10.10.2. Authentication Risk Assessments in Non-Digital Channels

(1) This IRM builds on existing policy by adding processes for assessing, documenting, and addressing authentication risks for telephone/voice, in-person, remote in-person, and correspondence channels. This policy applies NIST Risk Management Framework concepts to IRS authentication processes as a baseline for completing these risk assessments.

(1) By law, federal agencies are expected to document, publish and maintain records of policies, authorities, procedures and organizational operations. The IRM is the source for the IRS. See IRM 1.11.1.1.2, Authority, for the authorities and legal obligations of Internal Management Documents (IMDs).

(2) Confidentiality regulations such as IRC 6103 and other Federal guidelines require the IRS to authenticate the identity of individuals with whom it exchanges sensitive but unclassified (SBU) information (including personally identifiable information (PII) and tax information), regardless of the channel. Management officials bear the responsibility to conduct risk assessments of factors, procedures, and processes used to authenticate taxpayers, representatives or other third-parties interacting with the IRS.

(3) Privacy, Government Liaison and Disclosure’s (PGLD) Privacy Policy and Knowledge Management (PPKM) implements relevant privacy statutes, regulations, guidelines, OMB Memoranda, and other requirements. Numerous statutes such as the Privacy Act, Federal Information Security Modernization Act (FISMA) and Paperwork Reduction Act are reinforced by OMB and NIST guidance and implemented by the IRS accordingly.

(1) The Director, Identity Assurance (IA) is responsible for the Non-Digital Authentication Risk Assessment (NDARA) process.

(2) Organization Executives and Management Officials who lead programs described in this policy are responsible for these guidelines for continuous monitoring of new and ongoing authentication policies related to these channels.

(3) Executives of each IRS organization are responsible for ensuring an NDARA is completed every three years for each of their respective programs related to these channels. Any risks identified should be documented, mitigated and monitored.

(4) Each IRS organization is responsible for establishing internal processes for managing their risk assessment procedures and monitoring based upon this guidance.

(5) A copy of approved assessments will be emailed to *OS P GLD IA Risk Assessments, for policy team review and coordination on any identified risks.

(1) The Identity Assurance function manages and reviews the Authentication Risk Assessments in Non-Digital Channels Program.

(1)  Business Units are responsible for completing an NDARA every three years and addressing any deficiencies identified. The follow-up timeframe for addressing identified acceptable deficiencies or risks is every three years until resolved. The follow-up timeframe for addressing identified deficiencies or risks is every 6 months until determined acceptable or resolved.

(2) When risk assessments are completed and signed, they become an official record and must be maintained in accordance with Document 12829, General Records Schedule (GRS) 5.7 Item 020. Each office is responsible for reports and audits identifying internal administrative program weaknesses and risks, mitigation action plans, corrective actions, tracking records, correspondence, and other records held by the office responsible for coordinating internal control functions including risks. Destroy records five years after no further corrective action is needed.

(1) The tables lists commonly used terms and definitions:

(2) The table list commonly used acronyms and definitions:

(1) The Non-Digital Authentication Risk Assessment Form 15295 may be accessed at https://core.publish.no.irs.gov/forms/internal/pdf/f15295--2022-10-00.pdf

(2) Privacy Act of 1974 (as amended)

(3) IRC 6103, Confidentiality and Disclosure of Returns and Return Information

(4) NIST Special Publication 800-37, Risk Management Framework

(5) GAO 15-593SP, A Framework for Managing Fraud Risks in Federal Programs

(1) Prepare to consider risk of the authentication process in telephone/voice, in-person, remote in-person, and correspondence, depending on the risk. Key tasks applicable to assessing risk in IRS customer contact channels, include steps to:

• Describe the channel and how users gain access (i.e., telephone/voice, in-person, remote in-person, and correspondence).

• List data potentially included in the exchange and its level of sensitivity (i.e., SBU data, FTI, PII, law enforcement, or non-sensitive items).

• Gather subject matter experts (SMEs), appropriate to the tools used in the authentication process.

• Identify roles and responsibilities which may include Process Owner, Assessment Reviewers, Business Unit SMEs and Technical SMEs, if applicable.

(1) Categorize the risks in IRS authentication channels, and consider the components of the customer contact. Review the information gathered in the Prepare step in this IRM and include additional details to assess the level of risk associated with each factor.

• Review and list all data in the process required for authentication.

• Determine sensitivity of the data needed to authenticate.

• Determine the data made available, if successfully authenticated.

• Consider prior incidents and the potential for improper authentication of a taxpayer.

• Consider the type of users accessing the data (individuals, businesses, third or fourth-party representatives).

(1) Select an initial set of controls for the authentication process and tailor the controls as needed to reduce risk to an acceptable level based on an assessment of risk. Things to consider when selecting a set of controls:

• Examine generally accepted best practices.

• Review NIST, OMB or legislative guidance specific to the channel.

• Model industry best practices and available tools.

• Consider how this authentication process affects or is affected by other channels which may provide support and, if appropriate, mitigate risks where they overlap.

• The availability of options to eliminate or mitigate a risk.

• Cost of meeting the privacy and security requirements, compared to the cost of inadequate privacy and security.

• Inconvenience, distress or damage to standing or reputation.

• Financial loss or agency liability.

• Harm to agency programs or public interests.

• Personal safety.

• Civil or criminal violations.

(1) Implement controls at a level matching the risk to the channel. These controls must be adapted to the customer contact channel used to authenticate the individual. This includes information in physical, technological, and personal exchanges of information. Implementation may include application of commercially available solutions, new technology, adjustments to procedures, or new policies. Document any deviations from selected levels of risk. Note: SeeIRM 10.8.1, Policy and Guidance for guidance on risk acceptance and risk-based decisions.

(1) Assess the controls once implemented to ensure they are operating as intended. Ongoing assessments, such as quality reviews and operational reviews reduce overall risk by identifying problems before they may be exploited. These assessments may be performed at a variety of levels. Any newly identified risks must be analyzed using this process, beginning at the step most applicable to the nature of the risk and addressed within a reasonable timeframe, appropriate with the risk.

(1) Monitor all non-digital authentication channels (i.e., telephone/voice, in-person, remote in-person, and correspondence) at a level of frequency matching the level of sensitivity and frequency of changes to the related channel.

• Program level continuous monitoring must provide for immediate response, when necessary, as well as periodic reviews of the program for new threats or vulnerabilities. The regularity for response must be commensurate with the level of risk in the interaction. This policy recommends completing a full risk assessment every one to three years, depending on the results of the initial assessment and any intervening events.

• Owners of this policy should review it at least every three years, when changes are made to the related processes, or an external event, such as large improper releases of information or legislative changes, prompts review. The review should ensure the policy remains consistent with NIST, OMB, and other related requirements for IRS and the government, in general.

(1) Authorize the process at the level of ownership for the authentication channel. Refer to the Prepare step’s governance roles in this IRM.