10.6.4. Incident Management Program

(1) This IRM lays the foundation to implement and manage the Incident Management Program and Plan within the IRS to ensure an efficient and effective response and recovery following incidents that impact IRS personnel, facilities, and/or business operations.

(1) IRM 10.6.1, Continuity Operations Program, Continuity Planning Requirements, March 2014, establishes the continuity program and the policy framework for the IRS.

(2) Presidential Policy Directive 8/PPD-8: National Preparedness, April 11, 2011.

(3) Homeland Security Presidential Directive (HSPD) 5 - Management of Domestic Incidents, December 2003.

(4) Presidential Policy Directive 40, National Continuity Policy, July 15, 2016.

(5) Federal Continuity Directive 1 (FCD-1), Federal Executive Branch National Continuity Program and Requirements, January 17, 2017.

(6) National Incident Management System (NIMS), October, 2017.

(1) The IRS Incident Management Program is owned by SCR Continuity Operations (SCR-CO:CO) and Implemented by SCR Field Operations (SCR-CO:FO) and Campus SCRs as appropriate. See IRM 10.6.4.2 of this IRM for details.

(2) The IRS Incident Management Team (IMT) is cross functional and set up in response to a specific incident. SCR-CO:FO or Campus SCR will activate the IMT. See IRM 10.6.4.3 of this IRM for details.

(1) There are no periodic reports specifically on the Incident Management Program.

(2) When the Incident Management Plan is implemented and an IMT is activated, reports will be sent to the Senior Executive Team on a frequency determined by the scope of the incident. Usually this is daily, but may be more or less frequent as needed.

(3) The Treasury Operations Center (TOC) will be provided a copy of the Incident Status Report.

(4) All Corrective Actions generated from an Incident are tracked in the SCR-CO:CO Monthly Measures.

(1) Incident - An occurrence or event, natural or man-made, that requires a response to protect life or property. Incidents can, for example, include major disasters, emergencies, terrorist attacks, terrorist threats, civil unrest, wildland and urban fires, floods, hazardous materials, spills, nuclear accidents, aircraft accidents, earthquakes, hurricanes, tornadoes, tropical storms, tsunamis, war-related disasters, public health and medical emergencies, and other occurrences requiring an emergency response.

(2) Incident Management - The broad spectrum of activities and organizations providing effective and efficient operations, coordination, and support applied at all levels of government, utilizing both governmental resources to plan for, respond to, and recover from an incident regardless of cause, size, or complexity.

(1) CP - Continuity Plan;

(2) EOC - Emergency Operations Center;

(3) IC - Incident Commander;

(4) IMP - Incident Management Plan;

(5) IMT - Incident Management Team;

(6) LCR - Local Continuity Representative;

(7) NCPOC - National Continuity Point of Contact;

(8) OEP - Occupant Emergency Plan;

(9) SCR-CO - Senior Commissioner’s Representative-Continuity Operations;

(10) SCR-CO:FO - SCR Field Operations;

(11) SCR-CO:CO - SCR Continuity Operations.

(1) Incident Management Planning involves coordination with other IRS emergency plans that are referred to as the IRS Business Continuity Suite of Plans. The suite of plans include:

1. Incident Management Plan;

2. Occupant Emergency Plan;

3. Continuity Plan (Headquarters and Business Units);

4. Disaster Recovery/ Information Systems Contingency Plan.

(2) The following IRMs provide the plan requirements:

1. This IRM provides the requirements for the Incident Management Plan;

2. IRM 10.2.9Occupant Emergency Planning, October 5, 2017 provides requirements related to Occupant Emergency Plans;

3. IRM 10.8.60Information Technology (IT) Security, IT Service Continuity Management (ITSCM) Policy and Guidance, September 4, 2015 provides requirements for Information Systems Contingency Plans and Disaster Recovery Plans;

4. IRM 10.6.1Continuity Operations Program, Introduction to Continuity Planning, March 2014 and current update provides requirements for the IRS Continuity Plans.

(1) The IRS Incident Management Plan (IMP) provides a standardized, yet flexible, framework to managing incidents that impact its personnel, facilities, and/or IRS operations, regardless of incident type, location, and/or severity.

(2) The IMP is implemented by the activation of an IMT, led by an IC, who takes command and control, coordinates and communicates response and recovery activities for all impacted personnel and business units, regardless of to whom they normally report. This includes prioritization and coordination of the resources needed to continue, devolve, and/or reconstitute IRS Mission Essential Functions (MEFs), Essential Support Activities (ESAs), and Critical Business Processes (CBPs).

(3) The IRS Business Unit Continuity Plans (CPs) are implemented and coordinated through the IMP. Each business unit at the impacted site should have a Local Continuity Representative (LCR) who represents their business unit on the IMT’s Operations Section.

(4) All IRS locations with assigned personnel are covered by the IRS IMP.

(5) IRS will designate a sufficient number of IMP Owners and Local and/or Area IC(s) to cover all locations with assigned personnel.

(6) The Plan Owner may be responsible for multiple location(s) based on type of office and/or geographical location.

(7) The standardized IMP, as developed by SCR-CO:CO with input from Plan Owners, is required for use to ensure consistency across the enterprise. The Plan incorporates features of the Incident Command System.

(8) The IMP will be reviewed and updated on an annual basis or when critical changes are required due to lessons learned and/or best practices following exercises or real-world incidents.

(9) The IMP will be exercised as required by the IRS Test and Exercise Program requirements.

(1) The Incident Management Plan (IMP) consists of three components:

1. Incident Management Plan;

2. IMT Contact List;

3. Incident Management Plan Toolkit.

(1) IRS has the designated the following as IMP owners:

1. SCR-CO:FO SCRs are responsible for all field posts of duty and the Enterprise Computing Center - Martinsburg;

2. Wage and Investment Campus Directors are responsible for all campus locations and the Tennessee Enterprise Computing Center. Wage and Investment Campus Directors will work with the SCR-CO:FO SCR if the incident is large in scope or covers multiple geographic areas.

(2) Incident Management Plan Owners are responsible for:

1. Maintaining the IMP;

2. Identifying a sufficient number of IMT(s) for their geographical area of responsibility;

3. Identifying a primary and two alternates for key positions on each IMT. Key Positions include the IC, CS (Officers), and GS (Chiefs);

4. Maintaining a list(s) of their IMT members, with current contact information;

5. Coordinating with Continuity Operations to maintain a list(s) of the Operation’s Section Local Continuity Representatives (LCRs), as designated by the BUs with current contact information,;

6. Identifying and maintaining a list of primary and alternate EOCs;

7. Ensuring that key positions on the IMT, both primary and alternates, understand their team role and responsibilities;

8. Coordinating and/or conducting, and documenting completion of all required tests and exercises and report status/completion to SCR-CO:CO, as required;

9. Coordinating and/or conducting a hot wash and complete the after-action report/improvement plan following exercises and/or real-world incidents and provide documentation to SCR-CO:CO;

10. Monitoring corrective actions to ensure all are completed and report status/completion to SCR-CO:CO as required;

11. Assist in updating the IMP.

(1) An EOC is the central command and control facility where the IMT meets to manage and/or coordinate response and recovery operations.

(2) The EOC may be a physical fixed location or a virtual location or a combination of both.

(3) At a minimum, IRS must identify a primary and an alternate EOC for the IRS Senior Executive Team / Headquarters Commissioner's Core COOP Team.

(1) The lead of the IMT is the IC.

(2) The Command Staff consists of:

1. HCO Representative;

2. Campus Liaison;

3. Information Officer;

4. Liaison Officer;

5. Government Liaison Officer;

6. Safety Officer;

7. Security Officer;

8. Criminal Investigations Special Agent;

9. Treasury Inspector General for Tax Administration (TIGTA) Office of Investigations Special Agent;

10. National Treasury Employees Union (NTEU).

(3) The General Staff consists of:

1. Operation Section Chief, with LCRs reporting to Operations Section Chief;

2. Planning Section Chief;

3. Logistics Section Chief;

4. IT Section Chief;

5. Finance/Administrative Section Chief.

(4) To prevent any potential mishandling or confusion during an emergency, LCR selections should not include individuals who perform other roles within an IMT.

(1) IMT roles and responsibilities are defined in the IMP.

(2) The plan includes a quick response checklist for each role.

(1) Because each incident or event differs from all others in scope and impact, both Lessons Learned and Corrective Actions must be scaled appropriately.

(2) IC Responsibilities include, but are not limited to:

1. Identifying weaknesses in preparation, response, and reconstitution;

2. Developing improvement plans to address these weaknesses;

3. Tracking all BU specific resources used.

(3) SCR-CO:CO:

1. General Responsibilities are similar to BU responsibilities but also include all necessary supporting activities such as Procurement, Real Estate, and Physical Security;

2. Specific Responsibilities focus on issues related to program continuity and recovery, especially relating to the Service's Mission Essential Functions (see IRM 10.6.1Introduction to Continuity Planning).

(4) SCR-CO:FO Specific Responsibilities include issues identified as Incident Management (see IRM 1.4.12 Resource Guide for Managers, Senior Commissioner’s Representatives Roles in Management of IRS Field and Headquarters Offices,), employee accountability, and overall coordination.

(5) Agency Responsibilities:

1. The Service will assume responsibility for issues that will or may become public information, such as integrity of tax information;

2. The Service will provide coordinated response and tracking for all issues and questions raised by the oversight agencies;

3. Until delegated, the Service will be the primary contact for any audits or investigations;

4. SCR-CO:CO will assume responsibility for monitoring status of Corrective Actions resulting from an incident or event, and will provide reports, as appropriate.

(1) The purpose of the reporting is to ensure all critical processes of the Service are able to resume critical operations.

(2) All Corrective Actions must be submitted to Continuity Operations for tracking.

(3) It is the responsibility of each IC to close all Corrective Actions timely.

(4) Based on the Corrective Action Tracking Report, CO will identify any delinquent, incomplete, or unclosed issues and provide to the Continuity Operations Program Manager, SCR-CO:CO, for follow-up with SCR-CO:FO, or the individual BUs as needed.

(5) A summary of Corrective Actions status (not identified by any individual BU) will be included in a quarterly report to the Continuity Operations Program Manager, SCR-CO:CO. This will include type of Corrective Actions, and if appropriate, a listing of incomplete or unclosed recommendations with aging information.