1.10.3. Standards for Using Email

(1) The Internal Revenue Service processes Sensitive But Unclassified (SBU) information. The definition of SBU information is any information that requires protection due to the risk and magnitude of loss or harm to the IRS or the privacy to which individuals are entitled under 5 United States Code (USC) Section 552a (the Privacy Act), which could result from inadvertent or deliberate disclosure, alteration, or destruction. See IRM 10.8.1, Information Technology (It) Security, Policy and Guidance, for guidance on Sensitive But Unclassified (SBU) information.

(2) Personally Identifiable Information (PII) is a specific type of sensitive information. PII includes the personal data of taxpayers, and also the personal information of employees, contractors, applicants and visitors to the IRS. Refer to the Personally Identifiable Information (PII) section of IRM 10.8.1 for additional PII guidance

(3) You should never consider email secure. Do not include taxpayer, SBU, or PII information in email messages or attachments unless you use IRS approved encryption technology.

(4) Use the Secure Enterprise Messaging System (SEMS, or "Secure Messaging") for sending Microsoft Outlook messages that contain SBU data. Secure Messaging enables you to digitally encrypt email messages and attachments for transmission among IRS email users including Criminal Investigation,, the Treasury Inspector General for Tax Administration (TIGTA), and Chief Counsel employees. In order for you to send a secure message through Outlook, both you and the recipient must have Secure Messaging installed. This allows authorized employees to transmit SBU information to other authorized employees within the system once they have been enrolled and received training.

(5) Secure Messaging enrollment is an automated process for all LAN accounts with an Exchange mailbox in IRS. You can find the instructions for configuring the Outlook client to use the certificates at the Secure Enterprise Messaging Systems (SEMS) web site: http://documentation.sems.enterprise.irs.gov/.

(6) Alternatively, you may encrypt files to be e-mailed as attachments using the latest software provided by IT. Instructions are provided at http://findit-mits.web.irs.gov/.

(7) Do not send emails containing SBU data to taxpayers or their authorized representatives, even if requested, because of the risk of improper disclosure or exposure. Do not email SBU data to other external stakeholders, unless specifically authorized. For details, see the interim guidance on PGLD-10-0616-0003. “Using IRS and Personal Email Accounts” (to be incorporated into the Email section of IRM IRM 10.5.1 Privacy Policy).

(1) Individuals seeking to commit fraud or intending harm to the IRS or its employees often engage in a type of"social engineering," called "phishing" wherein they use an alias and a seemingly innocuous cover story in order to gain the victim’s confidence and gather sensitive information. Such scammers may use email, and try to trick you into revealing your password, or personal information. If you receive a suspicious, bogus, or phishing email:

• Do not open any attachments

• Do not reply

• "Forward" the email to the electronic mailbox, (phishing@irs.gov)

• Delete the email after forwarding

(1) All federal employees and federal contractors are required by law to preserve records containing adequate and proper documentation of the organization, functions, policies, decisions, procedures, and essential transactions of the agency. Records must be properly stored and preserved, available for retrieval and subject to appropriate approved disposition schedules.

(2) The Federal Records Act applies to email records just as it does to records you create using other media. Emails are records when they are:

• Created or received in the transaction of agency business

• Appropriate for preservation as evidence of the government’s function and activities, or

• Valuable because of the information they contain

(3) If you create or receive email messages during the course of your daily work, you are responsible for ensuring that you manage them properly. The National Archives and Records Administration, in OMB M-12-18, notes that by December 31, 2016, federal agencies must manage all email records (both permanent and temporary) in an accessible electronic format. IRS offices must move or copy their record emails to a separate electronic recordkeeping system unless their system has the features specified in IRM IRM 1.15.6.6(2) that support records management and litigation requirements, including the capability to identify, retrieve and retain the records for as long as they are needed. Some offices may need to print and file email records (along with related transmission and receipt data) if those offices still maintain paper recordkeeping systems (i.e. case files).

(4) An email determined to be a federal record may eventually be considered as having permanent, historical value by the National Archives. Therefore, ensure that all your communications are professional in tone.

(1) The public is aware of the role emails play in agency internal operations and emails are included in a growing number of Freedom of Information Act (FOIA) requests. Emails that are responsive to a FOIA request must be released unless the information contained in the email falls into one of nine very specific categories of exemptions. (See IRM 11.3.13 for more on FOIA processing). There is no category of exemption to protect the author or the Service from embarrassment.

(2) Emails provided in response to a FOIA must include the addressee, date and time. The address list, date and time are considered part of the record for both FOIA and record management purposes.

(3) Do not delete a message or attachment that is the subject of a congressional, Freedom of Information Act (FOIA), or discovery request or that is needed for litigation.

(1) IRM IRM 10.8.27, Information Technology (IT) Security, Internal Revenue Service Policy On Limited Personal Use Of Government Information Technology Resources, defines the minimum standard for acceptable personal use of Government IT resources by IRS employees. The first exhibit, includes a summary of prohibited activities that includes creating, copying, transmitting, or retransmitting chain letters or other unauthorized mass mailings regardless of their subject matter.

(2) The Spam Protection section of IRM 10.8.1, states "Email spamming, sending or forwarding chain letters, other junk email, or inappropriate messages shall be prohibited." In addition, the Electronic Mail (Email) Security section of IRM 10.8.1 states "Any use of IRS IT resources, including email, shall be made with the understanding that such use may not be secure, is not private, is not anonymous and may be subject to disclosure under FOIA."

(3) If you receive an inappropriate email, please notify your immediate supervisor or your local Data Security Area. Do not forward it to your co-workers, friends or family, etc. You should delete the inappropriate email after notifying the proper authorities.

(1) To avoid slowing down transmission of information:

• Use Arial or another simple font on a plain background.

• Do not use animation, backgrounds, wallpapers, borders, graphics and photographs or any other graphic element as part of your stationery message format or signature. Exceptions will only be allowed for special IRS Commissioner initiatives.

• Refrain from sending large attachments to work groups or audiences. Remember every email message and any attachments, embedded graphics and photographs require a copy for each Exchange server store where each recipient’s mailbox resides. Instead store the document on an IRS public web archive or SharePoint repository and insert a hyperlink into the message. Ensure the permissions allow access by all recipients prior to sending the message.

(1) A meaningful subject line helps recipients prioritize their email. Categorize all email by type. Include only related information in a message. If there is another topic you wish to address, send it in a separate message. This makes it easier for the recipient to manage and respond to messages on different topics.

(2) Use the follow-up flag feature to identify items with required follow-up dates.

(1) Most email will be normal priority. Designate an email as high priority only if the receiver will need to act on the message immediately. If your message is truly urgent, consider trying to reach the recipient by phone or in person.

• "!" – High. Example – Computers will be down this weekend so overtime will not be scheduled and credit hours will not be approved. Example – We need volunteers for a task force in Washington that will convene in two weeks. Nominations are due this Friday.

• "blank" – Normal (the default)

• "down arrow"– Low. Example – The territory office of (another operating division) in another city has moved; its new address is…

(1) Most email is of normal sensitivity. Messages designated as "private" or "confidential" should not be forwarded – but the system allows for this. Marking a message with one of these settings is advisory only. Recipients can take any actions on the message that they want to, such as forwarding the message to others.

(2) To designate sensitivity, from the "View" menu, select "Options" then select the appropriate designation.

• Private – Example: Communications with Labor Relations about an issue involving a particular employee.

• Confidential – Example: A proposal you are sharing with someone for their input, but which has not been shared with those who will approve or implement the procedures.

• Normal (default)

(1) To improve the effectiveness of email, follow these rules of etiquette and common sense guidelines:

1. Consider whether email is the best method for your communication. Sometimes, two-way dialogue by phone, Office Communicator or in person may be more effective. At other times, email may be best if you need written documentation.

2. Choose your recipients carefully. When selecting from the global address list, watch for duplicate names. If you frequently send messages to the same individuals, put them in your Personal Address Book. If two or more individuals have the same names, check the employees’ properties in the Global Address List to ensure your intended recipient is the right person in the right location.

3. Do not use a distribution list (as a convenience to you) unless your message is appropriate for everyone on that list.

4. Use the subject line to categorize messages. Do not include any confidential or sensitive information in the subject line.

5. Forward messages only when necessary. Do not forward to people who have already received the message. Example: Do not resend Commissioner All-Employee messages.

6. Be concise.

7. Review your messages for accuracy in content, spelling, and punctuation. Hint: Set auto spell check to check all messages before sending and review any changes made .

8. If you say that a file is attached, attach it. Hint: attach the file before you compose the message.

9. Insert hypertext links to large documents stored on IRS document repositories.

10. Maintain your Inbox.

11. Respond promptly to messages.

12. Routinely purge your mailbox of purely personal messages and work-related non-record emails. Non-record messages include communications to all employees (i.e., IRS Headlines electronic newsletter), and information/reference email and word processing files received “for your information” or as a carbon copy (CC) in which you were not expected to and on which you did not take action.

13. Use the "To" address line for the primary recipient.

14. Use the carbon copy "cc" and blind carbon copy "bcc" features appropriately. Avoid copying people who do not need to see your message. In an internal office environment, it is rarely appropriate to use the "bcc" feature.

15. Use "Reply to all" only if all the original recipients need to know your response. Otherwise, reply only to the sender.

16. Never use "Reply to all" when you receive an email as a member of a large geographic or servicewide distribution list.

17. Use conversational grammar.

18. Do not use all caps or all lower case. Use punctuation.

19. Use the "out of office assistant" or " auto forward" features when you will be out of the office for an extended time.

20. If you receive any messages with a known or suspected virus, delete them immediately and report the matter appropriately .

21. Avoid background, stationery or graphics.

22. Use a simple font and font size that is easily readable. For example, 12 point Arial is generally easy to read.

23. To accommodate those with visual impairments, select font and background colors that provide sufficient contrast and avoid unusual color combinations. For example, use the default font color (usually black or blue) rather than selecting red or green, use the default background color rather than selecting a background color and do not use the text highlighting feature.

24. Help prevent unnecessary email by telling recipients when your message does not require a reply.

25. Manage your email more effectively by using Outlook features such as voting buttons and invitation options. It will be easier for recipients to respond and easier to manage and track the results.

(1) Large attachments can degrade overall system efficiency, so you should limit the transmission of large files as email attachments whenever possible.

(2) Consider alternatives for attachments larger than 10MB:

(3) If you are responding with an attachment, use "Forward " instead of "Reply" because attachments do not stay with replies.

(4) If you want to save the email message but do not need the attachment, follow these instructions:

• Open the message,

• Right click the attachment icon, and

• Select remove from the menu.

• Close file. Select "yes" at the "Do you want to Save changes?" prompt.

(1) Ensure attachments are safe from viruses. Open attachments only if you trust the source and are expecting the attached file. Because of the impact the spreading of worms and viruses have on the IRS network, the Enterprise Messaging System is now configured to block all files with particular extension. If a file is sent via email with certain extensions (such as .exe, .vbs and .lnk), the message will be deleted without delivery.

(2) A number of virus variants try to bypass the IRS virus scanning software by including their damaging payload within a .zip file. Be cautious with any message you receive containing an attachment with a .zip file extension, and only unzip the file only if you trust the source.

(3) When you receive an email message with an attachment, save both the email and the attachment to a hard drive or network drive as soon as possible and remove the message and attachment from your mailbox. You free up space on your server by doing so.

(1) Personal distribution lists are created by an individual user. Use your Outlook Help feature, keyword: personal distribution list, for instructions on creating and sharing personal lists.

(1) IT and the SEMS staff can create global distribution lists for groups of practically any size and for any situation. These distribution lists are available for use from the global address list on Outlook. The list owner determines who will be authorized to use the list.

(2) There are several different types of global distribution lists.

(1) Before using a global distribution list to send an email message that requires follow-up actions or commitment of resources by recipients outside of your division, always discuss the requirement with the applicable Division Commissioner’s office.

(1) Contact OSGetServices (1-866-743-5748) or TDD/TTY: 1-866-435-7486 to request creation of a new global distribution list (DL). You will need to provide the following information :

• Business need justification

• Scope – to whom it applies

• Anticipated "shelf life" of DL

• Name and number of the individual charged with maintaining the DL

• Proposed list of initial DL members

• If the list is automated, the conditional criteria of the members

(1) Distribution group/list managers can find information on modifying a list in the SEMS Documentation Library online at http://documentation.sems.enterprise.irs.gov/.

(1) Generally, information requiring communication to all employees is distributed via theIRS Headlines electronic newsletter. The C&L Internal Communications (IC) branch distributes IRS Headlines every Monday using the all-employee global distribution list. Content for IRS Headlines should contain information relevant to a cross-section of IRS managers and employees. Examples of items found in IRS Headlines are those that include:

• Deadlines

• Action Items

• Strategic priorities and

• Employee accomplishments

(2) If you think you have information appropriate for IRS Headlines, you should take the following steps:

1. Originator discusses topic and schedule with the business unit's communication office. (If none, contact IC directly http://irweb.irs.gov/AboutIRS/bu/cl/cldir/9296.aspx.)

2. Business unit communicator discusses topic and schedule with the IC liaison for that business unit.

3. IC determines whether the topic is appropriate for IRS Headlines.

4. Originator and business unit communicator draft message and submit it to IC.

5. IC will provide editorial feedback on content, length, tone, and key messages.

6. IC will schedule article for publication in the IRS Headlines electronic newsletter.

7. IC will suggest ways to incorporate message into other internal communications products, when appropriate.

(1) On rare occasions, special circumstances may require the issuance of an all-employee email separate from IRS Headlines … and more. Any message submitted for distribution as an all-employee email will be subject to a stringent review process. The communications manager in your business unit is your initial point of contact when deciding whether to start the process of creating an all-employee email.

(2) When submitting a message for distribution to all employees, you must provide the following information:

• Significance to employees (Is there something they must know immediately to do their jobs correctly, to comply with the law, to prevent a systems failure, etc.?)

• Reason for extreme time sensitivity (Why is this information so critical to employees that it cannot wait for inclusion in the next edition of Headlines?)

• Necessity of email delivery instead of Headlines or other method (Why does this information have to be sent via a special email? Why wouldn’t IRWeb (intranet) or Headlines be more appropriate ?)

• Desired outcome (What immediate action do you want employees to take?)

• Business objective

(3) The C&L Internal Communication Branch will determine the best method of communicating the message based on the information submitted.