10.2.8. Incident Reporting

(1) SAMC is tasked with receiving and promptly reporting all physical security incidents and/or threats. SAMC’s mission is to document, archive and report incidents, threats, and emergencies by supporting the Internal Revenue Service’s law enforcement partners to ensure the safety of IRS personnel, facilities, and infrastructure. Additionally, SAMC disseminates, documents, and responds to inquiries from the Department of the Treasury, governmental agencies, and other federal law enforcement partners. This is important as SAMC must be kept apprised of situations that could require the immediate assistance and/or attention of the IRS Commissioner, the Chief, FMSS, and/or other IRS Leadership.

(2) SAMC operates 24 hours 7 days a week and is the focal point for incident reporting. SAMC monitors and routes incident reports to the appropriate IRS personnel.

(1) Treasury Directive (TD), TD P 85-01, Treasury Information Technology Security Program, February 28, 2022

(2) Restructuring and Reform Act (RRA) 98, 26 United States Code (USC) 7608 (b) and Public Law 105-206 or The Internal Revenue Service Restructuring and Reform Act of 1998

(3) Homeland Security Act of 2002 and 40 USC 1315

(1) Chief, FMSS prescribes and oversees security incident reporting, policy, and guidance.

(2) AD, Security oversees planning, developing, implementing, evaluating, and controlling security incident reporting.

(3) Each FMSS Operations AD and TM will ensure each SSC adheres to the IRS Incident Reporting Program.

(4) Section Chief, SAMC, is responsible for:

1. Developing and updating policy, procedures, and training documents.

2. Serving as the Threat and Incident Response Center (TIRC) Chair.

3. Maintaining Internal Controls for the SAMC Program.

4. Reviewing and approving the daily Leadership View (LV) report that outlines the Level 1, Level 2, and Level 3 Physical Security Incidents along with any office closures that occurred that day.

5. Establishing a secure process to receive physical security incidents and providing guidance to Watch Stander (WS) on proper classification, as needed.

(5) The SSC is responsible for:

1. Monitoring all incidents and threats within their geographical area to assist in identifying the validity of the data reported.

2. Ensuring reported incidents are properly addressed through established protocols and countermeasures.

3. Submitting the Follow Up Incident Report (FUIR).

   Note: All incidents that have been classified as a Level 1 incident and/or threat require a FUIR.

   Note: The FUIR must be submitted to SAMC within 24 hours of occurrence.

   Note: A Level 2 or 3 incident and/or threat may require a FUIR at the discretion of the AD of Security. The FUIR for Level 2 or 3 incidents must be completed within 72 hours.

4. Completing and ensuring their assigned Physical Security Staff complete ITM Course 71555, SAMC Incident Reporting, annually.

5. Providing updates on incidents to the FMSS TM, FMSS Operations AD, and SAMC until the incidents are completed and/or terminated.

   Note: Any incident requiring the evacuation or closing of an IRS facility due to an impending threat, either natural or man-made, is considered significant. In addition to SAMC, the FMSS TM and/or SSC must also report significant incidents immediately to the Chief, FMSS, and Operations AD by telephone. This initial notification is intended to provide forewarning of impending threats and/or situations.

(6) SCR/AO is responsible for reporting facility closures affected by any major equipment failures, natural disasters, acts of nature, or severe weather.

1. Reports of closures to SAMC must include:
   i. Description of the incident
   ii. Facility impacted by the incident
   iii. Number of personnel affected
   iv. Amount of time the facility is expected to be closed

(7) All IRS Personnel are responsible for:

1. Familiarizing themselves with the physical security incident and emergency reporting procedures, including the reporting of all physical security incidents, to SAMC within 30 minutes of incident discovery, or when it is safe to do so.

   Note: For additional information, see ITM Course 71555, SAMC Incident Reporting.

(1) Program Goals: To ensure servicewide incident reporting for IRS Headquarters (HQ) and provide senior leader awareness and analysis.

(2) Program Reports: Provide information regarding reporting of the program objectives. It is not intended to provide instruction for completing any reports. Identify the data sources, storage location, and the primary purpose for this data.

(3) Program Effectiveness: The timely and accurate incident processing, incident reporting, and notification to appropriate stakeholders.

(4) Internal Control - Random Sampling Process: Ensures that SAMC complies with the 15-minute timeframe for incident processing.

(5) Annual Review: Review the processes included in this manual annually to ensure accuracy and promote consistent tax administration.

(1) Internal Control - Random Sampling Process – ensures that the WS complies with the 15-minute timeframe for incident processing within the TRC application.

(1) Direct Threat - A threat is made through verbal communication when an individual threatens to harm a government employee, others, themselves, or any public officials. Threat can be communicated telephonic, in writing, through the postal service, through other electronic means or by body language. A threat can also be made to a government employee away from government property when the person making the threat has identified the individual by the nature of their work. Threats must be reported to law enforcement, onsite Protective Security Officer (if available) and management.

(2) Federal Protective Service (FPS) - An organization within the Department of Homeland Security (DHS) that protects federal facilities, their occupants, and visitors by providing law enforcement and protective security services/officers.

(3) Follow Up Incident Report (FUIR) - Report generated and prepared by the impacted SSC and used by the TIRC to outline the actions taken by FMSS to mitigate the reported incident/threat.

(4) Incident - An occurrence of an action or situation, such as an act of human intervention or an act of nature (e.g., storm or fire) that requires a physical security response.

(5) Indirect Threat - Any verbal or nonverbal communication that raises a concern of potential violence. The comment is stated indirectly about a government employee, person, themselves, government officials or towards a government facility. The communications can be received in person, through body language, in writing, by telephone, by fax or other electronic means.

(6) Information Technology (IT) Security - IT security service provider responsible for ensuring IRS compliance with federal statutory, legislative, and regulatory requirements governing confidentiality, integrity, and availability of IRS electronic systems, services, and data.

(7) Infrastructure - The basic equipment and structures (e.g., phones, desks, electricity, buildings) that are needed for the IRS to function properly.

(8) Insider Threat - An insider threat includes but is not limited to, Unauthorized Access (UNAX) violations; workplace violence and threats; domestic violence; concerning or inappropriate behavior; security breaches; background investigations; and information disclosures.

(9) Level 1 Incident - Incidents (actual or alleged) involving a direct or imminent threat or implied threat of physical harm to employees, contractors, visitors; damage, and/or destruction of IRS facility, infrastructure, property, and/or equipment; and/or actual or potential compromise of IRS data. Incidents can be direct (e.g., face to face or via phone call); indirect (e.g., email, mail, or other social media;) or other (e.g., defacement of property, conveyed via another party or source).

(10) Level 2 Incident - Incidents (actual or alleged) involving an indirect threat of physical harm to employees, contractors, visitors; damage and/or destruction of IRS facility, infrastructure, property, and/or equipment; and/or actual or potential compromise of IRS data. Incidents can be indirect (e.g., verbal via phone call, email, mail, or other social media;) or other (e.g., defacement of property, conveyed via another party or source).

(11) Level 3 Incident - Incidents involving no direct or indirect physical harm to employees, contractors, visitors; damage, and/or destruction of IRS facility, infrastructure, property and/or equipment; and/or actual or potential compromise of IRS data. Example of incidents include, minimal security or management involvement, security exercises, and loss, theft, or unrecoverable ID media.

(12) Personally Identifiable Information (PII) - Is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.

(13) Personnel - Refers to IRS employees and contractors.

(14) Privacy, Governmental Liaison and Disclosure (PGLD) - An IRS organization whose mission is to protect the sensitive information and privacy of taxpayers and employees.

(15) Security Exercises - Security awareness drills such as Shelter-in-Place, Fire Drill, and Active Shooter.

(16) SAMC - A 24/7 program within FMSS responsible for incident and threat reporting servicewide. The SAMC also serves as the central point for all incident communications and notifications.

(17) Stakeholder - IRS business unit or individual responsible for security oversight and/or with a need to know.

(18) Taxpayer Assistance Center (TAC) - An IRS location that provides taxpayers with tax assistance face-to-face.

(19) Threat - A person or thing likely to cause damage or danger.

(20) Treasury Inspector General for Tax Administration (TIGTA) - A Treasury organization committed to the prevention and detection of fraud, waste, and abuse within the IRS and related entities.

(21) TIGTA Incident Notification Submittal (TINS) - Incidents submitted by TIGTA to SAMC.

(22) Threat and Incident Response Center (TIRC) - Group that monitors and reviews incidents and threats to the IRS. Stakeholder organizations, including: FMSS, TIGTA, Criminal Investigation (CI), PGLD, IT Cyber Security, and FPS.

(23) Threat Response Center (TRC) - Database software application used by the Watch Standers to manage all incident and threats reported to SAMC.

(24) Watch Stander (WS) - SAMC personnel that receive and process incidents and distribute to appropriate stakeholders.Acronyms

(1) IRM 10.2.9, Occupant Emergency Planning

(2) IRM 10.5.4, Privacy and Information Protection, Incident Management Program

(3) IRM 10.8.1, Information Technology, Policy and Guidance

(4) IRM 21.3.4, Taxpayer Contacts, Field Assistance

(5) Insider threat Capability Concept of Operations