Part 10. Security, Privacy and Assurance
Chapter 6. Continuity Operations
Section 5. Annual Certification Requirements
10.6.5 Annual Certification Requirements
Manual Transmittal
March 18, 2022
Purpose
(1) This transmits revised IRM 10.6.5 Annual Certification Requirements, catalogue number 71633J.
Material Changes
(1) This updates guidance on reporting required by the Department of Treasury for all the Bureaus.
(2) A section on Pandemic Reporting was added.
(3) Sections added to conform to Publishing requirements.
(4) Links were updated.
Effect on Other Documents
This updates IRM 10.6.5 Annual Certification Requirements dated March 11, 2020..
Audience
IRM 10.6.5 applies primarily to the Office of Continuity Operations. Since this it is certification for the Service, all Business Unit Continuity activities during the year contribute to the certification.
Effective Date
(03-18-2022)
Pablo F. Meléndez
Chief, Business Continuity Operations Officer, Deputy Chief of Staff Office C:CoS:DCoS:
Continuity Coordinator
Program Scope and Objectives
(1) Purpose:
This document establishes the process for issuing the annual certification of IRS Continuity Readiness to the Department of the Treasury (Treasury). This certification will be sent to the Continuity Coordinator of Treasury annually as described in the Federal Continuity Directive - 1 (FCD-1) and in accordance with all Treasury directives.
These authorities can be found at: Federal Continuity Directive 1 - January 17, 2017 (fema.gov).
(2) Audience. These procedures apply to IRS employees who are responsible for developing, implementing, and using the Business Unit Continuity Plans including:
Members of SCR Continuity Operations;
Members of Headquarters Continuity Operations (COOP) Teams.
(3) Policy Owner. The IRS Continuity Coordinator is the Business Continuity Operations Officer of the Deputy Chief of Staff Office of the Commissioner’s Complex.
(4) Program Owner. The Program Manager of Continuity of Operations of the Senior Commissioner’s Representatives within the Deputy Chief of Staff Office.
(5) Stakeholders. All audience listed above plus Treasury Office of Emergency Programs.
Background
(1) Annex A of Federal Continuity Directive (FCD) -1 requires all departments to provide an annual certification of readiness to the Department of Homeland Security. To support this, Treasury requires IRS to provide an annual certification which declares that IRS sustains a continuity capability by maintaining the needed continuity plans and by participating in annual continuity exercises. To ensure the IRS can certify these requirements, the Senior Commissioner’s Representatives-Continuity Operations (SCR-CO:CO) will assess the Continuity Readiness of each Business Unit (BU). Continuity Readiness will be based on, but not limited to, the BU’s self-assessments of their Continuity Plans, Test and Exercises conducted, Training, and remediation of Corrective Actions, and any other relevant issues at that time that indicate Continuity Readiness.
Authority
(1) These authorities can be found at Federal Continuity Directive 1 - January 17, 2017 (fema.gov) (FCD-1).
Responsibilities
(1) The Continuity Operations Program Manager, SCR-CO:CO (or designee), in concert with Treasury’s Office of Emergency Programs (OEP) and IRS Continuity Stakeholders, will determine the criteria required to ensure demonstration of IRS Continuity Capabilities, which will include, but is not limited to: an adequate number of Tabletop Exercises (TTX) and/or Integrated Functional Exercises (IFE) to be conducted for the fiscal year; current Continuity Plan; completed Corrective Actions and After Action Reports; and any other responses required during actual events.
(2) SCR-CO:CO staff will support the continuity of IRS essential functions by providing Continuity Program policy, guidance, and oversight, establishing and assuring compliance with metrics integrated into a comprehensive, risk-based, Test, Training and Exercise program, and assisting the BUs to integrate continuity capabilities into their daily operations.
(3) SCR-CO:CO staff will verify that each BU is fully successful and in compliance with guidelines in the annual Continuity Program Requirements memo issued at the start of each fiscal year, or actions to correct the deficiencies.
(4) BUs will ensure compliance with the requirements outlined in the annual Continuity Program Requirements memo as some of this information will contribute to the IRS’ ability to certify its Continuity Capability to Treasury.
Program Reports
(1) There are no program reports on the completion of this annual certification.
Related Resources
(1) Support procedures are listed in Cos:SCR-CO Standard Operating Procedures:
SOP_004_Test_and_Exercise_Corrective_Action_final (Test and Exercise Corrective Action Program);
SOP_005_Continuity_Test_and_Exercise_Monitoring_Procedures_final (Continuity Test and Exercise Monitoring Procedures);
SOP_006_Training_and_Monitoring_Procedures_final (Training and Monitoring Procedures).
Procedures
(1) At the beginning of each fiscal year, the IRS Continuity Coordinator will issue a memorandum to all IRS BUs that describes the current fiscal year IRS Continuity Program Requirements. The memorandum identifies critical activities that must be performed by each BU, which includes required test and exercises and standards that must be met.
(2) During the fiscal year, SCR-CO:CO will monitor the various components of Continuity Readiness to ensure each BU is meeting these standards.
(3) By September 1 of each Fiscal Year, SCR-CO:CO will prepare for the signature of the IRS Continuity Coordinator, a letter Treasury’s Assistant Secretary for Management, certifying that the IRS has met the standards of Continuity Capability, or if not, the Corrective Actions underway with expected completion dates.
Documentation
(1) Continuity documentation, (such as BU plans and compliance tracking sheet), must be accessible by SCR-CO:CO; either kept centrally on the location mandated by SCR-CO:CO.
Distribution
(1) The IRS will submit the Annual Statement of Assurance of Continuity Capability to Treasury with the understanding it may be included in their submission to the Department of Homeland Security as well as Congress, if requested.
(2) SCR-CO:CO will distribute a copy to NCPOCs and members of the HQCOOP.
(3) A copy will also be posted on the SCR-CO:CO MS-SharePoint site.
Pandemic
(1) Pandemics vary in scale and effect. If the IRS has set up and Incident Management Team as a response to a pandemic, the IRS will distribute to the Department of Treasury any information requested.
(2) During the Pandemic, this may include:
Daily Status Reports;
Mitigation efforts;
Best Practices.
(3) At the conclusion of the Pandemic, the IRS will produce an After-Action Report, a summary of which will be provided to the Department of Treasury:
What worked right;
What went wrong;
Lessons Learned;
Corrective Actions.
(4) During and after the Pandemic, the IRS will participate in any Audit by the Treasury Inspector General for Tax Administration or the Government Accountability Office.
