance and details on 45-day notification requirements.

* Note: Advance approval is not required, only advance notification.

7.4.2 Consolidated Data Center

Agencies are required to notify the Office of Safeguards when moving IT operations to a consolidated data center. Refer to Section 5.4.2, Contractor- or Agency-Shared Facility--Consolidated Data Centers for additional information.

* Note: Advance approval is not required, only advance notification.

7.4.3 Contractor or Subcontractor Access

All agencies intending to re-disclose FTI to contractors must notify the IRS at least 45 days prior to the planned re-disclosure. Contractors consist of but are not limited to cloud computing providers, consolidated data centers, off-site storage facilities, shred companies, IT support, or tax modeling/revenue forecasting providers. The contractor notification requirement also applies in the circumstance where the contractor hires additional subcontractor services. Approval is required if the (prime) contractor hires additional subcontractor services in accordance with Exhibit 6, Contractor 45-Day Notification Procedures.

Notification is also required for contractors to perform statistical analysis, tax modeling, or revenue projections (see Section 2.4, State Tax Agency Limitations).

7.4.4 Data Warehouse Processing

No prior notification is required when an agency implements a data warehouse containing FTI. For additional data warehouse guidance, see Exhibit 10, Data Warehouse Security Requirements.

7.4.5 Non-Agency-Owned Information Systems

Under limited circumstances, the IRS may review requests for the use or access to FTI using a non-agency-owned information system (e.g., mobile devices, cloud environments, outsourced data centers). Notify the Office of Safeguards 45 days in advance of planned activities to use non-agency-owned information systems to receive, process, store, or transmit FTI. See Section 9.3.1.15 Use of External Information Systems (AC-20) for additional information.

7.4.6 Tax Modeling

The agency must notify the Office of Safeguards if planning to include FTI in statistical analysis, tax modeling, or revenue projections.

The Office of Safeguards will forward the notification to the IRS Statistics of Income for approval of the modeling methodology (see Section 2.4, State Tax Agency Limitations).

7.4.7 Live Data Testing

Agencies must submit a Data Testing Request (DTR) form to request approval to use live FTI in a testing environment. Refer to Section 9.4.6, Live Data Testing, for additional guidance on 45-day notification requirements.

7.4.8 Virtualization of Information Technology Systems

No prior notification is required when an agency is planning to receive, process, store, or transmit FTI in virtualized environments. For additional guidance, see Section 9.4.14, Virtualization Environments.

8.0 Disposing of FTI -- IRC 6103(p)(4)(F)

8.1 General

Users of FTI are required by IRC 6103(p)(4)(F) to take certain actions after using FTI to protect its confidentiality (see Exhibit 2, USC Title 26, IRC 6103(p)(4), and Exhibit 5, Civil Damages for Unauthorized Disclosure). Agency officials and employees either will return the information (including any copies made) to the office from which it was originally obtained or destroy the FTI. Agencies will include in their annual report (e.g., SSR) a description of the procedures implemented. See Section 7.0, Reporting Requirements--6103(p)(4)(E) for additional reporting requirements.

8.2 Returning IRS Information to the Source

Agencies electing to return IRS information must use a receipt process and ensure that the confidentiality is protected at all times during transport (see Section 4.4, FTI in Transit).

8.3 Destruction and Disposal

FTI furnished to the user and any paper material generated therefrom, such as copies, photo impressions, computer printouts, notes, and work papers, must be destroyed by burning or shredding. If a method other than burning or shredding is used, that method must make the FTI unreadable or unusable.

The following guidelines must be observed when destroying FTI:

Table 9 -- FTI Destruction Methods

 ----------------------------------------------------------------------

When using either method for destruction, every third piece of physical electronic media must be checked to ensure appropriate destruction of FTI.

Hand tearing, recycling, or burying information in a landfill are unacceptable methods of disposal.

8.4 Other Precautions

FTI must never be disclosed to an agency's agents or contractors during disposal without legal authorization and destruction must be witnessed by an agency employee.

The Department of Justice, state tax agencies, and SSA may be exempted from the requirement of having agency personnel witness destruction by a contractor. If a contractor is used:

9.1 General

This section details the computer security requirements agencies must meet to adequately protect FTI under their administrative control. While the Office of Safeguards has responsibility to ensure the protection of FTI, it is the responsibility of the agency to build in effective security controls into its own IT infrastructure to ensure that FTI is protected at all points where it is received, processed, stored, or transmitted. It will not be the intent of IRS to monitor each control identified but to provide these to the organization, identifying those controls required for the protection of moderate risk systems within the federal government.

All agency information systems used for receiving, processing, storing, or transmitting FTI must be hardened in accordance with the requirements in this publication. Agency information systems include the equipment, facilities, and people that collect, process, store, display, and disseminate information. This includes computers, hardware, software, and communications, as well as policies and procedures for their use.

Impact levels used in this document are described in Federal Information Processing Standards (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems. NIST publications are available at /taxbase/taxbasehttp://csrc.nist.gov/publications/PubsSPs.html

The computer security framework was primarily developed using guidelines specified in NIST SP 800-30 Revision 1, Guide for Conducting Risk Assessments, and NIST SP 800-53 Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations. Only applicable NIST SP 800-53 controls are included in this publication as a baseline. Applicability was determined by selecting controls required to protect the confidentiality of FTI. Agencies are encouraged to review supplemental guidance provided within NIST SP 800-53.

Section 2.7.2 Computer Security Review Process for information on the on-site review process.

9.3 NIST SP 800-53 Control Requirements

9.3.1 Access Control

9.3.1.1 Access Control Policy and Procedures (AC-1)

The agency must:

The agency must:

9.3.1.3 Access Enforcement (AC-3)

The information system must enforce:

The information system must enforce approved authorizations for controlling the flow of FTI within the system and between interconnected systems based on the technical safeguards in place to protect the FTI.

Additional requirements for protecting the flow of FTI can be found in:

The agency must:

The agency must:

The information system must:

9.3.1.8 System Use Notification (AC-8)

The information system must:

9.3.1.9 Session Lock (AC-11)

The information system must:

The information system must automatically terminate a user session after 30 minutes of inactivity.

This control addresses the termination of user-initiated logical sessions in contrast to SC-10 which addresses the termination of network connections that are associated with communications sessions (i.e., network disconnect). A logical session (for local, network, and remote access) is initiated whenever a user (or process acting on behalf of a user) accesses an organizational information system.

9.3.1.11 Permitted Actions without Identification or Authentication (AC-14)

The agency must:

9.3.1.12 Remote Access (AC-17)

The agency must:

Any remote access where FTI is accessed over the remote connection must be performed using multi-factor authentication.

FTI cannot be accessed remotely by agency employees, agents, representatives, or contractors located offshore--outside of the United States territories, embassies, or military installations. Further, FTI may not be received, processed, stored, transmitted, or disposed of by IT systems located offshore.

9.3.1.13 Wireless Access (AC-18)

The agency must:

Additional requirements for protecting FTI on wireless networks are provided in Section 9.4.18, Wireless Networks.

9.3.1.14 Access Control for Mobile Devices (AC-19)

A mobile device is a computing device that (i) has a small form factor such that it can easily be carried by a single individual; (ii) is designed to operate without a physical connection (e.g., wirelessly transmit or receive information); (iii) possesses local, non-removable, or removable data storage; and (iv) includes a self-contained power source.

The agency must:

9.3.1.15 Use of External Information Systems (AC-20)

Unless approved by the Office of Safeguards, the agency must prohibit:

9.3.1.16 Information Sharing (AC-21)

The agency must restrict the sharing/re-disclosure of FTI to only those authorized in IRC 6103 and as approved by the Office of Safeguards.

9.3.1.17 Publicly Accessible Content (AC-22)

The agency must:

9.3.2.1 Security Awareness and Training Policy and Procedures (AT-1)

The agency must:

The agency must:

Insider threat training should bring awareness of the potential for individuals (e.g., employees, contractors, former employees) to use insider knowledge of sensitive agency information (e.g., security practices, systems that hold sensitive data) to perform malicious actions, which could include the unauthorized access or redisclosure of FTI.

9.3.2.3 Role-Based Security Training (AT-3)

The agency must provide role-based security training to personnel with assigned security roles and responsibilities:

Note: Training conducted under this section is distinct from Section 6.3, Disclosure Awareness, and Section 9.3.2.2, Security Awareness Training (AT-2).

9.3.2.4 Security Training Records (AT-4)

The agency must:

9.3.3.1 Audit and Accountability Policy and Procedures (AU-1)

The agency must:

Security-relevant events must enable the detection of unauthorized access to FTI data. Auditing must be enabled to the greatest extent necessary to capture access, modification, deletion, and movement of FTI by each unique user.

The agency must:

9.3.3.3 Content of Audit Records (AU-3)

The information system must:

The agency must allocate audit record storage capacity to retain audit records for the required audit retention period of seven years.

9.3.3.5 Response to Audit Processing Failures (AU-5)

The information system must:

The agency must:

Table 10 -- Proactive Auditing Methods to Detect Unauthorized Access to FTI

 ----------------------------------------------------------------------

9.3.3.7 Audit Reduction and Report Generation (AU-7)

The information system must provide an audit reduction and report generation capability that:

The information system must:

The information system must protect audit information and audit tools from unauthorized access, modification, and deletion.

The agency must authorize access to manage audit functionality only to designated security administrator(s) or staff other than the system and network administrator. System and network administrators must not have the ability to modify or delete audit log entries. (CE4)

9.3.3.10 Audit Record Retention (AU-11)

The agency must retain audit records for the events identified in Section 9.3.3.2, Audit Events (AU-2) for seven years to provide support for after-the-fact investigations of security incidents and to meet regulatory and agency information retention requirements.

9.3.3.11 Audit Generation (AU-12)

The information system must:

The agency must employ mechanisms for coordinating the access and protection of audit information among external organizations when audit information is transmitted across agency boundaries.

This requirement applies to outsourced data centers or cloud providers. The provider must be held accountable to protect and share audit information with the agency through the contract.

See Section 9.4.1, Cloud Computing Environments for additional cloud computing requirements, including language for cloud computing requirements. Also see Section 5.4, Controls over Processing for information pertaining to consolidated data centers.

9.3.4 Security Assessment and Authorization

9.3.4.1 Security Assessment and Authorization Policy and Procedures (CA-1)

The agency must:

The agency must:

The agency must:

The agency must:

Additional information is available in Section 6.5, Plan of Action and Milestones.

9.3.4.5 Security Authorization (CA-6)

The agency must:

The agency must develop a continuous monitoring strategy and implement a continuous monitoring program that includes:

9.3.5.1 Configuration Management Policy and Procedures (CM-1)

The agency must:

The agency must develop, document, and maintain under configuration control, a current baseline configuration of the information system.

The agency must review and update the baseline configuration of the information system: (CE1)

9.3.5.3 Configuration Change Control (CM-3)

The agency must:

The agency must analyze changes to the information system to determine potential security impacts prior to change implementation.

9.3.5.5 Access Restrictions for Change (CM-5)

The agency must define, document, approve, and enforce physical and logical access restrictions associated with changes to the information system.

9.3.5.6 Configuration Settings (CM-6)

The agency must:

The agency must:

The agency must:

9.3.5.9 Configuration Management Plan (CM-9)

The agency must develop, document, and implement a configuration management plan for the information system that:

The agency must:

The agency must:

All FTI that is transmitted to agencies is backed up and protected within IRS facilities. As such, the focus of contingency planning controls is on the protection of FTI stored in backup media or used at alternative facilities and not focused on the availability of data. Agencies must develop applicable contingencies for ensuring that FTI is available, based upon their individual risk-based approaches.

9.3.6.1 Contingency Planning Policy and Procedures (CP-1)

The agency must:

The agency must:

The agency must provide contingency training to information system users consistent with assigned roles and responsibilities:

The agency must:

The agency must:

The agency must:

The agency must:

The agency must provide for the recovery and reconstitution of the information system to a known state after a disruption, compromise, or failure.

9.3.7 Identification and Authentication

9.3.7.1 Identification and Authentication Policy and Procedures (IA-1)

The agency must:

The information system must:

The information system must uniquely identify and authenticate devices before establishing a connection.

Organizational devices requiring unique device-to-device identification and authentication may be defined by type, device, or a combination. Information systems typically use of the following to identify and authenticate:

The agency must manage information system identifiers by:

The agency must manage information system authenticators by:

The information system obscures feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.

9.3.7.7 Cryptographic Module Authentication (IA-7)

The information system must implement mechanisms for authentication to a cryptographic module that meets the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

Validation provides assurance that when agency implements cryptography to protect FTI, the encryption functions have been examined in detail and will operate as intended.

All electronic transmissions of FTI must be encrypted using FIPS 140-2 validated cryptographic modules. A product does not meet the FIPS 140-2 requirements by simply implementing an approved security function. Only modules tested and validated to FIPS 140-2 meet the applicability requirements for cryptographic modules to protect sensitive information. NIST maintains a list of validated cryptographic modules on its website /taxbasehttp://csrc.nist.gov/

9.3.7.8 Identification and Authentication (Non-Organizational Users) (IA-8)

The information system must uniquely identify and authenticate non-agency users (or processes acting on behalf of non-agency users).

9.3.8 Incident Response

These incident response controls apply to both physical and information system security relative to the protection of FTI.

9.3.8.1 Incident Response Policy and Procedures (IR-1)

The agency must:

Agencies must train personnel with access to FTI, including contractors and consolidated data center employees if applicable, in their incident response roles on the information system and FTI. The agency must provide incident response training to information system users consistent with assigned roles and responsibilities:

Agencies entrusted with FTI must test the incident response capability at least annually.

9.3.8.4 Incident Handling (IR-4)

The agency must:

The agency must track and document all physical and information system security incidents potentially affecting the confidentiality of FTI.

9.3.8.6 Incident Reporting (IR-6)

The agency must:

9.3.8.7 Incident Response Assistance (IR-7)

The agency must provide an incident response support resource, integral to the agency incident response capability that offers advice and assistance to users of the information system for the handling and reporting of security incidents.

9.3.8.8 Incident Response Plan (IR-8)

The agency must:

The agency must respond to information spills by:

9.3.9.1 System Maintenance Policy and Procedures (MA-1)

The agency must:

The agency must:

The agency must approve, control, and monitor information system maintenance tools.

9.3.9.4 Non-Local Maintenance (MA-4)

The agency must:

The agency must:

Information system media is defined to include both digital and non-digital media.

9.3.10.1 Media Protection Policy and Procedures (MP-1)

The agency must:

The agency must restrict access to digital and non-digital media containing FTI to authorized individuals.

9.3.10.3 Media Marking (MP-3)

The agency must label information system media containing FTI to indicate the distribution limitations and handling caveats.

The agency must label removable media (CDs, DVDs, diskettes, magnetic tapes, external hard drives and flash drives) and information system output containing FTI (reports, documents, data files, back-up tapes) indicating "Federal Tax Information". Notice 129-B IRS provided labels can be used for this purpose.

9.3.10.4 Media Storage (MP-4)

The agency must:

9.3.10.5 Media Transport (MP-5)

The agency must:

See Section 4.4, FTI in Transit, for more information on transmittals and media transport requirements.

9.3.10.6 Media Sanitization (MP-6)

The agency must:

The agency must restrict the use of information system media (e.g., diskettes, magnetic tapes, external/removable hard drives, flash/thumb drives, CDs, DVDs) on information systems that receive, process, store, or transmit FTI using physical or automated controls.

Additional requirements for protecting FTI during media sanitization are provided in Section 9.3.10.6, Media Sanitization (MP-6); Section 9.4.7, Media Sanitization; and Exhibit 10, Data Warehouse Security Requirements.

9.3.11 Physical and Environmental Protection

9.3.11.1 Physical and Environmental Protection Policy and Procedures (PE-1)

The agency must:

The agency must:

The agency must:

The agency must control physical access within agency facilities.

9.3.11.5 Access Control for Output Devices (PE-5)

The agency must control physical access to information system output devices to prevent unauthorized individuals from obtaining the output.

Monitors, printers, copiers, scanners, fax machines, and audio devices are examples of information system output devices.

9.3.11.6 Monitoring Physical Access (PE-6)

The agency must:

The agency must:

9.3.11.8 Delivery and Removal (PE-16)

The agency must authorize, monitor, and control information system components entering and exiting the facility and maintain records of those items.

9.3.11.9 Alternate Work Site (PE-17)

The agency must:

9.3.11.10 Location of Information System Components (PE-18)

The agency must position information system components within the facility to minimize potential damage from physical and environmental hazards and to minimize the opportunity for unauthorized access.

For additional guidance, see Section 4.3, Restricted Area Access, and Section 4.5, Physical Security of Computers, Electronic, and Removable Media.

9.3.12 Planning

9.3.12.1 Security Planning Policy and Procedures (PL-1)

The agency must:

An approved and accurate SSR satisfies the requirements for the SSP (see Section 7.0, Reporting Requirements--6103(p)(4)(E)).

The agency must:

The agency must:

(See also Section 5.1.1 Background Investigation Minimum Requirements)

9.3.13.1 Personnel Security Policy and Procedures (PS-1)

The agency must:

(See also Section 5.1.1 Background Investigation Minimum Requirements)

The agency must:

(See also Section 5.1.1 Background Investigation Minimum Requirements)

The agency must:

The agency, upon termination of individual employment must:

The agency must:

Before authorizing access to FTI, the agency must:

The agency must:

The agency must:

9.3.14.1 Risk Assessment Policy and Procedures (RA-1)

The agency must:

The agency must:

The agency must:

9.3.15.1 System and Services Acquisition Policy and Procedures (SA-1)

The agency must:

The agency must:

The agency must:

The agency must include the following requirements, descriptions, and criteria, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and agency mission/business needs:

9.3.15.5 Information System Documentation (SA-5)

The agency must:

The agency must apply information system security engineering principles in the specification, design, development, implementation, and modification of the information system.

Security engineering principles include, for example:

The agency must:

The contract for the acquisition must contain Exhibit 7 language, as appropriate (see Section 9.3.15.4, Acquisition Process (SA-4), and Exhibit 7, Safeguarding Contract Language).

9.3.15.8 Developer Configuration Management (SA-10)

The agency must require the developer of the information system, system component, or information system service to:

The agency must require the developer of the information system, system component, or information system service to:

The agency must replace information system components (specifically security patches and/or product updates) when support for the components is no longer available from the developer, vendor, or manufacturer. During a Safeguards on-site review, any unsupported system that is identified will not be tested and will result in a critical finding.

9.3.16 System and Communications Protection

9.3.16.1 System and Communications Protection Policy and Procedures (SC-1)

The agency must:

The information system must separate user functionality (including user interface services) from information system management functionality.

9.3.16.3 Information in Shared Resources (SC-4)

The information system must prevent unauthorized and unintended information transfer via shared system resources.

9.3.16.4 Denial of Service Protection (SC-5)

The information system must protect against or limit the effects of denial of service attacks.

Refer to NIST SP 800-61 R2, Computer Security Incident Handling Guide, for additional information on denial of service.

9.3.16.5 Boundary Protection (SC-7)

The information system must:

The agency must limit the number of external network connections to the information system. (CE3)

The agency must: (CE4)

The information system must, in conjunction with a remote device, prevent the device from simultaneously establishing non-remote connections with the system and communicating via some other connection to resources in external networks. (CE7)

Additional requirements for protecting FTI on networks are provided in Section 9.4.10, Network Protections.

9.3.16.6 Transmission Confidentiality and Integrity (SC-8)

Information systems that receive, process, store, or transmit FTI, must:

This control applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, fax machines).

9.3.16.7 Network Disconnect (SC-10)

The information system must terminate the network connection associated with a communications session at the end of the session or after 30 minutes of inactivity.

This control addresses the termination of network connections that are associated with communications sessions (i.e., network disconnect) in contrast to user-initiated logical sessions in AC-12.

9.3.16.8 Cryptographic Key Establishment and Management (SC-12)

The agency must establish and manage cryptographic keys for required cryptography employed within the information system.

Cryptographic key management and establishment can be performed using manual procedures or automated mechanisms with supporting manual procedures.

9.3.16.9 Cryptographic Protection (SC-13)

The information system must implement cryptographic modules in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

9.3.16.10 Collaborative Computing Devices (SC-15)

The information system must:

9.3.16.11 Public Key Infrastructure Certificates (SC-17)

The agency must issue public key infrastructure certificates or obtain public key infrastructure certificates from an approved service provider.

9.3.16.12 Mobile Code (SC-18)

The agency must:

9.3.16.13 Voice over Internet Protocol (SC-19)

The agency must:

9.3.16.14 Session Authenticity (SC-23)

The information system must protect the authenticity of communications sessions. This control addresses communications protection at the session level versus the packet level (e.g., sessions in service-oriented architectures providing Web-based services) and establishes grounds for confidence at both ends of communications sessions in ongoing identities of other parties and in the validity of information transmitted.

9.3.16.15 Protection of Information at Rest (SC-28)

The information system must protect the confidentiality and integrity of FTI at rest. Information at rest refers to the state of information when it is located on storage devices as specific components of information systems.

Agencies may employ different mechanisms to achieve confidentiality and integrity protections, including the use of cryptographic mechanisms, file share scanning, and integrity protection. Agencies may also employ other security controls, including, for example, secure offline storage in lieu of online storage, when adequate protection of information at rest cannot otherwise be achieved or when continuously monitoring to identify malicious code at rest.

The confidentiality and integrity of information at rest shall be protected when located on a secondary (non-mobile) storage device (e.g., disk drive, tape drive) with cryptography mechanisms

FTI stored on deployed user workstations, in non-volatile storage, shall be encrypted with FIPS-validated or National Security Agency (NSA)-approved encryption during storage (regardless of location) except when no approved encryption technology solution is available that addresses the specific technology.

Mobile devices do require encryption at rest (see Section 9.3.1.14, Access Control for Mobile Devices (AC-19), and Section 9.4.8, Mobile Devices).

9.3.17 System and Information Integrity

9.3.17.1 System and Information Integrity Policy and Procedures (SI-1)

The agency must:

The agency must:

9.3.17.3 Malicious Code Protection (SI-3)

Malicious code protection includes antivirus software and antimalware and intrusion detection systems.

The agency must:

Information system entry and exit points include, for example, firewalls, electronic mail servers, Web servers, proxy servers, remote access servers, workstations, notebook computers, and mobile devices. Malicious code includes, for example, viruses, worms, Trojan horses, and spyware. Malicious code can also be encoded in various formats (e.g., UUENCODE, Unicode), contained within compressed or hidden files or hidden in files using steganography. Malicious code can be transported by different means, including, for example, Web accesses, electronic mail, electronic mail attachments, and portable storage devices.

9.3.17.4 Information System Monitoring (SI-4)

The agency must:

Information system monitoring capability is achieved through a variety of tools and techniques (e.g., intrusion detection systems, intrusion prevention systems, malicious code protection software, scanning tools, audit record monitoring software, network monitoring software).

Strategic locations for monitoring devices include, for example, selected perimeter locations and nearby server farms supporting critical applications, with such devices typically being employed at the managed interfaces.

9.3.17.5 Security Alerts, Advisories, and Directives (SI-5)

The agency must:

The agency must:

The information system must check the validity of information inputs.

9.3.17.8 Error Handling (SI-11)

The information system must:

The agency must handle and retain information within the information system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.

9.3.17.10 Memory Protection (SI-16)

The information system must implement safeguards to protect its memory from unauthorized code execution.

Some adversaries launch attacks with the intent of executing code in non-executable regions of memory or in memory locations that are prohibited. Security safeguards employed to protect memory include, for example, data execution prevention and address space layout randomization. Data execution prevention safeguards can either be hardware-enforced or software-enforced, with hardware providing the greater strength of mechanism.

9.3.18 Program Management

9.3.18.1 Senior Information Security Officer (PM-2)

The agency must appoint a senior information security officer with the mission and resources to coordinate, develop, implement, and maintain an agency-wide information security program.

The security officer described in this control is an agency official. This official is the senior information security officer. Agencies may also refer to this official as the senior information security officer or chief information security officer.

9.4 Additional Computer Security Requirements

9.4.1 Cloud Computing Environments

Background

As defined by NIST, "Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model promotes availability and is composed of five essential characteristics, three service models, and four deployment models."

While cloud computing offers many potential benefits, it is not without risk. The primary security concerns with cloud computing are:

The risk to data varies in each of the four deployment models, with private cloud typically being the lowest risk model and public cloud being the highest risk model. Depending on the deployment model, compensating controls can be accepted in place of the mandatory requirements, but those compensating controls must provide the same level of protection as mandatory controls for safeguarding FTI.

The service and deployment model used in a cloud computing environment will determine the responsibility for security controls implementation between the agency and the cloud provider for the protection of FTI that is stored or processed in the cloud environment. The delineation of security control responsibility is heavily dependent on the service and deployment models of the solution the agency is adopting. For example, if the solution is an SaaS email solution, the agency may be responsible for a small subset of security control responsibilities. If the agency is deploying its own applications to a PaaS or IaaS solution, it will have greater responsibility for securing the application layer and potentially the platform and middleware.

Requirements

The following mandatory controls are applicable for all cloud service and deployment models. However, as stated earlier, depending on the deployment model, compensating controls can be accepted in place of the mandatory requirements provided that those compensating controls afford the same level of protection as mandatory controls for safeguarding FTI. Potential compensating controls will be evaluated by the Office of Safeguards, as part of the cloud computing notification (see first requirement).

To use a cloud computing model to receive, process, store, or transmit FTI, the agency must be in compliance with all requirements in this publication. The following mandatory requirements are in effect for introducing FTI to a cloud environment:

9.4.2 Data Warehouse

The concept of data warehousing consists of a collection of multi-dimensional integrated databases that are used to provide accessible information to clients or end users. The data can be manipulated through different categories or dimensions to facilitate analyzing data in relational databases. The result can provide the client or end user with an enterprise view or snapshot of the information.

Security requirements apply to data warehousing environments, as well as to typical networked environments.

Section 5.2 and Exhibit 10, Data Warehouse Security Requirements, provide unique requirements for this environment.

Additional data warehouse security requirements are available on the Office of Safeguards website.

9.4.3 Email Communications

A written policy must be established and distributed which covers the agency's rules concerning email of FTI. If FTI is prohibited from inclusion within emails or email attachments, the policy must clearly state the actions that will be taken if FTI is inadvertently emailed.

If FTI is allowed to be included within emails or email attachments, the agency must only transmit FTI to an authorized recipient and must adhere to the following requirements:

A written policy must be established and distributed which covers the agency's rules concerning faxing of FTI. If FTI is prohibited from inclusion within fax communications, the policy must clearly state the actions that will be taken if FTI is inadvertently faxed.

If FTI is allowed to be included within fax communications, the agency must only transmit FTI to an authorized recipient and must adhere to the following requirements:

To use an Integrated Voice Response (IVR) system that provides FTI over the telephone to a customer, the agency must meet the following requirements:

9.4.6 Live Data Testing

The use of live FTI in test environments should generally be avoided and is not authorized unless specifically approved by the Office of Safeguards through the submission of a Data Testing Request (DTR) form.

The IRS defines live data as primarily unmodified, non-sanitized data extracted from taxpayer files that identifies specific individual or corporate taxpayers and includes taxpayer information or tax return information. The use of live data in testing environments is limited to tax administration or other authorized IRS purposes and may be disclosed only to those individuals with a need-to-know.

Any systems within pre-production testing environments ideally will be configured according to requirements in this publication. However the Office of Safeguards understands most agencies may not be able to fully implement all Publication 1075 requirements in a test environment.

Agencies wishing to use live FTI data in pre-production must submit a DTR to the IRS Office of Safeguards for authority to use live data for testing, providing a detailed explanation of the safeguards in place to protect the data and the necessity for using live data during testing.

Need and Use Justification statements should be revised to cover this use of IRS data, if not already addressed. State taxing agencies should check their statements (agreements) to see if "testing purposes" is covered.

Testing efforts that use live FTI data primarily fall into two categories: one-time testing and ongoing testing.

An example of a one-time testing use of live FTI data would be for system testing that is done prior to a new system implementation and, once testing has validated that the data will work properly, the live FTI data is not required to continue to remain in the test environment. For one-time testing efforts, the Office of Safeguards requires the FTI to be deleted from systems and databases upon completion of testing efforts and that the hard drive of the test systems be cleared electronically prior to repurposing the system for other state agency testing efforts.

Duration for ongoing test activities will be agreed upon as part of the live data request process. Some examples of ongoing testing efforts include:

The type of sanitization performed depends on whether or not the media:

The following media sanitization requirements are required:

9.4.8 Mobile Devices

Background

Mobile devices (e.g., smartphones, tablets) provide several unique security and management challenges when used to access corporate resources, including sensitive data. Mobile devices can store vast amounts of data and, by default, security options are not enabled. This leaves the devices vulnerable to allowing an unauthorized person to gain access to the information stored on them or accessed through them. In addition, due to the portable nature of mobile devices, they are susceptible to loss or theft. Another challenge to maintaining security of mobile devices is effectively tracking mobile device inventory. Bring your own device (BYOD) presents additional security and privacy challenges, as it may not be possible to fully manage security of personally owned devices; BYOD for access to FTI must, therefore, be restricted to access to e-mail where FTI is encrypted. These unique challenges highlight the need to increase the security posture of mobile devices to ensure the protection of FTI that may be stored on or accessed from a mobile device.

Requirements

To use FTI in a mobile device environment, the agency must meet the following mandatory requirements:

9.4.9 Multi-Functional Devices and High Volume Printers

To use FTI in a multi-functional device (MFD) or High Volume Printer, the agency must meet the following requirements:

Agencies must implement boundary protection devices throughout their system architecture, including routers, firewalls, switches, and intrusion detection systems.

Any publicly accessible servers used in the receipt, process, transmission, or storage of FTI must be placed into an enclave.

Network address translation (NAT) must be implemented at the public traffic demarcation point on the network. If NAT is not implemented at the agency's boundary firewall or router, then it must be implemented on each firewall or router that protects network segments that contain infrastructure components which receive, process, store, or transmit FTI.

The agency's managed interfaces employing boundary protection must deny network traffic by default and allow network traffic by exception (e.g., deny all, permit by exception). All remote traffic must migrate through a managed interface. Firewalls shall be configured to prohibit any transmission control protocol (TCP) or user datagram protocol service or other protocol/service that is not explicitly permitted (i.e., deny by default).

Inbound services shall be prohibited, unless a valid business case can establish their necessity.

See Section 9.3.16.5, Boundary Protection (SC-7). Additional network protection requirements are available on the Office of Safeguards website.

9.4.11 Storage Area Networks

Background

A storage area network (SAN) is a network whose purpose is to transfer data among information systems and the storage elements in high speed. SANs achieve economy of scale by eliminating the need to manage storage from multiple vendors and platforms.

The typical components of a SAN can be broken down into the host layer, the fabric layer, and the storage layer that comprise the networking infrastructure, management devices that organize connection, storage devices/elements, and client computer systems. The storage layer, where FTI resides, comprises physical disk drives, disk arrays, tape libraries, and other storage media.

SAN components that are most vulnerable to attack include connection points between servers, management devices, and IP-based devices. The fundamental issues are that most SAN protocols do not require device authentication and that it is relatively simple to join the SAN fabric with a spoofing and session hijacking technique.

Requirements

To use FTI in a SAN environment, the agency must meet the following mandatory requirements:

9.4.12 System Component Inventory

The agency must maintain a current inventory of information systems that receive, process, store, or transmit FTI in both production and pre-production environments. Updates to the inventory should be a critical step when implementing installations, removals, and updates to the information system. The inventory should accurately reflect and be consistent with the security domain of the current information system to enable the detection of unauthorized access to FTI within production and pre-production environments.

The IRS does not mandate the particular details or a specific format required to capture the inventory of systems with FTI. However, as part of the on-site safeguard review, the IRS will evaluate the agency's inventory to provide a level of assurance that the inventory is comprehensive of all systems that receive, process, store, or transmit FTI in production and pre-production environments.

Additional system component inventory guidance is available on the Office of Safeguards website.

9.4.13 Virtual Desktop Infrastructure

Background

A virtual desktop infrastructure (VDI) provides users access to enterprise resources, including a virtual desktop from locations both internal to and external to the agency's networks. In a VDI environment, a user can access FTI by connecting to a virtual workstation via a vendor-specific agent, connection client, or through an Internet browser from practically any mobile device with Internet access.

This requirement is applicable to VDI environments in which agency-owned and/or non-agency-owned equipment (including personally-owned devices) may be used as the client for the virtual desktop. The agency must demonstrate that despite the ownership and operational location of the client, FTI remains subject to the safeguard requirements and the highest level of attainable security.

Requirements

To use VDI as a means of remote access to FTI and systems that store, transmit, process and/or receive FTI, the agency must meet the following mandatory requirements:

9.4.14 Virtualization Environments

Background

NIST SP 800-125 defines full virtualization as, "the simulation of the software and/or hardware upon which other software runs." This simulated environment is called a virtual machine (VM). There are many forms of virtualization, distinguished primarily by computing architecture layer.

Requirements

To use a virtual environment that receives, processes, stores, or transmits FTI, the agency must meet the following mandatory requirements:

9.4.15 VoIP Systems

Background

VoIP is the transmission of voice over packet-switched networks. VoIP systems include a variety of components, such as call processors/call managers, gateways, routers, firewalls, and protocols. Data, in the form of a digitized voice conversation, is enclosed in a packet and transported via a data network to a voice gateway that converts voice calls between the IP network and the public switched telephone network. In FTI implementations, this means that telephone conversations between agency personnel and their taxpayer customers where FTI is discussed as part of the conversation are transmitted across the network as a data packet.

Requirements

To use a VoIP network that provides FTI to a customer, the agency must meet the following mandatory requirements:

9.4.16 Web-Based Systems

To use an external Web-based system or website (web portal) that provides FTI over the Internet to a customer the agency must meet the following requirements:

Background

The core functions of the Web browser include retrieving information over a network connection (Internet or private network), presenting the information to the users, and sending the information back to the source for a complete transaction. With an increasing amount of information being delivered to the end user via the Web browser, client-side exploits are a growing concern. Web browsers are at the frontline of information security. Most importantly, the default configuration of a Web browser does not provide adequate security. These requirements apply when FTI is accessed through a Web browser.

Requirements

To access FTI using a Web browser, the agency must meet the following mandatory requirements:

9.4.18 Wireless Networks

Background

A wireless environment is one in which a user can connect to a LAN without physically connecting a device(s) through a wired Ethernet connection. A wireless local area network (WLAN) uses radio waves to broadcast network connectivity to anyone who is within a limited receiving range, such as an office building. WLANs are usually implemented as extensions to existing wired LANs using wireless switches or access points to deliver connectivity to wireless clients, such as laptops or mobile devices. Because of the broadcast and radio nature of wireless technology, ensuring confidentiality is significantly more difficult in a wireless network than a wired network.

These requirements address the security requirements for 802.11 wireless networks that are to be used to receive, process, store, or transmit FTI. This includes wireless networks located at the agency's office or data center from where FTI is received, processed, stored, or transmitted.

Requirements

To use FTI in an 802.11 WLAN, the agency must meet the following mandatory requirements:

10.0 Reporting Improper Inspections or Disclosures

10.1 General

Upon discovering a possible improper inspection or disclosure of FTI, including breaches and security incidents, by a federal employee, a state employee, or any other person, the individual making the observation or receiving information must contact the office of the appropriate special agent-in-charge, TIGTA immediately, but no later than 24 hours after identification of a possible issue involving FTI. Call the local TIGTA Field Division Office first.

Table 11 -- TIGTA Field Division Contact Information

 ----------------------------------------------------------------------

Hotline Number: 800-589-3718

TIGTA Homepage: https://http://www.treasury.gov/tigta

Mailing Address: Treasury Inspector General for Tax Administration Ben Franklin Station P.O. Box 589 Washington, DC 20044-0589

10.2 Office of Safeguards Notification Process

Concurrent to notifying TIGTA, the agency must notify the Office of Safeguards by email to Safeguards mailbox, safeguardreports@irs.gov. To notify the Office of Safeguards, the agency must document the specifics of the incident known at that time into a data incident report, including but not limited to:

Even if all information is not available, immediate notification is the most important factor, not the completeness of the data incident report. Additional information must be provided to the Office of Safeguards as soon as it is available.

The agency will cooperate with TIGTA and Office of Safeguards investigators, providing data and access as needed to determine the facts and circumstances of the incident.

10.3 Incident Response Procedures

The agency must not wait to conduct an internal investigation to determine if FTI was involved in an unauthorized disclosure or data breach. If FTI may have been involved, the agency must contact TIGTA and the IRS immediately.

Incident response policies and procedures required in Section 9.3.8, Incident Response, must be used when responding to an identified unauthorized disclosure or data breach incident.

The Office of Safeguards will coordinate with the agency regarding appropriate follow-up actions required to be taken by the agency to ensure continued protection of FTI. Once the incident has been addressed, the agency will conduct a post-incident review to ensure the incident response policies and procedures provide adequate guidance. Any identified deficiencies in the incident response policies and procedures should be resolved immediately. Additional training on any changes to the incident response policies and procedures should be provided to all employees, including contractors and consolidated data center employees, immediately.

10.4 Incident Response Notification to Impacted Individuals

Notification to impacted individuals regarding an unauthorized disclosure or data breach incident is based upon the agency's internal incident response policy since the FTI is within the agency's possession or control.

However, the agency must inform the Office of Safeguards of notification activities undertaken before release to the impacted individuals. In addition, the agency must inform the Office of Safeguards of any pending media releases, including sharing the text, prior to distribution.

10.5 FTI Suspension, Termination, and Administrative Review

The federal tax regulation 26 CFR 301.6103(p)(7)-1 establishes a process for the suspension or termination of FTI and an administrative review if an authorized recipient has failed to safeguard returns or return information. For more information, refer to Exhibit 3, U.S.C Title 26, CFR 301.6103(p)(7)-1.

11.0 Disclosure to Other Persons

11.1 General

Disclosure of FTI is prohibited unless authorized by statute. Agencies having access to FTI are not allowed to make further disclosures of that information to their agents or to a contractor unless authorized by statute.

Agencies are encouraged to use specific language in their contractual agreements that clearly state the requirements necessary to protection the confidentiality of FTI and avoid ambivalence or ambiguity. See the model language of Exhibit 7, for additional guidance on appropriate language to be used in the contract, see Exhibit 6, Contractor 45-Day Notification Procedures.

Absent specific language in the IRC or where the IRC is silent in authorizing an agency to make further disclosures, the IRS' position is that further disclosures are unauthorized.

11.2 Authorized Disclosure Precautions

When disclosure is authorized, the agency must take certain precautions prior to engaging a contractor, namely:

Engaging a contractor who may have incidental or inadvertent access to FTI, and will not be performing services which require authorized access to FTI, does not fall under these requirements. An agency may not contract for the disclosure of FTI which is not authorized by IRC 6103. Only contracts for services which require access to FTI to perform their duties under the contract are required to comply with these standards.

11.3 Disclosing FTI to Contractors

The agency must notify the Office of Safeguards prior to re-disclosing FTI to contractors. The agency must notify and obtain written approval from the Office of Safeguards prior to re-disclosing FTI to sub-contractors. (see Section 7.0, Reporting Requirements--6103(p)(4)(E), and Section 7.4, 45-Day Notification Reporting Requirements, for additional information).

In addition to the notification, the agency must:

In rare circumstances, under the authority of IRC 6103(p)(2)(B), the IRS may execute and an agreement with an agency which authorizes the re-disclosure of FTI to another entity. These agreements are negotiated and approved by the IRS Headquarters Office of Disclosure with concurrence of the Office of Safeguards.

Federal agencies authorized by statute to enter into re-disclosure agreements are required to provide a copy of the executed agreement to the Office of Safeguards within 30 days of execution. The electronic copy must be sent to the Office of Safeguards via SDT. If SDT is not available, the agreement may be emailed to the SafeguardReports@irs.gov mailbox.

12.0 Return Information in Statistical Reports

12.1 General

IRC 6103 authorizes the disclosure of FTI to specific federal agencies for use in statistical reports, tax administration purposes, and certain other purposes specified in IRC 6103(j). Statistical reports may only be released in a form that cannot be associated with, or otherwise identify, directly or indirectly, a particular taxpayer.

Agencies authorized to produce statistical reports must adhere to the following guidelines or an equivalent alternative that has been approved by the IRS:

Federal agencies seeking statistical information from the IRS must make their requests under IRC 6103(j). The requests must be addressed to:

Director, Statistics of Income Division Internal Revenue Service, OS:P:S 1111 Constitution Avenue, NW Washington, D.C. 20224

12.3 State Tax Agency Statistical Analysis

State tax agencies must provide written notification and obtain IRS approval prior to performing tax modeling, revenue estimation, or other statistical activities involving FTI. The agency must demonstrate that the activity is required for tax administration purposes. The agency must adhere to the following process to submit a request:

^‡ Refer to http://www.irs.gov/uac/IRS-Disclosure-Offices for contact information.

12.4 Making a Request under IRC 6108

State agencies seeking statistical information from the IRS must make requests under IRC 6108 and submit the request to the mailing address specified in Section 12.2, Making a Request under IRC 6103(j). A charge will be assessed for this service.

Exhibit 1 USC Title 26, IRC 6103(a) and (b)

IRC SEC. 6103. CONFIDENTIALITY AND DISCLOSURE OF RETURNS AND RETURN INFORMATION

Inspection

The terms "inspected" and "inspection" means any examination of a return or return information.

Disclosure

The term "disclosure" means providing return or return information known to any person.

Federal agency

The term "Federal agency" means an agency within the meaning of section 551 (1) of Title 5, United States Code.

Chief executive officer

The term "chief executive officer" means, with respect to any municipality, any elected official and the chief official (even if not elected) of such municipality

Terrorist incident, threat, or activity

The term "terrorist incident, threat, or activity" means an incident, threat, or activity involving an act of domestic terrorism (as defined in section 2331 (5) of Title 18, United States Code) or international terrorism (as defined in section 2331(1) of such title).

Exhibit 2 USC Title 26, IRC 6103(p)(4)

Any Federal agency described in subsection (h)(2), (h)(5), (i)(1), (2), (3), (5), or (7), (j)(1), (2), or (5), (k)(8), (l)(1), (2), (3), (5), (10), (11), (13), (14), or (17), or (o)(1), the General Accounting Office, the Congressional Budget Office, or any agency, body, or commission described in subsection (d), (i)(3)(B)(i) or (7)(A)(ii), or (l)(6), (7), (8), (9), (12), (15), or (16) or any other person described in subsection (l)(16), (17), (19), (20) or (21) shall, as a condition for receiving returns or return information--

USC Title 26, Section 6103(p)(4), requires external agencies and other authorized recipients of federal tax return and return information (FTI) to establish procedures to ensure the adequate protection of the FTI they receive. That provision of the United States Code also authorizes the IRS to take actions, including suspending or terminating FTI disclosures to any external agencies and other authorized recipients, if there is misuse, or if the safeguards in place are inadequate to protect the confidentiality of the information, or both.

Procedures for administrative review of a determination that an authorized recipient has failed to safeguard returns or return information:

IRC SEC. 7213 UNAUTHORIZED DISCLOSURE OF INFORMATION

IRC SEC. 7431 CIVIL DAMAGES FOR UNAUTHORIZED INSPECTION OR DISCLOSURE OF RETURNS AND RETURN INFORMATION.

Federal agencies, state tax agencies, and state child support enforcement agencies in the possession of FTI may use contractors, sometimes in limited circumstances.

Agencies must notify the IRS prior to executing any agreement to disclose FTI to a contractor, or at least 45 days prior to the disclosure of FTI, to ensure that appropriate contractual language is included and that contractors are held to safeguarding requirements. Further, any contractors authorized access to or possession of FTI must notify and secure the approval of the IRS prior to making any redisclosures to subcontractors. For additional information, see Section 7.4.3, Contractor or Subcontractor Access.

To provide agency notification of intent to enter into an agreement to make disclosures of FTI to a contractor, submit a letter in electronic format, on agency letterhead over the head of agency's signature, to SafeguardReports@irs.gov. Ensure that the letter contains the following specific information:

If the 45-day notification pertains to the use of a contractor to conduct tax modeling, estimate revenue, or employ FTI for other statistical purposes, the agency must also submit a separate statement detailing the methodology and data to be used by the contractor. The Office of Safeguards will forward the methodology and data statement to the IRS Statistics of Income office for approval of the methodology (see Section 7.4.3). Templates can be located on the Office of Safeguards website.

If the 45-day notification is not possible, please contact the Safeguards mailbox at SafeguardReports@irs.gov for assistance.

Exhibit 7 Safeguarding Contract Language

CONTRACT LANGUAGE FOR GENERAL SERVICES

I. PERFORMANCE

In performance of this contract, the Contractor agrees to comply with and assume responsibility for compliance by his or her employees with the following requirements:

The IRS and the Agency, with 24 hour notice, shall have the right to send its inspectors into the offices and plants of the contractor to inspect facilities and operations performing any work with FTI under this contract for compliance with requirements defined in IRS Publication 1075. The IRS' right of inspection shall include the use of manual and/or automated scanning tools to perform compliance and vulnerability assessments of information technology (IT) assets that access, store, process or transmit FTI. On the basis of such inspection, corrective actions may be required in cases where the contractor is found to be noncompliant with contract safeguards.

CONTRACT LANGUAGE FOR TECHNOLOGY SERVICES

I. PERFORMANCE

In performance of this contract, the contractor agrees to comply with and assume responsibility for compliance by his or her employees with the following requirements:

The IRS and the Agency, with 24 hour notice, shall have the right to send its inspectors into the offices and plants of the contractor to inspect facilities and operations performing any work with FTI under this contract for compliance with requirements defined in IRS Publication 1075. The IRS' right of inspection shall include the use of manual and/or automated scanning tools to perform compliance and vulnerability assessments of information technology (IT) assets that access, store, process or transmit FTI. On the basis of such inspection, corrective actions may be required in cases where the contractor is found to be noncompliant with contract safeguards.

Exhibit 8 Warning Banner Examples

A warning banner is required when access is provided to any information system that receives, processes, stores, or transmits FTI. The following elements, as explained in Section 9.3.1.8, System Use Notification (AC-8), must be contained within the warning banner: (i) the system contains U.S. Government information, (ii) user actions are monitored and audited, (iii) unauthorized use of the system is prohibited, and (iv) unauthorized use of the system is subject to criminal and civil sanctions.

The following warning banners are acceptable examples for use by agencies.

WARNING

This system may contain U.S. Government information, which is restricted to authorized users ONLY. Unauthorized access, use, misuse, or modification of this computer system or of the data contained herein or in transit to/from this system constitutes a violation of Title 18, United States Code, Section 1030, and may subject the individual to criminal and civil penalties pursuant to Title 26, United States Code, Sections 7213, 7213A (the Taxpayer Browsing Protection Act), and 7431. This system and equipment are subject to monitoring to ensure proper performance of applicable security features or procedures. Such monitoring may result in the acquisition, recording, and analysis of all data being communicated, transmitted, processed, or stored in this system by a user. If monitoring reveals possible evidence of criminal activity, such evidence may be provided to Law Enforcement Personnel.

ANYONE USING THIS SYSTEM EXPRESSLY CONSENTS TO SUCH MONITORING.

The following two banners are approved by the Department of Justice for systems that have limited space for the warning banner.

WARNING! BY ACCESSING AND USING THIS GOVERNMENT COMPUTER SYSTEM, YOU ARE CONSENTING TO SYSTEM MONITORING FOR LAW ENFORCEMENT AND OTHER PURPOSES. UNAUTHORIZED USE OF, OR ACCESS TO, THIS COMPUTER SYSTEM MAY SUBJECT YOU TO CRIMINAL PROSECUTION AND PENALTIES.

WARNING! THIS SYSTEM CONTAINS U.S. GOVERNMENT INFORMATION. BY ACCESSING AND USING THIS COMPUTER SYSTEM, YOU ARE CONSENTING TO SYSTEM MONITORING FOR LAW ENFORCEMENT AND OTHER PURPOSES. UNAUTHORIZED USE OF, OR ACCESS TO, THIS COMPUTER SYSTEM MAY SUBJECT YOU TO STATE AND FEDERAL CRIMINAL PROSECUTION AND PENALTIES AS WELL AS CIVIL PENALTIES.

Exhibit 9 Record Retention Schedules

The Office of Safeguards requires the retention of FTI logs only. FTI should be destroyed after use or according to the agency record retention schedule.

Table 12 - Record Retention Schedules

 ----------------------------------------------------------------------

When an agency implements a data warehouse, the agency must provide written notification to the Office of Safeguards, identifying the security controls, including FTI identification and auditing within the data warehouse. The written notification shall be submitted using SDT or to the SafeguardReports@irs.gov mailbox at least 45 days before implementation. In addition, the agency should update section 9.4.2 Data Warehouse when they submit their annual SSR.

Purpose

The purpose of this document is to provide an overview of data warehousing and data storage concepts and to define the security requirements necessary to protect these environments. Although some security controls may replicate those contained in this publication, such redundancy is necessary so that Exhibit 10 can be used as a stand-alone document. As a rule, all requirements contained within the main text of this publication also apply to any data warehousing environments used by federal, state, or local agencies, and these environments incorporate FTI. These requirements also apply to authorized representatives, agents, or contractors with access to FTI.

This document is intended to describe the controls that are specific to data warehousing-type environments. As the term data warehousing is used, the concepts are applied to all complex data environments, including data warehousing, data mining, and data marts.

Audience

This document is intended for federal, state, and local agencies, as well as authorized representatives, agents, or contractors with access to FTI. The document is to be used as a planning document and is intended to support the development and deployment of data warehousing architectures, as well as architectures of a similar environment, such as data marts.

Background

A data warehouse is a structure that is designed to distribute data from multiple arenas to the primary enterprise system. A data mart is a structure designed for access, which is used to facilitate client user support. A data warehouse receives, collects, extracts, transforms, transports, and loads data for a distribution to various data marts.

In the context of FTI within agencies, the data warehouse stores data sets, which contain specific taxpayer information as well as summary information and historical data.

A data warehouse is structured to separate analysis from transaction work and allows a large amount of data to be consolidated from several sources. The security controls remain constant with operational enterprises and are applicable to a data warehouse.

In a data warehouse, the scope of security changes with respect to the different dimensions of data management. Information enters a data warehouse through a staging area where it goes through a process of extraction, transformation, and loading. This process is referred to as ETL. In addition, a data warehouse is operated by query or a search engine tool. Through the use of end-to-end security, the data warehouse ensures the confidentiality, privacy, and integrity of FTI. The security of the data warehouse must include all aspects of the warehouse, including hardware, software, data transport, and data storage.

Data Warehousing Implications

FTI placed in a data warehouse environment may be used only for "tax administration" purposes or for other authorized purposes defined within this publication. As part of the data warehouse, FTI data must retain its identity as FTI to the data element level (i.e., it must be obvious that the IRS is the source of the data). Whenever calculations or data manipulations are performed that could commingle FTI with any other data, the access to FTI must be restricted to agency staff with a need-to-know and their contractors or agents as authorized by law. This requirement is defined in the primary publication but is reinforced here for clarification.

Security

Security controls for data warehousing concepts are derived from NIST SP 800-53, Recommended Security Controls for Federal Information Systems. These controls address the areas of management, operational, and technical controls.

When all controls are implemented and managed, these controls provide effective safeguards for the confidentiality, integrity reliability, and availability of the data. For this document, the defined controls have been mapped to the classes and families of the NIST SP 800-53 to allow technical personnel to easily review NIST controls and understand how these apply to security environments.

The next sections define specific and unique controls related to data warehousing environments. If no additional controls are required, the sections identify this fact.

Management Controls

The following section identifies high-level management controls that shall be used within a data warehousing environment.

Risk Assessment

The agency shall have a risk management program in place to ensure that each aspect of the data warehouse is assessed for risk. Any risk documents shall identify and document all vulnerabilities associated with the data warehousing environment.

Planning

Planning is crucial to the development of a new environment. A security plan shall be in place to address organizational policies, security testing, rules of behavior, contingency plans, architecture and network diagrams, and requirements for security reviews. Although such a security plan will provide planning guidelines, it does not replace requirements documents, which contain specific details and procedures for security operations.

Policies and procedures are required to define how activities and day-to-day procedures will occur. They contain the specific policies, relevant to all of the security disciplines covered in this document. Because they relate to data warehousing, any data warehousing documents can be integrated into overall security procedures. A section shall be dedicated to the data warehouses to define the controls specific to that environment.

The agency must develop policies and procedures to document all existing business processes. The agency must ensure that roles are identified for the organization and develop responsibilities for the roles.

Within the security planning and policies, the purpose or function of the warehouse shall be defined. The business process shall include a detailed definition of configurations and the functions of the hardware and software involved. In general, the planning shall define any unique issues related to data warehousing.

The agency must define how "legacy system data" will be brought into the data warehouse and how the legacy data that is FTI will be cleansed for the ETL transformation process.

The policy shall ensure that FTI will not be subject to public disclosure. Only authorized users with a demonstrated need-to-know can query FTI data within the data warehouse.

System and Services Acquisition

Acquisition security needs to be explored. Because FTI is used within data warehousing environments, it is important that the services and acquisitions have adequate security in place, including the capacity to block information to contractors in cases in which they are not authorized to access FTI.

Certification, Accreditation, and Security Assessments

Certification, accreditation, and security and risk assessments are accepted best practices used to ensure that appropriate levels of control exist, that they are being managed, and that they are compliant with all federal and state laws or statutes.

State and local agencies shall develop a process or policy to ensure that data warehousing security meets the baseline security requirements defined in the current revision of NIST SP 800-53. The process or policy must contain the methodology used by the state or local agency to inform management, define accountability, and address known security vulnerabilities. Risk assessments must follow the guidelines provided in NIST Publication 800-30, Risk Management Guide for Information Technology Systems.

Operational Controls

The following section identifies high-level operational controls that shall be used within a data warehousing environment.

Personnel Security See Section 5.1.1 Background Investigation Minimum Requirements

Physical Security and Environmental Protection

There are no additional physical security controls for a data warehousing environment. However, the physical security requirements throughout this publication apply to the physical location that hosts the data warehouse hardware.

Contingency Planning

Online data resources shall be provided adequate tools for the backup, storage, restoration, and validation of data. Agencies will ensure that the data provided is reliable.

Both incremental and special purpose data backup procedures are required, combined with off-site storage protections and regular test-status restoration to validate disaster recovery and business process continuity. Standards and guidelines for these processes are bound by agency policy and are tested and verified. Although already addressed in this publication, the agency's contingency plan must be evaluated to ensure that all data resources are synchronized and restored to allow re-creation of the data to take place.

Configuration Management

The agency shall have a process and documentation to identify and analyze how FTI is used and how FTI is queried or targeted by end users. Parts of the system containing FTI shall be mapped to follow the flow of the query from a client through the authentication server to the release of the query from the database server. During the life cycle of the data warehouse, online and architectural adjustments and changes will occur. The agency shall document these changes and ensure that FTI always is secured from unauthorized access or disclosure.

Maintenance

There are no unique maintenance requirements for data warehousing environments.

System and Information Integrity

There are no unique system and information integrity requirements for data warehousing environments.

Media Protection

The agency shall have policy and procedures in place that describe the cleansing process at the staging area and how the ETL process cleanses the FTI when it is extracted, transformed, and loaded. In addition, the agency shall describe the process of object reuse once FTI is replaced from data sets. IRS requires that all FTI be removed by a random overwrite software program.

Incident Response

Intrusion-detection software shall be installed and maintained to monitor networks for any unauthorized attempt to access tax data. The agency's incident reporting policy and procedures must cover the data warehousing environment as well.

Awareness and Training

The agency shall have a disclosure awareness training program in place that includes how FTI security requirements are communicated to end users. Training shall be user-specific to ensure that all personnel receive appropriate training for a particular job, such as training required for administrators or auditors.

Technical Controls

The following section identifies high-level technical controls that shall be used within a data warehousing environment.

Identification and Authentication

The agency shall configure the Web services to be authenticated before access is granted to users via an authentication server. The Web portal and two-factor authentication requirements in Section 9.0 apply in a data warehouse environment.

Business roles and rules shall be imbedded at either the authentication level or application level. In either case, roles must be in place to ensure that only authorized personnel have access to FTI information.

Authentication shall be required both at the operating system level and at the application level, whenever the data warehousing environment is accessed.

Access Control

Access to systems shall be granted based upon the need to perform job functions. Agencies shall identify which application programs use FTI and how access to FTI is controlled. The access control to application programs relates to how file shares and directories apply file permissions to ensure that only authorized personnel have access to the areas that contain FTI.

The agency shall have security controls in place that include preventive measures to keep an attack from being a success. These security controls shall also include detective measures in place to let the IT staff know that an attack is occurring. If an interruption of service occurs, the agency shall have additional security controls in place that include recovery measures to restore operations.

Within the data warehouse, the agency shall protect FTI as sensitive data and be granted access to FTI for the aspects of its job responsibilities. The agency shall enforce effective access controls so that end users have access to programs with the least privilege needed to complete the job. The agency shall set up access controls in its data warehouse based on personnel clearances. Access controls in a data warehouse are classified in general as follows.

All FTI shall have an owner assigned to provide responsibility and accountability for its protection. Typically, this role is assigned to a management official such as an accrediting authority.

The agency shall configure control files and data sets to enable the data owner to analyze and review both authorized and unauthorized accesses.

The database servers that control FTI applications will copy the query request and load it to the remote database to run the application and transform its output to the client. Therefore, access controls must be implemented at the authentication server.

Web-enabled application software shall do the following:

The agency shall ensure that audit reports are created and reviewed for data warehousing related access attempts.

A data warehouse must capture all changes made to data, including additions, modifications, or deletions by each unique user. If a query is submitted, the audit log must identify the actual query made, the originator of the query, and relevant time and stamp information. For example, if John Doe makes a query to determine the number of people that earn more than $50,000, the audit log would store the fact that John Doe made such a query and its content. The results of the query would not be as significant as the type of query made.

System and Communication Protection

Whenever FTI is located on both production and test environments, these environments are to be segregated. Such action is especially important in the development stages of the data warehouse.

All Internet transmissions are to be encrypted with the use of HTTPS protocol and secure sockets layer encryption based on a certificate that contains a key no less than 128 bits in length, or FIPS 140-2 compliant, whichever is stronger. This encryption will allow information to be protected between the server and the workstation. Data is at its highest risk during the ETL stages when it enters the warehouse. Encryption shall occur as soon as possible. All sessions shall be encrypted and provide end-to-end encryption (i.e., from workstation to point of data).

Web server(s) that receive online transactions shall be configured in a "demilitarized zone" to receive external transmissions but still have some measure of protection against unauthorized intrusion.

Application server(s) and database server(s) shall be configured behind the firewalls for optimal security against unauthorized intrusion. Only authenticated applications and users shall be allowed access to these servers.

Transaction data shall be "swept" from the Web server(s) at frequent intervals, consistent with good system performance, and removed to a secured server behind the firewalls to minimize the risk that these transactions could be destroyed or altered by intrusion.

Antivirus software shall be installed and maintained with current updates on all servers and clients that contain tax data.

For critical online resources, redundant systems shall be employed with automatic failover capability.

Exhibit 11 Media Sanitization Techniques

The technique for clearing, purging, and destroying media depends on the type of media to be sanitized.

Table 13 -- Media Sanitization Techniques

 ----------------------------------------------------------------------

A

Accountability: A process of holding users responsible for actions performed on an information system.

Adequate security: Security commensurate with the risk and magnitude of harm resulting from the loss, misuse, unauthorized access to, or modification of information.

Affordable Care Act: U.S. federal statute signed into law on March 23, 2010, with the goal of expanding public and private insurance coverage and reducing the cost of healthcare for individuals and the government.

Alternative work site: Any working area that is attached to the wide area network either through a public switched data network or through the Internet.

Assurance: A measure of confidence that management, operational and technical controls are operating as intended and achieving the security requirements for the system.

Assurance testing: A process used to determine if security features of a system are implemented as designed, and are adequate for the proposed operating environment. This process may include hands-on functional testing, penetration testing, and/or verification.

Audit: An independent examination of security controls associated with a representative subset of organizational information systems to determine the operating effectiveness of system controls; to ensure compliance with established policy and operational procedures; and to recommend changes in controls, policy, or procedures where needed.

Audit trail: A chronological record of system activities sufficient to enable the reconstruction, review, and examination of security events related to an operation, procedure, or event in a transaction from its inception to final results.

Authentication: Verification of the identity of a user, process, or device, often as a prerequisite to allowing access to resources in an information system; see Identification.

Authorization: Access privileges granted to a user, program, or process.

Availability: Timely, reliable access to information and information services for authorized users.

B

Banner: Display of an information system, which outlines the parameters for system or information use.

Baseline security requirements: A description of the minimum security requirements necessary for an information system to enforce the security policy and maintain an acceptable risk level.

Blurring: The act of obscuring data so that it cannot be read or reconstructed.

C

Classified: National security information classified pursuant to Executive Order 12958.

Compromise: The disclosure of sensitive information to persons not authorized to receive such information.

Comingling: The presence of FTI and non-FTI data together on the same paper or electronic media.

Confidentiality: The preservation of authorized restrictions on information access and disclosure.

Configuration management: A structured process of managing and controlling changes to hardware, software, firmware, communications, and documentation throughout the system development life cycle.

Container: An object that can be used to hold or transport something.

Containerize: To package (freight) in uniform, sealed containers for shipment.

Control number: A code that identifies a unique document or record.

Control schedule: A record retention and disposal schedule established by the agency.

Corrective Action Plan (CAP): A report required to be filed semi-annually, detailing the agency's planned and completed actions to resolve findings identified during an IRS safeguard review.

Countermeasure: Action, device, procedure, mechanism, technique, or other measure that reduces the vulnerability of an information system.

Cryptography: The process of rendering plain text information unreadable and restoring such unreadable information to a readable form.

D

Data: A representation of facts, concepts, information, or instruction suitable for communication, processing, or interpretation by people or information systems.

Decryption: The process of converting encrypted information into a readable form. This term is also referred to as deciphering.

Degauss: To erase information electromagnetically from a magnetic disk or other storage device.

Digital subscription line: A public telecommunications technology that delivers high bandwidth over conventional copper wire that covers limited distances.

Discretionary access control: A method of restricting logical access to information system objects (e.g., files, directories, devices, permissions, rules) based on the identity and need-to-know of users, groups, or processes.

E

Encryption: See Cryptography.

Encryption algorithm: A formula used to convert information into an unreadable format.

Enterprise life cycle: A robust methodology used to implement business change and information technology modernization.

External network: Any network that resides outside the security perimeter established by the telecommunications system.

Extranet: A private data network that uses the public telephone network to establish a secure communications medium among authorized users (e.g., organization, vendors, business partners). An Extranet extends a private network (often referred to as an Intranet) to external parties in cases in which all parties may benefit from the exchange of information quickly and privately.

External information systems: See Non-Agency-Owned Equipment.

Exchange: An online marketplace in which individuals and small businesses can compare policies and buy insurance (with a government subsidy, if eligible).

F

File permission: A method of implementing discretionary access control by establishing and enforcing rules to restrict logical access of information system resources to authorized users and processes.

File server: A local area network computer dedicated to providing files and data storage to other network stations.

Firewall: Telecommunication device used to regulate logical access authorities between network systems.

Firmware: Microcode programming instructions permanently embedded into the read-only memory control block of a computer system. Firmware is a machine component of computer system, similar to a computer circuit component.

G

Gateway: An interface that provides compatibility between heterogeneous networks by converting transmission speeds, protocols, codes, or security rules. This interface is sometimes referred to as a protocol converter.

H

Host: A computer dedicated to providing services to many users. Examples of such systems include mainframes, minicomputers, or servers that provide dynamic host configuration protocol services.

I

Identification: A mechanism used to request access to system resources by providing a recognizable unique form of identification such as a Login ID, User ID, or token; see Authentication.

Information: See Data.

Information system: A collection of computer hardware, software, firmware, applications, information, communications, and personnel organized to accomplish a specific function or set of functions under direct management control.

Information system security: The protection of information systems and information against unauthorized access, use modification, or disclosure to ensure the confidentiality, integrity, and availability of information systems and information.

Integrity: The protection of information systems and information from unauthorized modification to ensure the quality, accuracy, completeness, nonrepudiation, and authenticity of information.

Internet: Two or more networks connected by a router; the world's largest network, which uses TCP/IP to connect government, university, and commercial institutions.

Intranet: A private network that uses TCP/IP, the Internet, and World Wide Web technologies to share information quickly and privately between authorized user communities, including organizations, vendors, and business partners.

K

Key: Information used to establish and periodically change the operations performed in cryptographic devices for the purpose of encrypting and decrypting information.

L

Least privilege: A security principle under which users or processes are assigned the most restrictive set of privileges necessary to perform routine job responsibilities.

M

Management controls: Security controls focused on managing organizational risk and information system security and devising sufficient countermeasures or safeguards to mitigate risk to acceptable levels. Management control families include risk assessment, security planning, system and services acquisition, and security assessment.

Malicious code: Rogue computer programs designed to inflict a magnitude of harm by diminishing the confidentiality, integrity, and availability of information systems and information.

N

Network: A communications infrastructure and all components attached thereto whose primary objective is to transfer information among a collection of interconnected systems. Examples of networks include local area networks, wide area networks, metropolitan area networks, and wireless area networks.

Node: A device or object connected to a network.

Non-Agency-Owned Equipment: Any technology used to receive, process, store, or transmit FTI that is not owned and managed by the agency but is owned by a contractor and centrally managed by their own IT department.

Nonrepudiation: The use of audit trails or secure messaging techniques to ensure the origin and validity of source and destination targets (i.e., senders and recipients of information cannot deny their actions).

O

Object reuse: The reassignment of a storage medium, which contains residual information, to potentially unauthorized users or processes.

Operational controls: Security controls focused on mechanisms primarily implemented by people as opposed to systems. These controls are established to improve the security of a group, a specific system, or group of systems. Operational controls require technical or specialized expertise and often rely on management and technical controls. Operational control families include personnel security, contingency planning, configuration management, maintenance, system and information integrity, incident response, and awareness and training.

Organization: An agency or, as appropriate, any of its operational elements.

P

Packet: A unit of information that traverses a network.

Password: A private, protected, alphanumeric string used to authenticate users or processes to information system resources.

Patient Protection and Affordable Care Act: See Affordable Care Act.

Penetration testing: A testing method by which security evaluators attempt to circumvent the technical security features of the information system in efforts to identify security vulnerabilities.

Personally identifiable information: Any information about an individual maintained by an agency with respect to, but not limited to, education, financial transactions, medical history, and criminal or employment history, and information that can be used to distinguish or trace an individual's identity (e.g., name, Social Security Number, date and place of birth, mother's maiden name, biometric records) including any other personal information linked or linkable to an individual.

Personally-Owned Devices: Any equipment purchased and owned by an individual, not owned by the agency or contractor and not managed by an IT department.

Plan of Action and Milestones (POA&M): A management tool used to assist organizations in identifying, assessing, prioritizing, and monitoring the progress of actions taken to correct security weaknesses found in programs and systems. The POA&M arises from agency-conducted internal inspections and highlights the corrections that result from such inspections (defined in OMB 02-01).

Potential impact: The loss of confidentiality, integrity, or availability that could be expected to have a limited adverse effect, a serious adverse effect, or a catastrophic adverse effect on organizational operations, organizational assets, or individuals.

Privileged user: A user that has advanced privileges with respect to computer systems. Such users in general include administrators.

Protocol: A set of rules and standards governing the communication process between two or more network entities.

R

Remnants: Residual information remaining on storage media after reallocation or reassignment of such storage media to different organizations, organizational elements, users, or processes. See Object reuse.

Residual risk: Portions of risk that remain after security controls or countermeasures are applied.

Risk: The potential adverse impact on the operation of information systems, which is affected by threat occurrences on organizational operations, assets, and people.

Risk assessment: The process of analyzing threats to and vulnerabilities of an information system to determine the potential magnitude of harm, and identify cost-effective countermeasures to mitigate the impact of such threats and vulnerabilities.

Risk management: The identification, assessment, and prioritization of risks.

Router: A device that forwards data packets between computer networks, creating an overlay internetwork.

S

Safeguards: Protective measures prescribed to enforce the security requirements specified for an information system; synonymous with security controls and countermeasures.

Security policy: The set of laws, rules, directives and practices governing how organizations protect information systems and information.

Security requirement: The description of a specification necessary to enforce the security policy. See Baseline security requirements.

Standard user: A general program user, who does not have administrative rights.

Switch: A computer networking device that links network segments or network devices.

System: See Information system.

System Security Plan: An official document that provides an overview of the security requirements for an information system and describes the security controls in place or planned for meeting those requirements (NIST SP 800-18).

T

Tax modeling: A large-scale microsimulation model of a tax system. Tax models come in all shapes and sizes, depending on the nature of the policy issues examined. The policy questions may relate to specific problems, concerning perhaps the revenue implications of a particular tax, or they may involve an extensive analysis of the cost and redistributive effects of a large number of taxes and transfer payments.

Technical controls: Security controls executed by the computer system through mechanisms contained in the hardware, software, and firmware components of the system. Technical security control families include identification and authentication, access control, audit and accountability, and system and communications protection.

Threat: An activity, event, or circumstance with the potential for causing harm to information system resources.

U

User: A person or process authorized to access an information system.

User identifier: A unique string of characters used by an information system to identify a user or process for authentication.

V

Virus: A self-replicating, malicious program that attaches itself to executable programs.

Voice over Internet Protocol (VoIP): A methodology and group of technologies for the delivery of voice communications and multimedia sessions over Internet protocol networks, such as the Internet.

Vulnerability: A known deficiency in an information system, which threat agents can exploit to gain unauthorized access to sensitive or classified information.

Vulnerability assessment: Systematic examination of an information system to determine its security posture, identify control deficiencies, propose countermeasures, and validate the operating effectiveness of such security countermeasures after implementation.