11.3.36. Safeguard Review Program

(1) Agencies executing data exchange agreements involving access to FTI subject to safeguarding requirements must have an approved SSR prior to having access to FTI. Publication 1075Section 7.2.1 Initial SSR Submissions Instructions. The SSR must be submitted for IRS Safeguards approval at least 90 days prior to the agency receiving FTI.

(2) The agency must address all elements in the SSR template at http://www.irs.gov/uac/Safeguards-Program additionally the initial SSR must contain the evidentiary requirements (artifacts) are focused on:

1. Controls that in their absence would potentially leave FTI exposed to a threat

2. IRS-specific controls that are critical for the protection of FTI.

(3) The Office of Safeguards will perform a comprehensive review of the agency’s entire SSR and each control description for compliance with standards to understand the agency’s overall security posture before approving the SSR and may request additional artifacts as needed.

(1) General:

1. Responsible officers or employees.

2. Functional organizations using the data.

3. Computer facilities or equipment and system security.

4. Physical security.

5. Retention policy and disposal methods.

(2) Safeguard activities shall include , a minimum, the following items:

1. Disclosure Awareness Program- Describe the efforts to inform all employees an contractors having access to FTI of the confidentiality requirements of the Internal Revenue Code, the agency’s security requirements, and the sanctions imposed for unauthorized inspection or disclosure of FTI.

2. Functional organizations using the data

3. Computer Facilities or Equipment and System Security- Changes or enhancements

4. Physical Security- Changes or enhancements.

(3) Agency Disclosure Awareness Program -The agency should describe the efforts to inform all employees having access to FTI of the confidentiality requirements of the IRC, the agency’s security requirements, and the sanctions imposed for unauthorized inspection or disclosure of return information.

(4) Reports of Internal Inspections -The agency should provide copies of a representative sampling of the Inspection Reports and a narrative of the corrective actions taken (or planned) to correct any deficiencies should be included with the annual SSR.

(5) Disposal of FTI -The agency should report the disposal or return of FTI to the IRS or source. The information should be adequate to identify the material destroyed and the date and manner of destruction, including copies of destruction logs.

(6) Other information -The agency should provide other information to support the protection of FTI, in accordance with IRC §6103(p)(4) requirements.

(7) Planned Actions Affecting Safeguard Procedures --Any planned agency or contractor action which would create a major change to current agency procedures or safeguards will be reported. Such major changes would include, but are not limited to, new computer equipment, facilities or systems to perform programming, processing or administrative services requiring access to FTI.

(8) Agency Use of Contractors - Agencies must account for the use of all contractors, permitted by law or regulation, to do programming processing or administrative services requiring access to FTI.

(1) Preparation of an Annual SSR begins with a review of the previous SSR submission:

• Cover outstanding actions list

• Identify areas where there is no change (NC)

• Identify areas that are not applicable (NA)

• Address content changes

(2) When agency requests extension to file their annual SSR, refer them Publication 1075 Section 7.2.2 SSR Update Submission Dates

(1) Agencies are required to submit an annual SSR encompassing any changes that impact the protection of FTI:

• New data exchange agreements.

• New computer equipment, systems, or applications (hardware or software).

• New facilities; and

• Organization changes, such as moving IT operations to a consolidated data center from an embedded IT operation.

(2) The following information must be updated in the SSR to reflect updates or change regarding the agency or safeguarding procedures within the reporting period:

• Changes to information or procedures previously reported

• Current annual period safeguard activities

• Planned actions affection safeguard procedures

• Agency use of contractors (non-agency employees)

(3) Location of the Data- Include an organization chart or narrative description of the receiving agency organization, which includes all functions where tax data must be processed or maintained. If the information is to be used or processed by more than one function, t hen the pertinent information must be included for each function.

(4) Flow of the Data- The report must contain a flow chart or narrative description of:

1. The agency flow of the FTI data from is receipt through its return to the IRS or its final destruction

2. How FTI is to be used or processed

3. How FTI is tracked and protected as it passes through the organizational levels within the agency

4. Describe how FTI is commingled with agency data or separated

5. Describe the paper or electronic products created from FTI

6. Where contractors are involved in the flow of FTI including,

(5) System of Records- A description of the permanent record(s) used to document requests for, receipt of, dissemination of (if applicable), and final disposition (return to the IRS or destruction) of the FTI (including all electronic media). Agencies and their contractors are expected to be able to provide an "audit trail "for all information requested and received; the trail is to also include copies or distribution beyond the original document/media.

(6) Secure Storage of the Data The agency will provide a description of the security measures employed to provide secure storage for the FTI when it is not in current use. Secure storage encompasses such diverse considerations as locked files or containers, secured facilities, key or combination control, off-site data storage facilities, and restricted areas.

(7) Restricting Access to the Data- A description of the procedures or safeguards to ensure access of FTI is limited to those individuals who have authorized access and have a need to know. Describe any physical barriers to how the information will be protected from unauthorized access when in use by the authorized recipient. Describe any physical barriers to unauthorized disclosure (including all security features where FTI is assessed, used or processed) as well as systemic and/or procedural barriers.

(8) Disposal- For all FTI provided by the IRS, and/or produced by the agency and/or contractor (e.g., print-outs, back-up tapes and the like), and not returned to the IRS, provide written agency report that documents the method of destruction by which records were destroyed (See paragraph (5), System of Records above)

(9) Information Technology (IT) Security The written report must describe all automated information systems and networks that receive, process, store, or transmit FTI. We not that all such systems are required to have safeguard measures in place which address all key components of IT security to restrict access to sensitive data. See Publication 1075, Section 9.0. The written report should :

1. Describe the systemic controls employed to ensure all IRS data is safeguarded from authorized access or disclosure

2. Include the procedures to be employed to ensure secure storage of the disks and the data, limit access to the disk(s), or computer screens, and the destruction of the data

3. Have additional comments regarding the safeguards employed to ensure the protection of the computer

4. Describe in detail the security precautions undertaken if the agency’s computer systems are connected or planned to be connected to other systems.

5. The SSR must include procedures for ensuring that all data is safeguarded from unauthorized access or disclosure.

(10) Disclosure Awareness Program- Each agency and contractor who receives returns and return information must have an awareness program wherein employees having access to FTI certify annually of the training received and receipt of the confidentiality provisions of the Internal Revenue Code, as well as, the civil and criminal sanctions for unauthorized inspections or disclosure of FTI. A description of the formal program should be included in the SSR.

(1) Delinquent Safeguard Security Reports (SSR) with incomplete information should initially be resolved through informal telephone contact between the reviewer and the agency.

(2) If a SSR is missing critical information to determine whether FTI is adequately, protected, reasonable attempts, including at least one written request, must be made to obtain the missing information.

(3) Formal procedures to withhold FTI will be initiated if an agency fails to:

1. Send in an acceptable report or

2. Send in the requested material or

3. Take action to correct a deficiency

(4) Reasonable attempts, including at least one written request, must be made to obtain missing information, or corrective action to be implemented .

(5) If an SSR deficiency is minor and will not cause unauthorized disclosures, and the deficiency cannot be immediately corrected then the report will be accepted with the deficiencies noted with the comment in the SSR.

(6) If a control has not been fully implemented, document the current state of the control and anticipated implementation date.

(7) Completing Review Process

1. The reviewer will complete the transmittal letter that is sent to the agency, the SSR Analysis, SSR Acceptance Checklist and Deliverable Acceptance Form.

2. Load documents to the Documents file on e-Trak, make a case note on e-Trak with the actions taken, update the Comments field on the case with the status, update Email Notification Comments field on the case and submit the package to quality review.

3. Upon completion of the review, the SSR will be submitted to the head of the agency via U.S. mail and via softcopy to the agency POC.

   Note: It is 60 calendar days from receipt of a SSR to deliver the approval back to the agency. Of these 60 days, DES/CSR has 35 days to conduct the analysis and submit to quality review.

(1) In order to promote uniformity in the format of SRR and to ensure that all reviews and reports address the key areas of the IRS’s safeguard requirements, all SRR will be prepared according to this standard format.

(2) Title Page or Cover Sheet- Each report will have a cover sheet, which must be updated with the agency specific information:

1. The State, Municipality or Federal Agency.

2. Agency name an in parenthesis specific agency state/fed abbreviation, agency code and agency type.

Example: MAXX-DOR or FDXX-FED-XXX

3. Month/Year of Report (based on month report issued)

(3) Table of Contents (TOC) - After completing the full report the TOC must be updated to ensure the page numbers are correct. The F9 key will update the TOC for Sections A-H. A manual update must be don for the Introduction, Background and Scope sections.

(4) Acronyms Listing- Update the Acronyms Listing with acronyms used throughout the report. Spell out acronyms the first time the acronym is used. Subsequently, use the acronym only.

(1) INTRODUCTION - Verify that the Introduction used matches the code authority for which the agency is receiving information. The DES must choose the correct template to use. If not template exist for the agency, such as for federal agencies, briefly outline the statutory provisions, in general, which permit the disclosure of returns or return information, and the intended purpose or benefit(s) of the disclosures. Any limitations or restrictions imposed by the IRC or regulation can be included in the introduction portion of the report, especially if it is germane to a finding or recommendation elsewhere in the report.

(2) BACKGROUND - Verify the Background used matches the code authority for which the agency is receiving information. If using the e-Trak generated template, you must chose the correct template. This section, which is agency and contractor specific, should contain the name of the agency reviewed, and if applicable, the specific organization(s) or function(s) within that agency. If several, separate, programs are being reviewed, the background section should give a brief description of each program.

• Insert the information highlighted in red on the template in the SRR.

• Develop the information highlighted in blue on the template in the SRR.

• For HS and CS agencies you must identify the relationship between the field office/county offices and the state, i.e. state run/county administered or state run/state administered.

• In the contractor portion you must develop a comprehensive list of all contractors the agency uses that have access to FTI or are listed in the Findings of the report. Contract language must be addressed for each contractor unless all contracts either contain or do not contain the language then a blanket statement can be used for all.

• In the IT portion you must develop a description of how the agency’s IT services are provided. If the agency uses an embedded IT as well as a consolidated data center, the services that each provides to the agency should be clear. The Service Level Agreement (SLA) or contract with the agency providing the IT services must be addressed. The last sentence of the IT paragraph should state who at the agency will be required to address the Section H findings.

• Example of the contractor and IT portion of the SRR.12XCS utilizes the following contractors for services that involve the disclosure of FTI.

• ABC processes FTI for the 12XCS application XLECS and manages the data center operation in Albuquerque, NM. Contract language included or not for each or statement for all or none having the language.

• District Attorney Offices are employed under cooperative agreements with 12XCS to provide child support services.

• 123, Inc. provides off-site storage of backup tapes containing FTI for ABC.

• The XXXX Department of Human Resources, Information Services Division (XDHR ISD) provides hardware and software maintenance, application support, end user support, workstation management, and systems development for all of the divisions within the Department of Human Resources. In addition, information technology services are provided by the XXXX Department of Finance, Information Services Division (XDOF ISD). The XDOF ISD operates the consolidated state data center that provides information technology infrastructure to directly serve a number of government entities. The XDOF ISD provides infrastructure monitoring, support services, including mainframe support, server management, network services, and development services. XDOF is a separate agency than XDHR. FTI is received at the XDOF ISD Data Center through CyberFusion connection to a RACF mainframe. The FTI is transmitted to a mainframe hosted at ABC located in City, State. The XXXX Location, Enforcement, and Collection System (XLECS) application resides on the mainframe. End users access the XLECS application from their workstations. In addition, reports containing FTI are generated on the mainframe at the XDOF ISD Data Center and are sent electronically to a server maintained by XDOF ISD residing at the State House Data Center. The Service Level Agreement (SLA) with the agency contains the required Safeguards language. The computer security findings in Section H will require corrective action by XXX and XXX (agency IT Divisions used to process FTI).

• See Section C. of this report for further discussion of the required actions to ensure safeguarding language is in all contracts and agreements with entities with access to FTI to ensure the continuous protection of taxpayer privacy and confidentiality of FTI.

(3) SCOPE - This section contains descriptive reviewer information regarding the conduct of the review. This section of the report should give the reader a sense of how the review was conducted and what programs and procedures were included or excluded from the review. In addition, the scope and objectives section should also indicate:

1. The highlighted information in red from the template.

2. Correct spelling of reviewers names.

3. Correct dates of review.

4. GL should be shown if participated in the review.

5. Agency POC listed as coordinating the review and their title.

6. In the locations section, list every location that was visited for your agency. If someone else visited a location for you, it must be listed and annotated who visited the site.

7. In the personnel section, list every one interviewed and their title, including personnel reviewed for Section H.

Note: When an SRR is generated from e-Trak the Title page or Cover Sheet, Table of Contents, Acronym Listing, Introduction, Background and Scope must be completed accordingly.

(4) FINDINGS AND RECOMMENDATIONS - All safeguard review reports will address each requirement enumerated in IRC §6103(p)(4), and other requirements determined to be necessary to ensure the confidentiality of FTI and return information. To ensure that all the requirements of the IRC, Publication 1075, and the IRM have been addressed, each subsection of this section will contain a statement of the requirement, followed by a description and discussion of the findings and recommendations for each item under this subsection.

(5) Begin creating the SRR

• Create “Parent” Findings for Section A-G by clicking SRR Findings->New SRR Findings

• Input a finding number: A.1, A.2, G.1, etc., as with the current process

• Select Open or Held In Abeyance for status

• Select the appropriate Pub 1075 Section

• Select Risk Category, as determined during onsite review – Risk categories in the report need to be in order by severity.

• Input Targeted Implementation Date in mm/dd/yyyy based on the risk category. Remember when calculating the date use days not months (90, 180, 270, 365).

• No should be selected for “Repeat Finding” (repeat findings), if not please change. We no longer capture repeat findings, therefore no should always be selected.

• Select No “Components Exist” (default) for A-G findings. H findings will have components and therefore, yes will need to be checked

• Initialization Date will be populated by Operations staff but should be validated by DES

• Finding Box: Input standardized language (be sure to use current version) for the finding and amend as necessary. You must include the risk category after the finding in parenthesis. Findings in the PFR should be shown in the report, however, the wording in parenthesis in the PFR is not in the SRR. This information is used to develop the narrative. Use complete sentences when writing. Add the finding narrative. In most cases the narrative should be as short as possible and describe the issue in the finding. Brackets in the Narrative should be removed. Names of offices, locations, etc used in the findings should be consistent.

Example: If the finding shows the Central Office then the discussion should refer to the Central Office, not headquarters, and should be spelled the same.

• Finding Example: The agency does not maintain an adequate system of records (logs) for tracking the receipt, movement, and disposal of FTI received in paper in Central Registry at the Headquarters Office. (Significant) The agency must maintain a system of records to track FTI Form 8796, specific requests, TDS prints, etc as appropriate] from request to destruction. The log must contain all FTI received or photocopied in accordance with Publication 1075Section 3.3 Converted Media. The log must include the following elements and be maintained for a minimum of 5 years or the applicable records control schedule, whichever is longer: taxpayer name, tax year(s), type of information (e.g. revenue agent reports, Form 1040, work papers) , reason for the request, date requested , date received , exact location of the FTI , who accessed the data and if disposed, the date and method of disposition

• Recommendation Box: Input standardized language and amend as necessary. You recommendation should resolve your finding. Verify that the targeted implementation dates used in the recommendation match the date in the Targeted Implementation Date box and are calculated accordingly. The dates for each risk category must match the dates in Section H.

• Recommendation Example: The agency must establish a system of records (log) for recording requests and receipts of interstate cases and payment updates containing FTI. The targeted implementation date for this recommendation is [DATE], which is 6 months from the date of the closing conference. To close this finding, please provide a copy of the system of records (logs) template used to track the receipt, movement, and disposal of paper FTI with the agency’s CAP.

  Note: Once the information for numbering, dates, findings/description, recommendation, and the issue codes is filled in, Click Save. If you do not save your data, you will lose it and have to re-enter.

(6) The DES will input all Section H Parent Findings and component findings from the document loaded to e-Trak by the CSR. Parent findings and component findings will be created for every Section H finding even if only 1 component exists.

• Input a finding number: H.1, H.2, H.3, etc., as with the current process

• Select Open for status

• Select the appropriate Pub 1075 Section

• Select Risk Category, as determined during onsite review – Risk categories in the report need to be in order by severity.

• Input Targeted Implementation Date in mm/dd/yyyy based on the risk category. Remember when calculating the date use days not months (90, 180, 270, 365).

• No should be selected for “Repeat Finding” (repeat findings), if not please change. We no longer capture repeat findings, therefore no should always be selected.

• Select Yes “Components Exist” (default) for H findings. H findings will have components and therefore, yes will need to be checked.

• Finding Box: Cut and paste language from the Section H document. You must include the risk category after the finding in parenthesis. If information is missing from the document or is incorrect the DES must work with the CSR as necessary to resolve.

• The DES needs to input the issue codes for all Findings. Issue Codes: Use the 1-to-1 mapping to select the correct issue code. Select Issue Code Group A-G . Select the appropriate Issue Code in the drop down. Select Issue Code Group H . Select the appropriate Issue Code in the drop down. If no direct mapping, choose other.

  Note: Once the information for numbering, dates, findings/description, recommendation, and the issue codes is filled in, Click Save. If you do not save your data, you will lose it and have to re-enter.

  Note: Once all findings have been input the DES will generate the SRR. The DES must validate the information in the report, ensure the correct information is included in the Title page or Coversheet, Table of Contents, Acronym Listing, Introduction, Background and Scope and that the report includes all findings and matches the data in e-Trak.

• The DES uploads the report back to the case using the proper naming convention. The file should be uploaded with a .doc extension.

  Example: MA104-DOR-SRR-111414.doc

(7) Prepare SRR Letter - If the template is not available on e-Trak you must obtain the latest version from SharePoint.

• Verify the appropriate code authorities are listed.

• Verify the current head of agency name and address are listed in the Agency Contacts on the Agency screen in e-Trak and are current. If they are not, you must add.

• Verify if agency has Secure Data Transfer (SDT) on Agency screen in e-Trak.

• Verify correct CAP dates are shown.

• Verify the signature authority (name and title) on the letter

• The letter should follow the naming convention format and be dated accordingly.

  Example: ME01X-CS-SRR-L-091014.doc

(8) Upload the completed SRR and letter by clicking Documents->new Documents and Inputting the appropriate information:

1. Click Document->New Document

2. Select Yes for “Ready for Management Approval”

3. Input a comment that the document is ready for QR

4. Click Browse, then Select the document from your file system

5. Click Save

(9) Upload other pertinent documents and create case notes as appropriate. The CSR should upload the documents associated with the Section H. If they are not loaded, you must check with the CSR. In addition to uploading the letter and the report, the following documents are reviewed in QR and need to be complete and uploaded prior to moving the case to QR status:

• SDSEM – These are considered your review work papers and should be completed with all failures and include a description of the failure. It should cover the sites visited. The coversheet should be completed with the required information.

• Deliverable Acceptance Form (DAF) – Ensure that the DAF has been loaded to e-Trak if the computer security portion of the review was conducted by BAH.

• State Agency contact Information

• PFR

  Note: Use the correct naming convention for all documents loaded in accordance with the naming convention document.

(10) Verify that the findings from the previous review are closed out. This includes all Section H component findings. Make a case note in the previous review case as well as the current case stating the reason for closing the findings (due to a new review).

(11) Prior to moving to QR make sure all notes on the case are updated.

• Make a note in Comments section on Case screen.

  Example: 11/14/14 – Forwarded SRR to QR - CB

• ADD the following to the Email Notification Comments on Case screen: PRIORITY (if report is under 45 days) . Report Name: ST/CODE-AGENCY-SRR-DATE . Number of days open Movement = To QR

  Example: Priority CO84X-CS-SRR-091014, 30 days, to QR

• If the package is returned for edits a new document must be loaded. The new submission must be updated with the date it is submitted, all edits completed, all track changes and comments removed.

(12) DES (Case Responsible) moves case to Quality Review step

• Select “Submit for Quality Review” from the Workflow Step dropdown

• Select the appropriate Quality Reviewer from the dropdown, if not already populated

• Click Save

(13) Time Frames to complete the SRR:

1. Computer Security Reviewer has 20 Days from official closing to provide the Section H

2. DES has 35 Days from official closing to submit the SRR to QR

3. Safeguards has 45 Days from official closing to issue the SRR

(1) TI’s are considered timely if the case in eTrak is released within 30 calendar days. All TI’s in inventory should be worked timely and consider the time sensitive nature of the agency’s inquiry.

(2) TI’s must be forwarded to Quality Review within 20 calendar days after case creation. See IRM 11.3.36.14.3 Quality Review of Technical Inquires for more information regarding the TI Quality Review Process.

(3) If additional information is needed from the inquirer in order to process the TI, the case responsible party will attempt contact by phone or email to obtain the needed information as soon as possible after case assignment. If a timely response is not received the case responsible party will close the TI with an e-mail advising the agency of closure and advise of:

• Information required in order to answer the question

• Inquiry can be resubmitted with the required information

(1) Generally DES will be assigned the following types of Technical Inquires:

• FOIA

• Physical Security Publication 1075 clarification

• CAP questions relative to SRR Section’s A to G findings

• Report

(2) Generally Computer Security Reviewers will be assigned the following types of Technical Inquires

• VOIP

• SCSEM

• Vulnerability scanning

• Computer Security Publication 1075 clarification questions

• CAP questions relative to SRR Section H findings

• SSR

(3) Physical Security Inquires from agencies under an open review will generally be handled by the DES assigned to conduct the review. The DES is the agency’s primary POC for all SSR, CAP, and inquires from their agency POC. An Open Review is easily identified on e-Trak by the calendar year the review is scheduled to occur and can also be identified by referencing the Review Schedule.

(1) If the case responsible party determines the TI is an issue that is not covered in Publication 1075 or generally a Safeguards issue do not delay, discuss with Chief, SRT for reassignment and resolution.

(2) If the scope of the inquiry is beyond your expertise, is not from an agency subject to safeguards oversight or does not pertain to the safeguard program, do not delay, discuss with Chief, SRT for reassignment and resolution.

(1) Assigned individual will acknowledge receipt of TI by updating notes in e-Trak case summarizing inquiry.

(2) Research and contact other Safeguards personnel as needed.

(3) Contact the requester, resolve the question(s) at hand and close the TI over the phone whenever possible. Confirm it a written response is needed.

(4) Add appropriate e-Trak notes describing:

• Discussion with requester

• Research

• Contact type(s) made i.e., phone, email, etc.

• Contact with other Safeguards or IRS personnel

(1) Resolve the inquiry during the initial phone discussion.

• Document the discussion and answer provided in e-Trak case notes as described above Section

• Load original e-mail with your response to the Document file in e-Trak and forward to QR

(2) Complete required research and preparation of written response.

• Complete research, document in e-Trak case notes.

• Load original e-mail with your response to the Document file in e-Trak and forward to QR

(3) Facilitate discussion with the inquirer in coordination with computer security reviewer/DES if necessary (coordinate with Chief or Chief-designated party to determine appropriate CSR assignment)

• Arrange the telephone discussion

• Document the discussion in e-Trak case notes

• If written response is required, load original e-mail with your responses to the Document file e-Trak and forward to QR.

(1) Prepare written response, on the original incoming inquiry loaded to e-Trak, and load to Outgoing Documents in e-Trak and load to Outgoing Documents in e-Trak.

(2) Always use the original incoming TI message.

(3) If there were intervening e-mail threads, they may be included in the response loaded to e-Trak Document file for QR to provide amplifying information.

(4) A separate attachment providing the response is not appropriate.

(5) Include all attachments to be sent to the agency as part of the response.

(6) As written, response should be appropriate for forwarding to the agency personnel in response to the original incoming message. Example format is shown below:

• Subject: OH531-SWA-TI, 30-2013-00915 for QR, 20 days

• Opening: Hello (Agency POC), this is in response to your inquiry dated (Month,DD,YYYY), concerning (State the subject)

• Body: Type narrative paragraph restating agency question with specific answer

• Closing sentence: I hope this fully responds to your inquiry.

(7) Cite Publication 1075 references as appropriate. Answer should provide guidance that is complete but does not just restate Publication 1075 text. Ensure that the agency will fully meet Publication 1075 standards on the issue if they follow the guidance provided.

(8) Do not provide telephone number or e-mail contact information

(1) All Technical Inquires do not require email/written response (see above Ways to Resolve the TI). Utilize the most appropriate method pending the type an extent of issues/inquires raised.

(2) When an e-mail response is required the DES will create an email to the agency requestor, copy to all individuals on original incoming message, using the email dropped into Documents in e-Trak. DES will upload a copy of the e-mail response in Documents.

(3) Technical Inquires are closed on e-Trak by support staff who will:

1. Locate e-mail to send in Outgoing Correspondence (if written response is required)

2. Ensure the to line is addressed to initial party that sent the inquiry and copy all appropriate personnel from original e-mail

3. Upload a copy of the sent email in Outgoing Correspondence

4. Add not to e-Trak case “TI closed; response sent to POC”

5. Change Workflow Step>Approve for Release Final

6. Save

(4) To meet the timeliness metric for Technical Inquires the case must be Released in e-Trak within the 30 day prescribed timeframe

(1) All correspondence should be sent electronically by Secure Data Transfer or encrypted using SecureZip, to the Safeguardsreports@irs.gov mailbox and include a cover letter signed by the head of the agency or authorized delegate.

(2) Use of a template will enhance the agency’s ability to provide all of the information to process the notification. Template suggested for the agency to use is embedded below. The use of this template will minimize processing errors as well as eliminate the a contractor check sheet as the comments will confirm notification compliance.

(1) Retrieve the 45-Day Notification Letter from the mailbox

(2) Assign an e-Trak case to DES and/or for Computer Security Reviewer (CSR) assignment rules are subject to occasional change and the most current version is located on Data Services SharePoint site)

(3) Upload notification from agency into the created e-Trak case.

(4) Acknowledge receipt of 45 Day Notification via email response

(5) Upload acknowledgement email into created e-Trak case.

(6) Update the e-Trak Case Notes

(7) Notify case assignment to SRT Chief, Mailbox Staff, IRS contractor, CSR and DES via email and update e-Trak.

(1) 45 Day Notification Letters for contractor and/or sub-contractor access to FTI are assigned to DES (see Data Services SharePoint site for the most current version of the assignment rules)

(2) Generally 45 Day Notification Letters for Live Data Testing, Non-Agency-Owned-Information-Systems, Data Warehouse, Cloud Computing, VoIP, IVR, Web Portals, and Virtual Environment which requires Information Technology (IT) review are assigned:

1. Computer Security Reviewer (IRS contractor) as e-Trak Case Responsible.

2. Disclosure Enforcement Specialist (DES”) as e-Trak Analyst

3. Copy to Supervisor of Mailbox Staff

Note: Agencies seeking to implement VoIP and IVR should seek advice from the office of Safeguards. The use of contractors for these services will require a 45 Day Notice.

(1) DES Process

1. Retrieve the agency’s notification letter from e-Trak

2. Contract agency for additional information as needed.

3. Reach out to Chief or Senior Technical Advisor as needed.

4. Work to completion according to DES 45 Day Notification Processing IRM 11.3.36.13.6

5. IT related contractor notifications complete the contractor portion, upload the documents to e-Trak, and notify IRS contractor of completion

6. Document any delays in e-Trak and notify Chief of any delays

7. Completed and upload the acknowledgement letter to be issued to the Agency to eTrak Documents (template located in Safeguards SharePoint site)

8. Upload case cover sheet

9. Submit to Chief or Associate Director for signature (approval authority rules located in Safeguards SharePoint site)

(2) Computer Security Reviewers Process

1. Retrieve the agency’s notification letter from e-Trak

2. Contact agency for additional information as needed

3. Work to completion within prescribed timeframe

4. Contact DES to inform them of status of account

5. Upload the acknowledgement letter of Agency to e-Trak Documents (template located in Safeguards SharePoint site)

6. DES will perform a quality review of above noted letter prior to sending for approval.

   Note: If the agency needs a 45 day letter issued on an emergency basis they should send the notification to the Safeguards mailbox. If necessary the DES will notify the Chief and/or Senior Technical Advisor if additional guidance is needed.

(1) 45 Day Notices are timely if processed to completion (Release status in eTrak) within 30 days of case creation in eTrak. Des will notify their Chief if there is a delay in processing beyond 30 days and update eTrak notes.

(2) Processing Tax Modeling and IT notification letters often required additional time, DES will work with Statistics of Income (SOI), CSR, IRS contractor, and Senior Technical Advisor as applicable to complete this process in a timely manner. Notify Chief of expected extended time frame if expected to exceed the 30 day due date.

(1) After receipt of assignment notice, retrieve notification form the eTrak document folder and save to your hard drive.

(2) Acknowledge receipt in eTrak by entering eTrak Note.

(3) Review the information provided to ensure it is within the standards in Publication 1075 and all Exhibit 6 information was provided.

(4) In additional information is needed from the agency to process the notification, call and/or email the agency POC listed in the notification as soon as possible after case assignment. The agency should respond directly to you and/or mat respond to SafeguardsReports@irs.gov and cc you. Provide the agency with a specific due dare for the response that is reasonable and within the 30 days allowed for processing 45 Day Notices.

(5) Document any delays in eTrak along with the cause for such delays and notify Chief if delays are expected to exceed the 30 day metric for resolution.

(6) If the agency fails to appropriately respond by the due date issued prepare the non-processible letter.

(7) Document all information received from the agency in the eTrak case created for the Notice and load documents and emails as appropriate.

(8) Prepare Safeguards response letter for approved/confirmed Notices. Always address the letter to the Head of Agency, Director, Deputy Director, etc, if the letter has been signed by them. Do not send the letter addressed to the POC unless this is the only name identified on the letter.

(1) DES must coordinate with the SOI. Specific current email contacts for coordination with SOI can be found in the desk guide for processing 45 Day Notices. Provide the following in this coordination:

1. Copy of the agency’s notification

2. Copy of the agency’s current Need and Use document

3. If no current Need and Use document is on file, obtain a signed copy from the agency and email to the Disclosure Manager for approval.

4. Copy of the agency’s separate statement detailing the methodology and date to be used by the contractor.

5. Notate eTrak with actions taken throughout the process.

6. Resume process of request - Once approved, incorporate SOI’s approval statement in the closing letter template.

7. Upload response letter to outgoing correspondence and checklist to document (each of which are templates found in Safeguards SharePoint site)

8. Submit to Associate Director for signature.

(1) If the letter includes contractor notification for Live Data Testing, Non-Agency-Owned-Information-Systems, Data Warehouse, Cloud Computing the process is the same as that for any 45 Day Notification letter IRM 11.3.36.13.3 .

(2) Complete the combination 45 day letter and/or Live Data Testing, Non-Agency-Owned-Information-Systems, Data Warehouse, Cloud Computing when the notification includes contractor notice using the template found in Safeguards SharePoint site upload to eTrak under documents, enter eTrak case note and notify CSR assigned case.

(3) If the Live Data Testing, Non-Agency Owned-Information-Systems, Data Warehouse, Cloud Computing notification does not include contractor notification complete the response letter using the template located at Safeguards SharePoint site, upload e-Trak under documents, enter e-Trak case notes and notify CSR.

(4) The letters/agency responses are signed by the Associate Director (AD). Once CSR has determined that the letter is ready for approval they are to notify the DES assigned as analyst in e-Trak. The DES will then conduct a quality review of the response and the case and submit to AD for signature if the response is appropriate and the case is complete.

(5) Contractor Notice must be made by the Agency, not by their contractor. If Safeguards is in receipt of 45 Day Notice from a contractor, request the Agency resubmit as the requesting official. All 45 day letters must be on agency letterhead and signed by the Head of the Agency. Close the 45 Day Notification e-Trak case using the non-processible template. A new eTrak case will be opened upon receipt of appropriate Notice.

(1) Enter a new note in eTrak reflecting:

• 45 Day Notice Processing Check sheet completed and uploaded in documents

• Letter to agency completed and uploaded to eTrak documents

• Forwarded to approving official (Chief/Associate Director) for signature

(2) Documents to be uploaded into eTrak case

• The original agency notification (this should already be uploaded by Mailbox staff when case was created)

• Additional information provided by agency, if applicable

• Closing letter (to eTrak outgoing correspondence)

• Checklist (notification template)

(3) Letter to agency should be uploaded under outgoing correspondence in eTrak and input should include these instructions:

• Select type “Notification”

• Input dare received/created

• Complete title

• Upload file

• Write description (letter)

(4) Instructions for submission for approval within eTrak include:

• Subject line of email comment

• “Naming convention, eTrak case #, To (Chief’s initials) for signature mm/dd/yy, # of days

  Note: Priority 35X-IN-CS-45D-ITTrans-050913, N-2013-00748, To GR for signature 06/05/13, 28 days

• Enter “Priority” at the beginning of email notification comment if case is 30 days old or less

• Update case screen select “workflow step” submit for management approval

(1) The following documents should be loaded in the Documents file in e-Trak when the Quality Reviewer receives the case file. Each of these documents should be reviewed by the Quality Reviewer.

• Deliverable Acceptance Form (DAF

• Safeguard Security Review Acceptance Checklist

• Safeguard Security Review Cover Letter

• Safeguard Security Review Analysis

(2) Written responses should be appropriate for forwarding to the agency personnel in response to additional information needed. If any documentation is missing, the Quality Reviewer should contact the DES/CSR to load the documentation.

(3) Verify that the SSR has provided guidance that is complete. There should be a response for every field within the SSR.

(4) The Quality Reviewer should review the SSR for grammar, punctuation, spelling and formatting throughout the report. Minor corrections (grammar, punctuation, formatting, etc.) can be made by the Quality Reviewer without returning/notifying the DES/CSR. The following items should be reviewed in the SSR.

1. SSR responses should clearly state current IRS Safeguards policies.

2. Publication 1075 and NIST references should be cited as appropriate.

3. Ensure that the agency will fully meet Publication 1075 and NIST standards on the issue if they follow the guidance provided.

4. Ensure title page references the correct agency.

5. Outstanding Actions – compare and verify that every item listed is covered in each individual section.

(5) Quality Review of SSR Transmittal Letter-The Quality Reviewer should review the transmittal letter that is sent to the agency. The Quality Reviewer should make minor corrections to the letter. If there are major changes to the letter the Quality Reviewer should wait until the report is reviewed to load and return the case to the DES/CSR for re-work.

(6) Review the transmittal letter for the following:

1. Verify that correct letter template is used.

2. Check spelling, grammar, punctuation throughout letter.

3. Verify that the official is named correctly.

4. Verify proper title is used in the salutation.

5. Verify agency name correct.

6. Verify the acceptance (or non-acceptance) statement’s validity.

7. Verify correct due dates and referenced.

(7) When corrections are made that must be addressed by DES/CSR, the SSR will need to be returned using the following procedures:

1. Rename the documents using the proper naming convention and the current date. If returning the documents on the same date as received, place that comment after the date, so that it can be distinguished from the original file.

2. Load the documents to the Documents file on e-Trak.

3. Make a case not on e-Trak with actions taken and the necessary corrective actions to be taken by DES/CSR.

4. Update the Comments field on the case with the status:

   Example: 11/04/14 -Ret’d to DES/CSR for edits-SS

5. Update the Email Notification Comments field on case. “Priority” should be used for cases less than 60 calendar days.

   Example: Priority MAXXX-DOR-SSR-102614, 35 days, ret’d for edits

(8) Completion of SSR Quality Review - Upon completion of quality review (SSR ready for approval/signature) the following procedures should be taken:

1. Add any final notes to the case.

2. The Comments field should be updated to reflect the status.

3. The letter and the report should be loaded to the Outgoing Correspondence file.

   Example: Example Comments Field: QR Complete. Agree with acceptance and sending signature 11/24/14 -CL

4. The Email Notification Comments field should be updated to reflect the current date and number of days open and status.

   Example: Email Notification Comments Field: MAXXX-DOR-SSR-102614, 30 calendar days, for approval/signature

5. Choose from the Workflow Step - Submit for Management Approval.

6. Choose the Associate Director as the Management Approver

   Example: SSR responses do not get forwarded to the Chiefs for approval. SSR responses are forwarded to the Associate Director for approval.

(1) SRRs must be forwarded to QR within 35 days review. The following documents should be loaded in the Documents file in e-Trak when the Quality Reviewer receives the case file. Each of these documents should be reviewed by the Quality Reviewer. If any file is missing, the Quality Reviewer should contact the DES to load the file.

• Deliverable Acceptance Form (DAF)

• State Agency Contact Information sheet

• Safeguards Disclosure Security Evaluation Matrix (SDSEM)

• Safeguard Review Report Letter

• Safeguard Review Report

(2) Prior to the Safeguard Review, the DES should have received the State Agency Contact Information sheet and the Safeguards Disclosure Security Evaluation Matrix (SDSEM) from the agency. At the end of the review, the DES should complete the SDSEM, listing all failures. Comments should be associated with every failure.

(3) Previous Review Open Findings - The Quality Reviewer must ensure previous open review findings are closed on e-Trak. Previous review findings and all components should be closed by the DES or someone otherwise directed by the Chief upon conducting the on-site review. The DES should have input a note on the current review case and the previous review case indicating that the findings have been closed.

(4) Open CAP Case -If there is an open CAP case associated with the previous review, the DES should forwarded this along with the SSR to OR r. If an open CAP was not received with the report, the Quality Reviewer should conduct a search to determine if one is open.

• In most instances, an open CAP case would be in analysis/prep status. If there is an open case with the DES that has not been moved to QR, the Quality Reviewer must notify the DES to forward the case.

• A note must be placed in the Comments field on the case indicating the status, that a new review has been conducted and that nothing is to be sent to the agency with this case. This is to avoid unnecessary confusion in the issuance of CAPs. The Email Notification Comments field should also be updated accordingly. See examples:

  Example: Comments Field Example: To Chief, SRT 2 for approval/closure. A new review has been conducted. Nothing is to be sent to the agency. -CB

  Example: Email Notification Comments field: MAXXX-DOR-CAP, 39 days, for approval/closure. Nothing to be sent to the agency.

(5) Verify the DAF that is loaded matches the agency if not notify DES to obtain and reload.

(6) Verify that the SDSEM has been completed with failures notated. There should be a comment for every failure. In most cases the failures should match the findings in the PFR and the SRR. If the SDSEM is not complete, notify the DES to correct and reload. A missing or incomplete SDSEM should not hold up the timeliness of an SRR.

(7) The SRR and transmittal letter should be moved to the Quality Reviewers's desktop to work. The SRR and letter should be saved by the DES in a doc format.

(8) The Quality Reviewer should correct the report and letter using the auto correct tool. The Quality Reviewer should review the report for grammar, punctuation, spelling and formatting throughout the report. Minor corrections (grammar, punctuation, formatting, etc.) to Introduction, Background and Scope, and spacing issues between findings can be made by the Quality Reviewer without returning/notifying the report and/or letter to the DES. The following items should be reviewed in the SRR:

1. COVERSHEET - verify coversheet – month, agency name, agency code (agency code for etrak should be used), correct format.

2. TABLE OF CONTENTS - make sure all pages are updated.

   Note: A manual change of the pages for the Introduction, Background and Scope is required. To update Table of Contents for Sections A – H press the F9 key. If these are not correct in the report Quality Reviewer should update.

3. ACRONYM LISTING - verify acronyms used in report are included in listing. Acronyms used in the report for the first time should be spelled out and the acronym in parenthesis.

4. INTRODUCTION - verify that the correct report template is used for the type of agency- (d), (l)(6), (l)(7), (l)(21). Use the (d) template for federal agencies; however, the DES must change the Introduction, Background and Scope as well as Section G to be specific to the agency.

5. BACKGROUND -verify that the information required in the templates based on agency type is reflected in the report. Ensure the information technology services to the agency and what services they provide. paragraph in Background describes who provides the information technology services to the agency and what services they provide. Verify the sentence “The computer security findings in Section H will require corrective action by XXX and XXX.” (may just be one), is included.

6. SCOPE - The Quality Reviewer should review the following:

1. Make sure reviewers names are spelled correctly.

2. Governmental Liaison should be shown if participating in review.

3. Responsible agency employees listed should include the person’s title.

4. Locations visited should be named consistently throughout report. If there is a finding for a location that is not listed, you may need to verify with DES.

5. Verify dates of last Safeguard Review and report (check SP or e-Trak)

(9) FINDING/NARRATIVE AND RECOMMENDATION -The Quality Reviewer should review the following:

1. Findings in PFR should be those shown in report.

2. Verify that the risk category is shown at the end of the finding in parenthesis.

3. Findings/Narrative and Recommendation must work together. The recommendation should resolve the issue described in the finding/narrative.

4. Review findings for consistency. Names of offices, locations, should be shown the same throughout the report.

5. Verify that correct standardized language is used throughout report (findings and recommendations match).

6. Verify the narrative provides a description of the issue, if appropriate. It must make sense. For example: Doors unlocked. This is not enough of a description. The DES must tell what doors are unlocked and where.

   Note: Brackets in the narrative used in standardized language should be removed and not shown in the report.

7. Dates – verify that the DES has used the correct number of days (not months). Dates should be consistent throughout all sections of the report.

8. Section H Quality Review -Verify Section H Introduction and MOT and Technology Specific Findings headers are included – DES has to copy and paste.

9. Verify findings listed in the Section H Introduction are shown in the report number for number.

10. Verify risk categories are shown in parenthesis in the parent finding.

11. Verify all findings and components are included

(10) QUALITY REVIEW- SRR TRANSMITTAL LETTER-The Quality Reviewer should review the transmittal letter that is sent to the agency. The Quality Reviewer should make minor corrections to the letter. If there are major changes to the letter the Quality Reviewer should wait until the report is reviewed to load and return the case to the DES for re-work. Review the transmittal letter for the following:

1. Verify that correct letter template is used.

2. Check spelling, grammar, punctuation throughout letter.

3. Verify that the official is named correctly.

4. Verify proper title is used in the salutation.

5. Verify agency name is correct.

6. Verify correct code authorities cited.

7. Agencies that received Beneficiary Earning Exchange Record (BEER) data

Note: For (l)(7) agencies, verify (from report) if receiving BEER data that SSA is included in letter; if not, it should not be listed. For agencies receiving IRC § 6103(l)(10) , verify (from report) both are listed

8. Verify correct CAP dates are shown in letter.

9. Verify that the agency POC in letter is listed on the Agency Contacts in e-Trak. If not, notify DES to validate/update.

10. Verify the signature authority (name and title) is correct.

(11) RETURNING REPORT TO DES FOR CORRECTIONS- When corrections are made that must be addressed by the DES, the report and/or letter will need to be discuss and/or returned to the DES for revision.

1. When possible, discuss with the DES and make corrections.

2. Return SRR to DES when major corrections are needed or a correction affects another part of the SRR. The Quality Reviewer will notify SRT Chief by email from e-Trak.

3. Rename the documents using the proper naming convention and the current date. If returning the documents on the same date as received indicate after the date, so that it can be distinguished from the original file.

4. Load the documents to the Documents file on e-Trak.

5. Make a case note on e-Trak with the actions taken and the necessary corrective actions to be taken by the DES.

6. Update the Comments field on the case with status.

   Example: Priority MAXXX-DOR-102614, 30 calendar days, ret’d for edits

(12) COMPLETION OF QUALITY REVIEW- Upon completion of quality review (report ready for approval/signature) the following procedures should be taken:

1. The letter and the report should be loaded to the Outgoing Correspondence file.

2. Add any final notes to the case.

3. The Comments field should be updated to reflect the status.

   Example: 10/26/14 - To Associate Director for approval/signature - CB

4. The Email Notification Comments field should be updated to reflect the current date and number of days open and status.

   Example: Priority MAXXX-DOR-SRR-102614, 34 days, for approval/signature

5. Choose from the Workflow Step-Submit to Management Approval.

6. Choose from Associate Director as the Management Approver.

(1) TIs must be forwarded to QR within 20 days for review The following documents should be loaded in the Documents file in e-Trak when the Quality Reviewer receives the case file. Each of these documents should be reviewed by the Quality Reviewer:

1. Written response, in informal e-mail format.

2. Always use the original incoming TI message.

3. If there were intervening e-mail threads, they may be included in the response forwarded for QR to provide amplifying information.

4. A separate attachment providing the response is generally not appropriate.

5. Do not include attachments that should be sent to the agency as part of the response.

6. Telephonic responses, documented discussion and answer provided in e-Trak case notes.

(2) As written, response should be appropriate for forwarding to the agency.

(3) If any documentation is missing, the Quality Reviewer should contact the DES to load the documentation.

(4) Verify that the TI has provided guidance that is complete. There should be a response for every question within the TI. If the TI is not complete, notify the DES to correct and reload.

(5) The Quality Reviewer should correct the TI using the autocorrect tool. The Quality Reviewer should review the TI for grammar, punctuation, spelling and formatting throughout the report. Minor corrections (grammar, punctuation, formatting, etc.) can be made by the Quality Reviewer without returning/notifying the DES. The following items should be reviewed in the TI:

1. TI responses should clearly state current IRS Safeguards policy and close the matter to avoid on-going discussions on the same issue.

2. Narrative paragraph should restate agency question with specific answer.

3. Publication 1075 references should be cited as appropriate.

4. Answer should provide guidance that is complete but does not just restate Publication 1075 text.

5. Ensure that the agency will fully meet Publication 1075 standards on the issue if they follow the guidance provided.

(6) If the discussion was held by phone, and the TI response is inaccurate it will be returned to DES and Chief, SRT to clarify our position with the agency POC, preferably with a follow up phone call. Subsequent action must be documented in the e-Trak case notes and forwarded to Technical Advisor for approval and closure.

(7) When corrections are made that must be addressed by the DES, the TI will need to be returned using the following procedures:

1. Rename the documents using the proper naming convention and the current date. If returning the documents on the same date as received indicate after the date, so that it can be distinguished from the original file.

2. Load the documents to the Documents file on e-Trak.

3. Make a Case note on e-Trak with the actions taken and the necessary corrective actions to be taken by the DES.

4. Update the Comments field on the case with the status.

   Example: 11/04/14 - Ret’d to DES for edits - BG

5. Update the Email Notification Comments field on the case. “Priority” should be used for cases less than 30 days.

   Example: Priority MAXXX-DOR-TI-102614, 20 days, ret’d for edits.

   Note: When returning TI's to the DES for correction, or making corrections (other than minor corrections), when possible, discuss with the DES. Ensure that the SRT Chief is copied on all returned TI's for correction.

(8) Completion of Quality Review – Upon completion of quality review (TI ready for approval/signature) the following procedures should be taken:

1. The written response, in e-mail format should be loaded to the Outgoing Correspondence file

2. The telephonic response, should be documented in the Note file.

3. Add any final notes to the case.

4. The Comments field should be updated to reflect the status.

   Example: Example Comments Field: Approved for Closure, Reviewed written TI response regarding. No additional Safeguards action required. Written response required to agency or No written response required to agency.

5. The Email Notification Comments field should be updated to reflect he current date and number of days open and status.

   Example: Email Notification Comments Field: MAXXX-DOR-TI-102614, for QR, 30 days, To Technical Advisor for approval/closure. BG.

6. Choose from the Workflow Step - Submit for Management Approval.

7. Choose the Technical Advisor as the Management Approver, unless otherwise directed by the SRT Chief or other management official.

   Example: TI responses do not get forwarded to the Chiefs for approval. TI responses are forwarded to the Technical Advisor for approval.

(9) Technical Advisor will review response for clarity, accuracy, and consistency with current policy. The Advisor will either:

1. Return to the originator with a request for edits, or

2. Approve and forward to the mailbox for release to the agency.

(1) A-CAP cases must be forwarded to QR within 30 days for review. The following documents should be loaded in the Documents file in e-Trak when the Quality Reviewer receives the case file. Quality Reviewer should contact DES for missing letters:

1. If Section H of CAP has been worked by contractor, a DAF should be uploaded to the documents file of the CAP case.

2. Complete letter to IRS Point of Contact (POC)

3. Complete letter to Head of Agency

4. CAP loaded by CPU

(2) The Quality Reviewer should correct the transmittal letters using the autocorrect tool. The Quality Reviewer should review the letters, and the Agency Response and IRS Comments in the SRR case for grammar, punctuation, spelling, formatting and spacing issues. Minor corrections (grammar, punctuation, formatting, spacing, etc.) can be made by the Quality Reviewer without returning the case for re-work and/or notifying the DES.

(3) Quality Review Sections A-G

1. Verify the Agency Responses for each finding has been migrated correctly

2. Verify the Technical Response in the IRS Comment is appropriate.

3. Verify the Status Box shows the appropriate status: Open or Closed. Open Status: Verify the Planned Implementation Date is appropriate. Closed Status: Verify the Actual Closed Date is correct.

(4) Quality Review Section H

1. Verify the Agency Responses have migrated correctly

2. Verify the IRS Comment is appropriate

3. Verify the Status Box shows the appropriate status: Open or Closed Open Status: Verify the Planned Implementation Date is appropriate Closed Status: Verify the Actual Closed Date is correct

4. Verify the Next CAP Due Date is documented correctly in Comments field

   Note: If all Component Findings have been closed, remember to verify the Parent Finding is closed.

(5) Quality Review of CAP Responses. DES/CSR should have addressed all open findings. Deficiencies within the SRR findings must be clearly noted in the Notes on the CAP case to allow the DES/CSR to correct.

1. Finding Accepted: Agency response is accepted and the finding is closed. IRS Comments: Agency response is accepted. No further reporting is required. Agency response is accepted and the finding is open. IRS Comments: Agency response is accepted. Please (Critical or Significant Findings - Provide information listed in recommendation and) report the finding status and actual implementation date on the next CAP update.

2. Finding Not Accepted: Agency response is not accepted for Critical or Significant Finding. IRS Comments: Agency response is not accepted. The agency must [Action given in Recommendation]. To close this finding, please provide [Documentation requested in Recommendation] and report the finding status, and actual implementation date on the next CAP update. Agency response is not accepted for Moderate or Limited Finding. IRS Comments: Agency response is not accepted. The agency must [Action given in Recommendation]. Please report the finding status and actual implementation date on the next CAP update.

3. Parent Finding: All Components Closed. IRS Comments: All component findings have been addressed. No further reporting is required.

   Note: Verify if the Finding has Components; if it does review all Components. When all Component Findings are closed, the Parent Finding should be closed.

4. Finding Not Accepted: Agency response was not received for Critical or Significant Finding. IRS Comments: Agency response has not been received. The agency must (Action given in Recommendation). Please report the finding status and actual implementation date on the next CAP update. Agency response was not received for Moderate or Limited Finding. IRS Comments: Agency response has not been received. The agency must (Action given in Recommendation). Please report finding status and actual implementation date on the next CAP update. Agency has planned implantation date long after the targeted implementation date IRS has requested. IRS Comments: Corrective action is overdue. Please report the finding status and actual implementation date on the next CAP update.

(6) Quality Review of IRS Point of Contact and Head of Agency Letters

1. Verify the correct letter templates are used.

2. Check spelling, grammar, punctuation throughout letter.

3. Verify that the official is named correctly.

4. Verify proper title is used in the salutation.

5. Verify agency name is correct.

6. Verify Agency Head and POC named in letters are listed on Agency Screen in e-Trak

7. Verify the next CAP due date is correct

(7) Returning CAP to DES for Corrections - When corrections are made that must be addressed by the DES/CSR, the CAP case and/or letters will need to be returned to the DES for revision using the following procedures:

1. Name the documents using the proper naming convention and the current date. If returning the documents on the same date as received indicate after the date, so that it can be distinguished from the original file.

2. Load the letters to the Documents file on e-Trak.

3. Make a Case note on e-Trak with the actions taken and the necessary corrective actions to be taken by the DES.

4. Update the Comments field on the case with the status.

   Example: 10/26/14 - Ret’d to DES for edits - BG

5. Update the Email Notification Comments field on the case. “Priority” should be used for cases less than 45 days.

Example: Priority MAXXX-DOR-A-CAP-102614, 30 days, ret’d for edits.

(8) Completion of Quality Review: Upon completion of quality review CAP and letters ready for approval/signature should be taken.

1. The letters should be loaded to the Outgoing Correspondence file.

2. Add any final notes to the case.

3. The Comments field should be updated to reflect the status.

   Example: 10/26/14 -To Chief SRT for approval/signature - BG. Choose the appropriate Chief SRT as the Management Approver.

4. The Email Notification Comments field should be updated to reflect the current date and number of days open and status.

Example: Priority MAXXX-DOR-A-CAP-102614, 30 days, for approval/signature

5. Choose from the Workflow Step - Submit for Management Approval.

(1) Interviews-During the on-site review, agency employees, contractors and subcontractors will be interviewed. Interviews are valuable in that they provide information based on personal experience. This information can help determine the extent of disclosure, safeguards and security awareness as well as awareness of penalty provisions of IRC §7213, IRC §7213A and IRC § 7431. Additionally, interviews can provide answers to questions regarding operations and procedures. Interviews do not have to be restricted to employees; they may also be conducted with third parties (e.g., custodians, security guards, other tenants) to gather information on the measures used to restrict access to areas housing tax data.

(2) Observation - Observing actual agency on-site operations is a required step in the review process. The DES must tour the areas or departments which handle or store FTI, including the data processing center, regardless of whether it is agency-operated, a shared facility or a contractor facility that receives processes, transmits or stores FTI. The DES should note actual written policy and procedures, actual operational execution of these policies and procedures, as well as work flow. The inspection should also provide information about the following security measures:

1. Perimeter security

2. Containerization

3. Keys and combination controls

4. Intrusion alarms

5. Presence of Fire detection and annunciation equipment

6. Physical access controls

7. Storage and handling

8. Emergency procedures, including data breaches and incident management

9. Destruction and disposal

10. Computer system security (including alternate work sites)

11. Call and payment centers

12. Collection agencies

13. Additional contractor and sub-contractor physical and logical access when reviewing additional locations.

    Note: Address contractor and subcontractor physical and logical access when reviewing additional locations

(3) Background Check- DES will during an on-site Safeguard Reviews inspect and evaluate agency policy and procedure related to background investigations of employees and contractors with access to and use of FTI as well as a sample of completed employee and contractor background investigations. DES will document on a SRR and CAP a finding and require corrective action by agency of any failure to comply with IRS published standards for agency background investigation requirements. DES will not on a SDSEM any compliance failures associated with specific test cases established with regard to IRS published standards for agency background investigation requirements. SDSEM Test cases to evaluated for compliance include:

1. Does the agency have a policy requiring a background investigation of each employee and contractor with access to and use of FTI?

2. Does the policy require the initiation of a background investigation prior to permitting newly hired employees or contractors access to or use of FTI?

3. Does the policy establish an unfavorable background investigation result criterion for each required element which, if found, would result in preventing or removing an employee’s or contractor access to and use of FTI?

4. Does the policy require that reinvestigations are initiated for each existing employee and contractor with access to our using FTI not less than 10 years from the date of their previous background investigation?

5. Does the policy specify that, at minimum, background investigations must include:

Step	Background Investigations
1.	Fingerprinting or review of Federal Bureau of Investigations (FBI) fingerprint results?
2.	Checks at local law enforcement agencies where the subject have lived, worked, and/or attended school within the last 5 years, and if applicable, of the appropriate agency for any identified arrests?
3.	Citizenship/residency checks conducted to verify an employee’s or contractor’s eligibility to legally work in the United States?
4.	Credit Checks to verify an employee’s or contractor’s financial status through a search of all three major credit bureaus covering all locations where the employee or contractor has resided, been employed, or attended school for six months or more for the past seven years?

6. Does the agency have a procedure that describes the roles, responsibilities and actions required to ensure background investigation policy requirements are timely initiated, completed, and unfavorable results are adjudicated?

7. Did the agency provided sample of completed employee and contractor background investigations include documentation of:

Background Investigation Documentation	Example
Citzenship/Residency Check	For example -a dated screen print from the E-Verify website or a green card?
Fingerprint Check	For example - FBI fingerprint results of dated certification by a memorandum official that favorable FBI fingerprint results were received?
Local Criminal Check	For example - a dated certification from a local law enforcement agencies regarding the existence or non-existence of any record of criminal activity or dated certification by a management official that favorable local law enforcement criminal check was completed?

(4) Review Guide - Exhibit 11.3.36-1 which contains a security outline that can be used as a tool in evaluating reports and planning Safeguard Reviews. This exhibit is not all inclusive and is used only as a guide to be modified or expanded to meet the requirements of a specific review. Not all questions and review topics may arise as a result of information gathered during the evaluation.

(5) Case file reviews - These consist of spot checks of agency files and the examination of records that contain FTI.

(1) Communication between team members, as the review is progressing, is vital and beneficial, as it can identify problems and provides information that may alter or expedite the review plan. The DES should communicate shared findings with other DES reviewing other agencies. c Ensure shared findings match on all agencies PFRs.

(2) Set aside time the closing conference to discuss the findings with POC. This allows the agency the opportunity to hear the findings and start of remediation.

(3) The PFR and recommendations should be discussed at the closing conference. This allows the agency the opportunity to better understand what the reviewer/team has found and provide additional information, should the agency see the need to do so.

(4) Critical findings must be reported to the Chief immediately, who will then communicate to the Associate Director.

(5) Check with CSR and DES must maintain regular communication during review.

(6) Set a deadline with the agency POC’s for needed policies and procedures generally not later than 2:00 p.m. the day before the closing..

(1) An on-site Need an Use Review of each agency receiving FTI will conducted as part of the Safeguard Review.

(2) A Need and Use Review is considered verification or confirmation of the Need and Use Justification made prior to the release of the requested tax information to the state agency

(3) Compare FTI the agency is using versus FTI received. Determine if the agency should continue to receive all the FTI. If not advise the GL and the Disclosure Manager as appropriate. Document the PFR with appropriate findings

(4) Ensure the agency is compliant with IRS statutes, Federal regulations, existing agency agreements (basic and implementing) service policies and MOU’s.

(5) The scope of the review should be broad enough to provide the reviewer with sufficient information to document a conclusion as to the agency’s need for and use of FTI.

(6) Other key areas to be reviewed would include (but are not limited to):

1. Routine exchanges

2. Joint projects or other specific exchanges

3. SLAs and MOUs

(7) Verify the Need and Use Justification Statement for Use of Federal Tax Information for Tax Modeling, Revenue Estimation or other Statistical Purposes.

(1) The PFR identifies the items requiring correction to as a result of an IRS Office of Safeguards on-site review. For each finding, the evaluated risk for potential loss, breach or misuse of FTI establishes the recommended timeframe for resolution. The risk category is noted next to each finding in this report to assist the agency in establishing priorities for corrective action. See also IRM 11.3.36.9.

(2) The DES must complete the PFR during the on-site review. The title page, footer and Section E should be complete prior to the review. The document must be completed including the computer security review findings in Section H and printed before the closing conference. The standardized findings with associated risk category are available on the PFR Standardized Findings Document.

(3) SRT Required actions to initiate IRC 6103(p)(7) recommendation:

1. Ensure that all actions regarding attempts to secure successive instances of reporting non-compliance are well documented in e-Trak.

2. Complete IRC 6103(p)(7) Recommendation for FTI Suspension and/or Termination of FTI Disclosures form.

3. Prepare GLDS Director letter to Head of Agency advising of 6103(p)(7) determination and intent to terminate FTI disclosures and appeal rights.

4. Submit IRC 6103(p)(7) Recommendation for FTI Suspension and/or Termination of FTI Disclosures form to AD for approval along with Action Routing Sheet and STAT prepared GLDS Director letter to Head of Agency advising of 6103(p)(7) determination and intent to terminate FTI disclosures and agency’s appeal rights.

(1) In general, the closing conference time will be discussed during the first evening meeting with the Chief and finalized as soon as possible thereafter. Closings should be scheduled according to scope, resources, agency availability and Safeguards availability with the final time and date signed off by the Chief. E-mail the agency POC the time of the closing conference . Review the risk categories – emphasizing the critical and significant risks. The DES will review findings in sections A-G and the CSR will review section H. Remind agency personnel that changes in procedures made to comply with recommendations should be documented in the CAP. Remind agency when the next SSR and CAP is due. Always ask the agencies if they have any questions before the close of conference

(1) SDSEM, Policy and Procedures Checklist, Agenda with physical locations and contact numbers, Review Contact Questionnaire.

(1) See IRM 11.3.36.15.1.

(1) See IRM 11.3.36.15.3

(1) See IRM 11.3.36.15.4

(1) The Associate Director, Federal Liaison and Chief SRT will be invited to the closing conference. Generally, since the closings are generally in Washington, DC, the Associate Director will attend the closing conference. The DES is required to send a calendar invite detailing the time, date, location and logistics to the Associate Director, Federal Liaison and Review Team.

(1) FSR documents, SDSEM, Policy and Procedures Checklist, Agenda with physical locations and contact phone numbers, Review Contact Questionnaire and Summary of agency after closing conference included:

1. The SDSEM will be used to document the findings for the agency.

2. After the review, complete Pass/Fail in column H on each tab of the SDSEM.

3. If the agency has failed a test, complete the IRS Comments and Supporting Evidence in column J.

(1) The Technical Inquiry & Notification weekly inventory report is based on an e-Trak query that focuses on the case types of Technical Inquiries and Notifications. All states EXCEPT release are included in the query. TIs and Notifications have a due date of 30 days from receipt of inquiry .

(1) The Safeguards Review Report (SRR) weekly reporting is based on an e-Trak query that focuses on “DES assignment” and “due date”. All states Except “Release” are included in the query. SRR’s have a 45 day completion date with a start time based on the closing conference date of the review.

(2) Each Safeguards Review Team analyst will be responsible for producing a weekly SRR inventory report. The SRR will be shared with each SRT Chief on a weekly basis (or as required by SRT Chief) to maintain workload accountability and inventory control. The query will be produced in Excel format unless otherwise determined by SRT Chief.

(1) The Safeguards Security Review Report (SSR) weekly reporting is based on an e-Trak query that focuses on “ IRS contractor assignment” and “due date”. All processing status Except “Release” are included in the query. SSR’s have a 60 day completion date with a start time based on the date the SSR was received in the Safeguards mailbox.

(2) Each Safeguards Review Team analyst will be responsible for producing a weekly SSR inventory report. The SSR will be shared with senior management and each SRT Chief on a weekly basis (or as required by SRT Chief) to identify any areas of concern and to ensure timely processing of reports in compliance with contractual guidance, maintain workload accountability and inventory control. IRS Contractor will be assigned as “Case Responsible” for all SSR cases. IRS Contractor will be responsible for reporting the status of active SSR’s during weekly inventory call (see note below). The query will be produced in Excel format unless otherwise determined by senior management and/or SRT Chief.

(1) The Safeguards Corrective Action Plan (CAP) weekly reporting is based on an e-Trak query that focuses on agencies where open findings exist on the POAM. This indicates that the findings need to be addressed in a CAP. The report focuses on DES assignment, contractor assignment and due date. All processing status Except “Release” are included in the query. CAP’s have a 45 day completion date with a start time based on the date the CAP was received in the Safeguards mailbox.

(2) Each Safeguards Review Team analyst will be responsible for producing a weekly CAP inventory report. This report will be shared with senior management and each SRT Chief on a weekly basis (or as required by SRT Chief) to identify any areas of concern and to ensure timely processing of reports in compliance with contractual guidance, maintain workload accountability and inventory control. SRT Analysts will be assigned on an alternating basis as “Case Responsible”, with subordinate assignments to DES staff (for sections A-G), and to the IRS contractor (for section H) for all CAP cases . IRS Computer Security Reviewers, commonly referred to as 2210, will be responsible for assisting with working Section H of the CAPs on an as needed basis as determined by the SRT Chief. The IRS Contractor will be responsible for reporting the status of active CAP’s during weekly inventory call (see note below). The query will be produced in Excel format unless otherwise determined by senior management and/or SRT Chief.

(1) Follow required actions below when Safeguard Security Reports (SSRs) have not been filed for two consecutive reporting years as follows:

(2) Follow required actions below when CAP have not been filed for two consecutive reporting periods as follows:

(1) Initiate enforcement recommendation below if agency continues to make unauthorized FTI accesses/disclosures after the following has occurred:

1. DES has issued Preliminary Findings Report (PFR) notifying agency of unauthorized FTI access/disclosures.

2. DES has received no response in the week following PFR issuance regarding actions taken to cease unauthorized FTI accesses/disclosures.

3. Associate Director has sent SRT prepared letter to advise Head of Agency of efforts to secure confirmation of agency actions to cease unauthorized FTI accesses/disclosures and warning that guidelines have been met to initiate 6103(p)(7) recommendation.

4. No confirmation of agency actions to cease unauthorized FTI accesses/disclosures is received within 90 days of PFR issuance.

(2) Initiate enforcement recommendation below if agency does not mitigate or provide a plan to mitigate critical and significant review findings after the following has occurred:

1. SRT has issued Preliminary Findings Report notifying agency of critical and significant review findings.

2. SRT has issued SRR and CAP soliciting agency’s response to mitigate or provide an approved plant to mitigate critical and significant review findings.

3. SRT documents that the agency in it’s first CAP submission subsequent to SRR issuance has not mitigated or provided an approved plan to mitigate critical and significant review findings.

4. Associate Director has sent SRT prepared letter to advise Head of Agency of next CAP deadline and warning that the next agency CAP submission without mitigation of or an approved plan to mitigate critical and significant review findings will meet our guideline for initiation of IRC 6103(p)(7) recommendation.

5. SRT documents that the agency in its second CAP submission subsequent to SRR issuance has not mitigated or provided an approved plan to mitigate critical and significant review findings.

(3) Initiate enforcement recommendation below if agency will not allow Safeguards to conduct on-site reviews without non-IRS additional background investigations/confidentiality statements will be required to conduct on-site reviews; or will not allow the use of automated tools to evaluate security configurations of IT devices after the following has occurred:

1. SRT has conducted phone and/or email contact with agency POC to notify of impending on-site review and agency indicates that non-IRS additional background investigations/confidentiality statements will be required to conduct on-site reviews; or will not allow the use of automated tools to evaluate security configurations of IT devices,

2. SRT has received a response from agency after sending on-site review engagement letter to Head of Agency regarding impending on-site review and advising of use of automated tools to evaluate security configurations of IT devices indicating that non-IRS additional background investigations/confidentiality statements will be required to conduct on-site reviews; or will not allow the use of automated tools to evaluate security configurations of IT devices,

3. SRT Chief has contacted agency POC and Head of Agency by phone and/or e-mail but has been unable to secure agency cooperation with conduct of the on-site review based on sufficiency of IRS background check/confidentiality statement sufficiency and of the use of automated tools to evaluate security configurations of IT devices for on-site review.

4. Associate Director has sent SRT prepared letter warning Head of Agency that not allow Safeguards to conduct on on-site review without the requirement of non-IRS background investigations/confidentiality statements and/or using automated tools evaluate security configurations of IT devices will meet or guideline for initiation of IRC 6103(p)(7) recommendation.

(4) SRT required actions to initiate IRC 6103(p)(7)recommendation:

1. Ensure that all actions regarding attempts to secure successive instances of reporting non-compliance are well documented in e-Trak.

2. Complete IRC 6103(p)(7) Recommendation for FTI Suspension and/or Termination of FTI Disclosures form.

3. Prepare GLDS Director letter of Head of Agency advising of IRC 6103(p)(7) determination and intent to terminate FTI disclosures and appeal rights.

4. Submit IRC 6103(p)(7) Recommendation for FTI Suspension and/or Termination of FTI Disclosures form for to AD for approval along with Action Routing Sheet and STAT prepared GLDS Director letter to Head of Agency advising of IRC 6103(p)(7) determination and intent to terminate FTI disclosures and agency’s appeal rights.

(1) In all cases where serious deficiencies are found or where required reports are not submitted, the responsible reviewer will attempt to obtain voluntary compliance through discussion and negotiation. (Delegation Order)

(2) When an impasse occurs, involving recipients subject to IRC §6103(p)(4) , the matter should be elevated to the appropriate GLDS management level.

(3) The reviewer should initiate enforcement recommendation if the agency will not allow Safeguards to conduct on-site reviews without non-IRS additional background investigations/confidentiality statements or will not allow the use of automated tools to evaluate security configurations of IT devices after the following has occurred:

1. Reviewer has conducted phone and/or email contact with the agency POC to notify of impending on-site review and agency indicates that non-IRS additional background investigations/confidentiality statements will be required to conduct on-site reviews, or will not allow the use of automated tools to evaluate security configurations of IT devices, or

2. Reviewer has received a response from the agency after sending on-site review engagement letter to the Head of Agency (HOA) regarding impending on-site review and advising of use of automated tools to evaluate security configurations of IT devices indicating that non-IRS additional background investigations/confidentiality statements will required to conduct on-site reviews; or will not allow the use of automated tools to evaluate security configurations of IT devices, and

3. The SRT Chief has contacted the agency POC and HOA by phone and/or e-mail but has been unable to secure agency cooperation with the conduct of the on-site review statement sufficiency of IRS background check/confidentiality statement sufficiency and of the use of automated tools to evaluate security configurations of IT devices for on-site review; and

4. The Associate Director, Safeguards has sent a letter warning HOA that not allowing Safeguards to conduct an on-site review without the requirement of non-IRS background investigations/confidentiality statements and/or using automated tools to evaluate security configurations of IT devices will meet our guidelines for initiation of IRC 6103(p)(7) recommendation.

(4) Required actions to initiate IRC 6103(p)(7)recommendation include:

1. Ensure that all actions regarding attempts to secure successive instances of reporting non-compliance are well documented in e-Trak.

2. Complete IRC 6103(p)(7) Recommendation for FTI Suspension and/or Termination of FTI Disclosures form see Exhibit 11.3.36-8.

3. Prepare letter for GLDS Director’s signature and issuance of HOA advising of IRC 6103(p)(7) determination and intent to terminate FTI disclosures and appeal rights.

4. Submit IRC 6103(p)(7) Recommendation for FTI Suspension and/or Termination of FTI Disclosures form to AD for approval along with Action Routing Sheet and GLDS Director letter to HOA advising of IRC 6103(p)(7) determination and intent to terminate FTI disclosures and agency’s appeal rights.

(1) If the appropriate management is unable to break the impasse, the recipient agency will be notified in writing of the IRS’s preliminary determination and intention to recommend discontinuance of disclosures.

(2) Such notices will allow 30 calendar days for response. Notices will indicate:

1. That a report is being submitted to the Office of Governmental Liaison Disclosure and Safeguards (GLDS) detailing the uncorrected deficiencies and the agencies reasons, if any, for noncompliance;

2. That the Director, Governmental Liaison, Disclosure and Safeguards will take appropriate action.

(3) At this time, a written report should be prepared and submitted by the Director, Office of Safeguards to the Director, Governmental Liaison and Disclosure.

(4) If it is determined that Federal tax administration would be impaired because of a safeguards deficiency, a duly delegated IRS official (see Delegation Order 11-2) may immediately suspend disclosures to the agency pursuant to IRC §6103(p)(4)and Treasury Regulation 301.6103(p)(7)-1. This would be the case where unauthorized accesses/disclosures would be made absent the suspension. See IRM 11.3.36.21.

(5) If the 30 day time frame expires without the agency taking satisfactory action, a letter will be drafted to the head of the agency from the Delegation Order 11-2 official notifying the agency that disclosures are being discontinued until such time as the deficiency is corrected. Copies of the letter should be sent to the Director, Office of Safeguards and to the Director, Office of Governmental Liaison, Disclosure and Safeguards. Documentation detailing the uncorrected deficiencies and the agency's reasons, if any, for noncompliance will be organized and maintained.

(6) The Director, Office of Governmental Liaison, Disclosure and Safeguards (GLDS) actions will be similar to those stated in section 5 above. If the Director is unable to break the impasse, the agency head will be notified in writing of the IRS’s preliminary determination and the Director's intention to recommend discontinuance of disclosure. The notice will allow 30 calendar days for response.

(7) If the 30 day time frame expires without the agency taking satisfactory action, two copies of the proposed letter to discontinue disclosures will be drafted to the head of the agency, from the Director's, Office of Governmental Liaison, Disclosure and Safeguards ,notifying the agency that disclosures are being discontinued until such time as the deficiency is corrected. Following the Director's signature, one signed copy will be retained in Headquarters Office, and the other will be forwarded to the Director, Office of Safeguards and to the Director, Governmental Liaison, Disclosure and Safeguards.

(1) The discontinuance of disclosures may take several forms. The appropriate form is dependent upon all of the facts in the case.

(2) All disclosures to an agency may be suspended or permanently cutoff in situations where the deficiency pervades the entire agency or where the agency refuses to submit the required reports.

(3) Suspensions or cutoffs of selected information may be used in cases where the deficiency can be isolated in a certain segment of the agency.