IRS 1075~1.pdf

Publication 1075 Tax Information Security Guidelines

For Federal, State and Local Agencies

Safeguards for Protecting Federal Tax Returns and Return Information

IRS Mission Statement

Provide America’s taxpayers top-quality service by helping them understand and meet their tax responsibilities and enforce the law with integrity and fairness to all.

Office of Safeguards Mission Statement

The Mission of the Office of Safeguards is to promote taxpayer confidence in the integrity of the tax system by ensuring the confidentiality of IRS information provided to federal, state, and local agencies. Safeguards verifies compliance with IRC 6103(p)(4) safeguard requirements through the identification and mitigation of any risk of loss, breach, or misuse of Federal Tax Information held by external government agencies.

Publication 1075 (September 2016) i

Changes for September 2016 Revision

This publication revises and supersedes Publication 1075 (October 2014) and is effective September 30, 2016. Feedback for Publication 1075 is highly encouraged. Please send any comments to SafeguardReports@irs.gov. Following are the highlighted changes:

1) Editorial changes have been made throughout this document to update website references and links, as well as to renumber sections and to clarify guidance

2) Table of Contents updated. Please find “tables” listed under respective sections rather than at the end of the Table of Contents

3) Section 1.3 – “Access Safeguards Resources Online” changed to “Access Safeguard Resources”

4) Section 1.3.1 – Added “Website Resources”

5) Section 1.3.2 – Added “Mailbox”

6) Section 1.4.1 – “Federal Tax Information (FTI)” – Added reference to include the Centers for Medicare and Medicaid and IRC 6103(p)(2)(B) Agreements

7) Section 2.7 – Created Section 2.7.1 “On-Site Review Process” and 2.7.2 “Computer

Security Review” to elaborate on the Safeguard Review Process

8) Section 2.9 – Added “Voluntary Termination of Receipt of FTI”

9) Section 2.9.1 – Added “Archiving FTI”

10) Section 2.9.2 – Added “Termination Documentation”

11) Section 3.2 – Updated “Electronic and Non-Electronic Logs” requirements and deleted duplicate log sample

12) Section 4.4 – Deleted duplicate paragraph for FTI in transit

13) Section 4.6 – “Offsite Storage Requirements” – Updated to show agency-type specific requirements

14) Section 4.7.1 – “Equipment” - Added exception for use of VDI and updated to include personally-owned devices

15) Section 5.1.1 – Added “Background Investigation Minimum Requirements”

16) Section 5.4.2 – Added guidance for use of Consolidated Data Centers

17) Section 5.4.2.1 – Added all contractor and shared sites to be included in Safeguard reviews mailto:SafeguardReports@irs.gov

18) Section 5.4.3 – Added “Review Availability of Contractor Facilities”

19) Section 6.3 – Updated “Disclosure Awareness Training”

20) Section 7.2.1 – Renamed from “SSR Update Submission and Instructions” to “Initial SSR Submission Instructions-New Agency Responsibility”

21) Section 7.2.2 – Renamed from “SSR Update Submission Dates” to “Instructions for Agencies Requesting New FTI Data Streams” and includes the mandatory requirement for providing evidence of security testing and ATO before the system is operational

22) Section 7.2.3 – Renamed from “SSR Update Submission Instruction” to “Annual SSR Update Submission Instructions”

23) Section 7.2.2 – Renumbered “SSR Update Submission Dates” to Section 7.2.4

24) Section 7.4 – Added table for 45 Day Notification Reporting Requirements

25) Section 7.4.4 – Removed requirement to notify Safeguards prior to implementing a data warehouse

26) Section 7.4.5 – “Non-Agency Owned Systems” updated

27) Section 7.4.8 – Removed requirement to notify Safeguards prior to locating FTI in a virtual environment

28) Section 8.3 – “Destruction and Disposal” – Updated section to include new requirements regarding shredding and updated regarding whenever physical media leaves the physical or systemic control of the agency

29) Section 9.2 – Updated Table 8 for Automated Compliance and Vulnerability

Assessment Testing to include profiles used with these tools can be downloaded from the Office of Safeguards’ website

30) Section 9.3.1.7(b) – “Unsuccessful Log On Attempts (AC-7) - Updated automatic lock period to 15 minutes

31) Section 9.3.1.10 – “Session Termination (AC-12)” – Updated to show information system must automatically terminate a user session after 30 minutes of inactivity

32) Section 9.3.1.15 – “Use of External Information Systems (AC-20) – Updated to reflect personally-owned device requirements.

33) Section 9.3.2.3 – Added definition of personnel with security roles and responsibilities and added distinction from Section 6.3, Disclosure Awareness and 9.3.2.2, Security Awareness Training (AT-2)

34) Section 9.3.3.8(c) – “Time Stamps (AU-8)” – Updated regarding synchronization of internal information system clocks

35) Section 9.3.3.10 – “Audit Record Retention (AU-11)” – Added clarification on retention

36) Section 9.3.7.3 – “Device Identification and Authentication (IA-3)” – Added clarification

37) Section 9.3.8.3 – Updated Incident Response Testing to remove the word, “systems” as testing requirements apply to both paper and electronic FTI

38) Section 9.3.11.7 – Updated to reflect 5 year retention period requirement

39) Section 9.3.12.3(c) – Added to Rules of Behavior (PL-4), “review and update at a minimum annually”

40) Section 9.3.15.6 – “Security Engineering Principles” (SA-8) - Added clarification of what security engineering principles include

41) Section 9.4.8 – “Mobile Devices ” - Updated to reflect current restrictions with

BYOD

42) Section 9.4.9 – Updated Multi-Functional Devices to include High-Volume Printers

43) Section 9.4.11(g) – “Storage Area Networks” - changed audit review to weekly

44) Section 9.4.13 – “Virtual Desktop Infrastructure” – updated to include agency and non-agency owned requirements

45) Section 9.4.14 – “Virtual Environment” Removed requirement to notify Safeguards prior to locating FTI in a virtual environment

46) Section 9.4.17 – “Web Browser” – Removed requirement a) Private browsing must be enabled on the Web browser and configured to delete temporary files and cookies upon exiting the session

47) Section 10.0 – Updated Reporting Improper Inspections or Disclosures including Table 9: TIGTA Field Division Contact Information

48) Section 12.1 – Updated guidelines for agencies authorized to produce statistical reports in “Return Information in Statistical Reports – General”

49) Exhibit 7 – “Safeguarding Contract Language” - added additional requirements in Section I Performance and Section III Inspection

50) Exhibit 10 – Changed to reflect updated SSR Requirements

51) Exhibit 12 – Glossary and Terms is no longer labeled, but is still found in the back of the publication

Table of Contents

1.0 Introduction

1.1 General

1.2 Overview of Publication 1075

1.3 Access Safeguards Resources

1.3.1 Website Resources

1.3.2 Mailbox

1.4 Key Definitions

1.4.1 Federal Tax Information (FTI)

1.4.2 Return and Return Information

1.4.3 Personally Identifiable Information

1.4.4 Information Received From Taxpayers or Third Parties

1.4.5 Unauthorized Access

1.4.6 Unauthorized Disclosure

1.4.7 Need to Know

2.0 Federal Tax Information and Reviews

2.1 General

2.2 Authorized Use of FTI

2.3 Secure Data Transfer

2.4 State Tax Agency Limitations

2.5 Coordinating Safeguards within an Agency

2.6 Safeguard Reviews

2.7 Conducting the Review

Table 1 – Safeguard Review Cycle

2.7.2 Computer Security Review Process

Table 2 – IT Testing Techniques

2.8 Corrective Action Plan

2.9 Voluntary Termination of Receipt of FTI

2.9.1 Termination Documentation

2.9.2 Archiving FTI Procedure (for agencies terminating receipt of FTI but required by statute to retain FTI for designated periods)

3.0 Recordkeeping Requirement – IRC 6103 (p)(4)(A)

3.1 General

3.2 Electronic and Non-Electronic FTI Logs

Figure 1 – Sample FTI Log

3.3 Converted Media

3.4 Recordkeeping of Disclosures to State Auditors

4.0 Secure Storage—IRC 6103(p)(4)(B)

4.1 General

4.2 Minimum Protection Standards

Table 3 – Minimum Protection Standards

4.3 Restricted Area Access

Figure 2 – Sample Visitor Access Log

4.3.1 Use of Authorized Access List

4.3.2 Controlling Access to Areas Containing FTI

4.3.3 Control and Safeguarding Keys and Combinations

4.3.4 Locking Systems for Secured Areas

4.4 FTI in Transit

4.5 Physical Security of Computers, Electronic, and Removable Media

4.6 Media Off-Site Storage Requirements

4.7 Telework Locations

4.7.1 Equipment

4.7.2 Storing Data

4.7.3 Other Safeguards

5.0 Restricting Access—IRC 6103(p)(4)(C)

5.1 General

5.1.1 Background Investigation Minimum Requirements

5.1.2 Implementing the Background Investigation Requirement

5.2 Commingling of FTI

5.2.1 Commingling of Electronic Media

5.3 Access to FTI via State Tax Files or Through Other Agencies

5.4 Controls over Processing

5.4.1 Agency Owned and Operated Facility

5.4.2 Contractor or Agency Shared Facility - Consolidated Data Centers

5.4.2.1 Agency Shared Facilities:

5.4.2.2 Consolidated Data Centers:

5.4.3 Review Availability of Contractor Facilities:

5.5 Child Support Agencies—IRC 6103(l)(6), (l)(8), and (l)(10)

5.6 Human Services Agencies—IRC 6103(l)(7)

5.7 Deficit Reduction Agencies—IRC 6103(l)(10)

5.8 Centers for Medicare and Medicaid Services—IRC 6103(l)(12)(C)

5.9 Disclosures under IRC 6103(l)(20)

5.10 Disclosures under IRC 6103(l)(21)

5.11 Disclosures under IRC 6103(i)

5.12 Disclosures under IRC 6103(m)(2)

6.0 Other Safeguards—IRC 6103(p)(4)(D)

6.1 General

6.2 Training Requirements

Table 4 – Training Requirements

6.3 Disclosure Awareness Training

6.3.1 Disclosure Awareness Training Products

6.4 Internal Inspections

6.4.1 Recordkeeping

6.4.2 Secure Storage

6.4.3 Limited Access

6.4.4 Disposal

6.4.5 Computer Systems Security

6.5 Plan of Action and Milestones

7.0 Reporting Requirements—6103(p)(4)(E)

7.1 General

7.1.1 Report Submission Instructions

7.1.2 Encryption Requirements

7.2 Safeguard Security Reports

7.2.1 Initial SSR Submission Instructions – New Agency Responsibilities

Table 5 - Evidentiary Requirements for SSR approval before release of FTI

7.2.2 Agencies Requesting New FTI Data Streams

7.2.3 Annual SSR Update Submission Instructions

7.2.4 SSR Update Submission Dates

Table 6 – SSR Due Dates

7.3 Corrective Action Plan

7.3.1 CAP Submission Instructions and Submission Dates

Table 7 – CAP Due Dates

7.4 45-Day Notification Reporting Requirements

Table 8 – 45-Day Notification Reporting Requirements

7.4.1 Cloud Computing

7.4.2 Consolidated Data Center

7.4.3 Contractor or Subcontractor Access

7.4.4 Data Warehouse Processing

7.4.5 Non-Agency-Owned Information Systems

7.4.6 Tax Modeling

7.4.7 Live Data Testing

7.4.8 Virtualization of Information Technology Systems

8.0 Disposing of FTI—IRC 6103(p)(4)(F)

8.1 General

8.2 Returning IRS Information to the Source

8.3 Destruction and Disposal

Table 9 – FTI Destruction Methods

8.4 Other Precautions

9.0 Computer System Security

9.1 General

9.2 Assessment Process

9.3 NIST SP 800-53 Control Requirements

9.3.1 Access Control

9.3.2 Awareness and Training

9.3.3 Audit and Accountability

Table 10 – Proactive Auditing Methods to Detect Unauthorized Access to FTI

9.3.4 Security Assessment and Authorization

9.3.5 Configuration Management

9.3.6 Contingency Planning

9.3.7 Identification and Authentication

9.3.8 Incident Response

9.3.9 Maintenance

9.3.10 Media Protection

9.3.11 Physical and Environmental Protection

9.3.12 Planning

9.3.13 Personnel Security

9.3.14 Risk Assessment

9.3.15 System and Services Acquisition

9.3.16 System and Communications Protection

9.3.17 System and Information Integrity

9.3.18 Program Management

9.4 Additional Computer Security Requirements

9.4.1 Cloud Computing Environments

9.4.2 Data Warehouse

9.4.3 Email Communications

9.4.4 Fax Equipment

9.4.5 Integrated Voice Response Systems

9.4.6 Live Data Testing

9.4.7 Media Sanitization

9.4.8 Mobile Devices

9.4.9 Multi-Functional Devices and High Volume Printers

9.4.10 Network Protections

9.4.11 Storage Area Networks

9.4.12 System Component Inventory

9.4.13 Virtual Desktop Infrastructure

9.4.14 Virtualization Environments

9.4.15 VoIP Systems

9.4.16 Web-Based Systems

9.4.17 Web Browser

9.4.18 Wireless Networks

10.0 Reporting Improper Inspections or Disclosures

10.1 General

Table 11 – TIGTA Field Division Contact Information

10.2 Office of Safeguards Notification Process

10.3 Incident Response Procedures

10.4 Incident Response Notification to Impacted Individuals

10.5 FTI Suspension, Termination, and Administrative Review

11.0 Disclosure to Other Persons

11.1 General

11.2 Authorized Disclosure Precautions

11.3 Disclosing FTI to Contractors

11.4 Re-Disclosure Agreements

12.0 Return Information in Statistical Reports

12.1 General

12.2 Making a Request under IRC 6103(j)

12.3 State Tax Agency Statistical Analysis

12.4 Making a Request under IRC 6108

Exhibit 1 USC Title 26, IRC 6103(a) and (b)

Exhibit 2 USC Title 26, IRC 6103(p)(4)

Exhibit 3 USC Title 26, CFR 301.6103(p)(7)-1

Exhibit 4 Sanctions for Unauthorized Disclosure

Exhibit 5 Civil Damages for Unauthorized Disclosure

Exhibit 6 Contractor 45-Day Notification Procedures

Exhibit 7 Safeguarding Contract Language

Exhibit 8 Warning Banner Examples

Exhibit 9 Record Retention Schedules

Table 12 – Record Retention Schedules

Exhibit 10 Data Warehouse Security Requirements

Exhibit 11 Media Sanitization Techniques

Table 13 – Media Sanitization Techniques

Glossary and Key Terms

Introduction Section 1.0

Publication 1075 (September 2016)

1.0 Introduction

1.1 General

To foster a tax system based on voluntary compliance, the public must maintain a high degree of confidence that the personal and financial information furnished to the Internal Revenue Service (IRS) is protected against unauthorized use, inspection, or disclosure.

The IRS must administer the disclosure provisions of the Internal Revenue Code (IRC) according to the spirit and intent of these laws, ever mindful of the public trust. The IRC defines and protects the confidential relationship between the taxpayer and the IRS and makes it a crime to violate this confidence. IRC 7213 prescribes criminal penalties, making it a felony offense for federal and state employees and others who illegally disclose federal tax returns and return information. Additionally, IRC 7213A makes the unauthorized inspection of Federal Tax Information (FTI) a misdemeanor, punishable by fines, imprisonment, or both. And finally, IRC 7431 prescribes civil damages for unauthorized inspection or disclosure, and upon criminal indictment or information under IRC 7213 or 7213(A), notification to the taxpayer that an unauthorized inspection or disclosure has occurred.

The concerns of citizens and Congress regarding individual rights to privacy require the IRS to continuously assess disclosure practices and the safeguards used to protect the confidential information entrusted. While the sanctions of the IRC are designed to protect the privacy of taxpayers, the IRS recognizes the importance of cooperating to the fullest extent permitted by law with other federal, state, and local authorities in their administration and enforcement of laws.

Those agencies or agents that legally receive FTI directly from either the IRS or from secondary sources (e.g., Social Security Administration [SSA]), pursuant to IRC 6103 or by an IRS-approved exchange agreement must have adequate programs in place to protect the data received. Furthermore, as agencies procure contractor services, it becomes equally important that contractors protect that information from unauthorized use, access, and disclosure.

Safeguards reports and related communications in possession of federal, state and local agencies are considered the property of the IRS and may not be disclosed to anyone outside the agency and are subject to disclosure restrictions under federal law and IRS rules and regulations. This includes, but is not limited to, Preliminary Findings Report (PFR); Safeguard Review Report (SRR); Safeguard Security Report (SSR) and Corrective Action Plan (CAP).

Release of any IRS Safeguards document requires the express permission of the Internal Revenue Service. Requests received through Sunshine and/or Information Sharing/Open Records provisions must be referred to the federal Freedom of Information Act (FOIA) statute for processing. State and local agencies receiving such requests should refer the requestor to the instructions to file a FOIA request with the IRS. Federal agencies should follow established procedures which require consultation before citing FOIA exemptions on IRS agency records, or directly refer the FOIA request to IRS for processing.

The intent of this requirement is to address any public request for sensitive information and prevent disclosure of data that would put FTI at risk. The agency may still distribute these reports internally and within other state agencies, auditors or oversight panels as required to either take corrective actions or report status without further IRS approval.

Additional guidance may be found at, https://www.irs.gov/uac/IRS-Freedom-of-Information, and questions should be referred to the Safeguards mailbox at Safeguardreports@irs.gov.

1.2 Overview of Publication 1075

This publication provides guidance to ensure the policies, practices, controls, and safeguards employed by recipient agencies, agents, or contractors adequately protect the confidentiality of FTI.

Enterprise security policies address the purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance to implement all applicable security controls. This document contains the managerial, operational, and technical security controls that must be implemented as a condition of receipt of FTI.

The guidelines outlined herein apply to all FTI, no matter the amount or the media in which it is recorded. FTI must be afforded the same levels of protection regardless of it residing on paper or electronic form. Systematic, procedural, or manual security policies must minimize circumvention.

A mutual interest exists in our responsibility to ensure that FTI is disclosed only to persons authorized and used only as authorized by statute or regulation. The IRS is confident of your diligence in this area and believes that this publication will be a helpful resource.

Conforming to these guidelines meets the safeguard requirements of IRC 6103(p)(4) and makes our joint efforts beneficial.

Requirements throughout this document apply to all organizational segments of an agency receiving FTI. It is the agency’s responsibility to ensure all functions within the agency, including consolidated data centers and contractors (where allowed by federal statute) with access to FTI, understand and implement the requirements in this publication.

This publication provides the preliminary steps to consider before submitting a request to receive FTI, requirements for proper protection, expectations from the IRS, and considerations that may be helpful in establishing a program to protect FTI. The exhibits in this publication are provided for additional guidance.

mailto:Safeguardreports@irs.gov https://www.irs.gov/uac/IRS-Freedom-of-Information

The Office of Safeguards is responsible for all interpretations of safeguarding requirements. Publication 1075 requirements may be supplemented or modified between editions of Publication 1075 via guidance issued by the Office of Safeguards and posted on the Office of Safeguards website.

1.3 Access Safeguards Resources

The Office of Safeguards maintains Publication 1075, templates, guidance, and frequently asked questions online at http://www.irs.gov/uac/Safeguards-Program.

Agencies are highly encouraged to regularly visit the website for updates.

1.3.1 Website Resources

The website contains many resources to assist agencies with meeting Publication1075 requirements. Examples of the website’s features include:

Safeguard alerts and technical assistance memorandums

Recommendations on how to comply with Publication 1075 requirements

Reporting requirement templates (e.g., Safeguard Security Report [SSR]) and guidance

Instructions for reporting unauthorized accesses, disclosures, or data breaches

Internal inspections report templates and instructions

IRS disclosure awareness videos and resources

Disclosure and physical security requirements documented in the Safeguard Disclosure Security Evaluation Matrix (SDSEM) template

Computer security requirements documented in Safeguard Computer Security Evaluation Matrix (SCSEM) templates organized by technology or topic

1.3.2 Mailbox

The Safeguards Mailbox is a repository for information and communication to the Office of Safeguards relative to Safeguarding requirements and Publication 1075. The Mailbox is located at SafeguardReports@irs.gov. Below are items that are appropriate for submission to the Mailbox:

Safeguards Reports and Extension Requests

45 Day Notifications

Publication 1075 Technical Inquiries

Re-Disclosure Agreements http://www.irs.gov/uac/Safeguards-Program

1.4 Key Definitions

This section establishes a baseline of key terms used throughout this publication. For additional definitions of terms and phrases, refer to Glossary and Key Terms.

1.4.1 Federal Tax Information (FTI)

Safeguarding FTI is critically important to continuously protect taxpayer confidentiality as required by IRC 6103. FTI is a term of art and consists of federal tax returns and return information (and information derived from it) that is in the agency’s possession or control which is covered by the confidentiality protections of the IRC and subject to the IRC 6103(p)(4) safeguarding requirements including IRS oversight. FTI is categorized as Sensitive But Unclassified information and may contain personally identifiable information (PII).

FTI includes return or return information received directly from the IRS or obtained through an authorized secondary source, such as Social Security Administration (SSA), Federal Office of Child Support Enforcement (OCSE), Bureau of the Fiscal Service (BFS),or Centers for Medicare and Medicaid Services (CMS), or another entity acting on behalf of the IRS pursuant to an IRC 6103(p)(2)(B) Agreement.

FTI includes any information created by the recipient that is derived from federal return or return information received from the IRS or obtained through a secondary source.

FTI may not be masked to change the character of information to circumvent IRC 6103 confidentiality requirements.

1.4.2 Return and Return Information

IRC 6103(b)(1) defines a return as any tax or information return, estimated tax declaration, or refund claim (including amendments, supplements, supporting schedules, attachments, or lists) required by or permitted under the IRC and filed with the IRS by, on behalf of, or with respect to any person or entity. Examples of returns include forms filed on paper or electronically, such as Forms 1040, 941, 1120, and other informational forms, such as 1099 or W -2*. Forms include supporting schedules, attachments, or lists that are supplemental to or part of such a return.

Refer to IRS.gov for a complete catalog of IRS forms.

Return information, in general, is any information collected or generated by the IRS with regard to any person’s liability or possible liability under the IRC. IRC 6103(b)(2)(A) defines return information very broadly. It includes but is not limited to:

Information that IRS obtained from any source or developed through any means that relates to the potential liability of any person under the IRC for any tax, penalty, interest, fine, forfeiture, or other imposition or offense

Information extracted from a return, including names of dependents or the location of business

The taxpayer’s name, address, and identification number

Information collected by the IRS about any person’s tax affairs, even if identifiers, such as name, address, and identification number are deleted

Status of whether a return was filed, under examination, or subject to other investigation or processing, including collection activities

Information contained on transcripts of accounts

1.4.3 Personally Identifiable Information

FTI may include Personally Identifiable Information (PII). FTI may include the following PII elements:

Name of a person with respect to whom a return is filed

Taxpayer mailing address

Taxpayer identification number

E-mail addresses

Telephone numbers

Social Security Numbers

Bank account numbers

Date and place of birth

Mother’s maiden name

Biometric data (e.g., height, weight, eye color, fingerprints)

Any combination of the above

1.4.4 Information Received From Taxpayers or Third Parties

Copies of tax returns or return information provided to the agency directly by the taxpayer or his/her representative (e.g. W-2’s, Form 1040, etc.) or obtained from public information files (e.g. federal tax lien on file with the county clerk, Offers in Compromise available for public inspection; court records, etc.) is not protected FTI that is subject to the safeguarding requirements of IRC 6103(p)(4). If the agency independently verifies FTI provided by the IRS or a secondary source with the taxpayer or a third party source, the verified information is not FTI as long as the IRS source information is replaced or overwritten with the newly provided information.

1.4.5 Unauthorized Access

Unauthorized access occurs when an entity or individual knowingly or due to gross negligence receives or has access to FTI without authority, as defined in IRC 6103.

Access to FTI is permitted only to individuals who require the FTI to perform their official duties and as authorized under the IRC. FTI must never be indiscriminately disseminated, even within the recipient agency, body, or commission. Agencies must evaluate the need for FTI before the data is requested or disseminated.

1.4.6 Unauthorized Disclosure

An unauthorized disclosure occurs when an entity or individual with authorization to receive FTI knowingly or with gross negligence discloses FTI to another entity or individual who does not have authority, as defined in IRC 6103 and IRC 6104(c).

An unauthorized disclosure has occurred when FTI is knowingly or due to gross negligence provided to an individual who does not have the statutory right to have access to it under the IRC. Even without willfulness or gross negligence FTI is not to be disclosed to entities or individuals who are not authorized by IRC 6103 to have it.

Subject to the disclosure provisions of IRC 6103, agencies may need to disclose FTI to outside entities (e.g., for prosecution, appeals, or collection processes) as long as the receiving entity has a need-to-know and the individual recipient has authority under IRC 6103 to receive it. If the individual does not have a need-to-know, this constitutes an unauthorized disclosure.

1.4.7 Need to Know

Under need-to-know restrictions, even if an entity or an individual has the authority to access FTI, one would not be given access to such information if it were not necessary to perform his or her official duties with regard to the purpose for which IRC 6103 provides the FTI is to be used.

Limiting access to individuals on a need-to-know basis reduces opportunities to “browse” or improperly view FTI. Restricting access to designated personnel minimizes improper access or disclosure. When FTI must be provided to clerical, computer operators, or others, these should only be provided the FTI that is essential to accomplish their official duties.

Federal Tax Information and Reviews Section 2.0

2.0 Federal Tax Information and Reviews

2.1 General

IRC 6103 is a confidentiality statute and generally prohibits the disclosure of FTI (see Exhibit 1, USC Title 26, IRC 6103, for general rules and definitions). Exceptions to the general rule authorize disclosure of FTI to certain federal, state, and local agencies.

Generally, these disclosures are made by the IRS in response to written requests signed by the head of the requesting agency or an authorized delegate. FTI so disclosed may be used by the receiving agency solely for the purpose described in the exception authorizing the disclosure. The statutes providing authorization to disclose FTI contain specific conditions that may require different procedures in maintaining and using the information. These conditions are outlined under specific sections in this publication.

As a condition of receiving FTI, the receiving agency must show, to the satisfaction of the IRS, the ability to protect the confidentiality of that information. Certain safeguards must be implemented to prevent unauthorized access and use. Besides written requests, the IRS may require formal agreements that specify, among other things, how the information will be protected. An agency must ensure its safeguards will be ready for immediate implementation upon receipt of FTI. Copies of the initial and subsequent requests for data and any formal agreement must be retained by the agency a minimum of five years as a part of its recordkeeping system.

Agencies must always maintain the latest SSR on file. The initial request for FTI must be followed by submitting an SSR to the IRS at least 45 days before the scheduled or requested receipt of FTI (see Section 7.0, Reporting Requirements—6103(p)(4)(E)).

The SSR must include processing and safeguard procedures for all FTI received and distinguish between agency programs and functional organizations using FTI. Multiple organizations, divisions or programs within a federal agency using FTI should be consolidated into a single report for that agency at the direction of the Office of Safeguards.

Agencies entering into an agreement to disclose FTI to agents or contractors requires advance notice to the Office of Safeguards (see Section 7.4, 45 Day Notification Reporting Requirements and Section 11.3, Disclosing FTI to Contractors.)

Agencies must exercise care in outlining their safeguard program. Reports that lack clarity or sufficient information will be returned to the submitting agency for additional documentation.

2.2 Authorized Use of FTI

Any agency that receives FTI for an authorized use may not use that information in any manner or for any purpose not consistent with that authorized use. If an agency needs FTI for a different authorized use under a different provision of IRC 6103, a separate request must be sent to the Office of Disclosure.

An unauthorized secondary use of FTI is specifically prohibited and may result in discontinuation of disclosures to the agency and imposition of civil or criminal penalties on the responsible officials.

The Office of Safeguards conducts “need and use” verification reviews as part of the safeguard review and always considers whether the agency’s use is in conformance with the governing provisions allowing the disclosure of FTI. The agency must describe the purpose(s) for which FTI is collected, used, maintained, and shared.

2.3 Secure Data Transfer

The IRS established a Secure Data Transfer (SDT) program to provide encrypted electronic transmission of FTI between the IRS and trading partners. For support with establishing an IRS SDT account, please submit an SDT Customer Support Request.

Complete information on establishing an SDT account is available in the SDT Handbook. The SDT Handbook is available from a local IRS governmental liaison or a request to the Safeguards mailbox.

In addition to installing the SDT software, each agency must also have an IdenTrust Certificate installed. After the initial installation, agencies are required to renew the IdenTrust Certificate every two years. Refer to the ACES (Access Certificates for Electronic Services) IdenTrust website for additional information.

Only the following types of documents will be accepted via SDT:

Control File (.txt)

Adobe (.pdf)

Word Document (.doc or .docx)

Excel Document (.xls or.xlsx)

Zipped File (.zip)

Contact the SafeguardReports@irs.gov mailbox for specific details on how to submit information via SDT.

2.4 State Tax Agency Limitations

FTI may be obtained per IRC 6103(d) by state tax agencies only to the extent the information is needed for, and is reasonably expected to be used for, state tax administration. An agency’s records must include some account of the result of its use of FTI (e.g., disposition of closed cases and summary of revenues generated) or include reasons why the information was not used. If any agency continually receives FTI that it is unable to use for any reason, it must contact the IRS official liaison and discuss the need to stop the receipt of this FTI.

State tax agencies using FTI to conduct statistical analysis, tax modeling, or revenue projections must notify the IRS by submitting a signed Need and Use Justification for Use of Federal Tax Information form and following the established guidelines.

Annually, the agency must provide updated information in the SSR regarding its modeling activities that include FTI. In the SSR, the agency must describe:

Any use of FTI that is in addition to what was described in the original Need and

Use Justification Form

Any new, previously unreported internal tax administration compilations that include FTI

Changes to the listing of authorized employees (Attachment B to the Need and Use Justification Form)

If the agency intends to use a contractor for conducting statistical analysis, tax modeling, or revenue projections, it must submit a 45-day notification (see Section 11.3, Disclosing FTI to Contractors) prior to contractor access to the FTI. The agency’s SSR must detail the use of FTI for this purpose. In addition, the agency must submit a separate statement detailing the methodology used and data to be used by the contractor. The Office of Safeguards and Statistics of Income functions will review the information provided to confirm that appropriate safeguarding protocols are in place and that the modeling methodology to be used to remove taxpayer identifying information is appropriate.

The agency must:

a) Identify the minimum FTI elements (e.g., name, address, date of birth) that are relevant and necessary to accomplish the legally authorized purpose of collection

b) Limit the collection and retention of FTI to the minimum elements identified for the purposes described in the notice and for which the individual has provided consent

c) Conduct an initial evaluation of FTI holdings, as well as:

i. Establish and follow a schedule for regularly reviewing those holdings to ensure that only FTI identified in the notice is collected and retained; and

ii. Certify that the FTI continues to be necessary to accomplish the legally authorized purpose.

2.5 Coordinating Safeguards within an Agency

Because of the diverse purposes that authorized disclosures may be made to an agency and the division of responsibilities among different components of an agency, FTI may be received and used by several quasi-independent units within the agency’s organizational structure. Where there is such a dispersal of FTI, the agency must centralize safeguarding responsibilities to the greatest extent practical and establish and maintain uniform safeguard standards consistent with IRS guidelines. The official(s) assigned these responsibilities must hold a position high enough in the agency’s organizational structure to ensure compliance with the agency safeguard standards and procedures.

The selected official(s), or point(s) of contact (POC(s)) must also be responsible for ensuring that internal inspections are conducted, for submitting required safeguard reports to the IRS, for properly reporting any data breach incidents, and for any necessary liaison with the IRS.

2.6 Safeguard Reviews

A safeguard review is an on-site evaluation of the use of FTI and the measures employed by the receiving agency and its agents (where authorized) to protect the data.

This includes all FTI received whether from the IRS or a secondary source such as SSA, BFS or another agency (see Section1.4.1, Federal Tax Information).

Safeguard reviews are conducted to determine the adequacy of safeguards as opposed to evaluating an agency’s programs. Several factors will be considered when determining the need for and the frequency of reviews. Reviews are conducted by the IRS Office of Safeguards within the Office of Privacy, Governmental Liaison and Disclosure.

2.7 Conducting the Review

The IRS initiates the review by communication with an agency point of contact (POC).

The preliminary discussion will be followed by a formal engagement letter to the agency head, which provides official notification of the planned safeguard review.

This engagement letter outlines what the review will encompass. Additional requests for specific information will be provided to the agency POC. These requests may include a list of records to be reviewed (e.g., training manuals, flowcharts, awareness program documentation, and organizational charts relating to the processing of FTI), the scope and purpose of the review, a list of the specific areas to be reviewed, and agency personnel to be interviewed.

Reviews cover the requirements of IRC 6103(p)(4) which can be found in:

Section 3.0, Recordkeeping Requirement

Section 4.0, Secure Storage—IRC 6103(p)(4)(B)

Section 5.0, Restricting Access—IRC 6103(p)(4)(C)

Section 6.0, Other Safeguards—IRC 6103(p)(4)(D)

Section 7.0, Reporting Requirements—6103(p)(4)(E)

Section 8.0, Disposing of FTI—IRC 6103(p)(4)(F)

Section 9.0, Computer System Security

2.7.1 On-Site Review Process

The on-site review officially begins at the opening conference where procedures and parameters will be communicated. Observing actual operations is a required step in the review process. Sites to be reviewed will be based on the flow of the FTI through the agency, which may include field offices, consolidated data centers, off-site storage facilities, disaster recovery sites, and contractor sites both within and outside the state.

Agency files may be spot-checked to determine if they contain FTI. The actual review is followed by a closing conference and issuance of a Preliminary Findings Report (PFR) where the agency is informed of findings identified during the review. A Safeguard Review Report (SRR) and Corrective Action Plan (CAP) will be issued within 45 days of the closing conference to document the on-site review findings. Requests for corrections to the SRR must be emailed to the SafeguardReports@irs.gov mailbox. The Office of Safeguards will respond with acknowledgement and determination.

Table 1 – Safeguard Review Cycle

Action Notice Time Frame Note

Preliminary Discussion

Primary Point of Contact from last review

*120 days ahead of review

*Timeframe is approximate for the preliminary discussion and engagement letter. This may occur closer to the actual review date.

Engagement Letter

Submitted to agency head

*120 to 30 days in advance of review

Opening Conference

At HQ with agency head, department heads, and IT staff

Day 1 of review 9:00 a.m.

Opening conference will summarize the review.

On-Site Review

Visit to various departments where FTI is located

2 to 3 days Additional days may be needed as required.

Action Notice Time Frame Note

Closing Conference with Preliminary Findings Report

At HQ with agency head and department heads

Last day of review; will leave PFR for agency

Agency can start working on the findings but must wait until the CAP cycle to report corrective actions.

This may be a soft (preliminary) closing if there are additional sites or devices to review.

Final Report Submitted to agency head

Prepared within 45 days after closing conference

Agency responds with CAP.

CAP

Submissions

Report on any corrective action still open from the final report

Submitted semi-annually

Responses must include a status of finding and an actual numerical date of when the planned or actual correction action is taken to address the finding. Subsequent CAP responses are required for all open findings. Evidentiary documentation is required for critical and significant findings.

SSR

Submission

Initially report procedures established to protect FTI received from the IRS; reports yearly actions taken to protect FTI and any updates in procedures

Submitted annually

Yearly update to the document will be accompanied by a certification of accuracy by agency head.

2.7.2 Computer Security Review Process

The Office of Safeguards will assess agency compliance with the computer security requirements identified in this publication as part of the on-site review process.

Requirements are assessed as they relate to NIST SP 800-53 security controls as outlined in this publication. To ensure a standardized computer security review process, the following techniques will be used to evaluate agency policies, procedures, and IT equipment that receive, process, store, or transmit FTI:

Table 2 – IT Testing Techniques

Automated Compliance and Vulnerability Assessment Testing

Computer Security Reviewers will use a combination of compliance and vulnerability assessment software tools to validate the adequate protection of FTI on agency and contractor owned equipment. These automated tools will be launched from either IRS-issued flash drives or laptop computers. Profiles used with these tools can be downloaded from the Office of Safeguards’ website.

SCSEM Documents and tests hardening requirements for specific technologies used to receive, process, store, or transmit FTI. SCSEMs can and should be downloaded from the Office of Safeguards’ website.

MOT Documents will be requested in advance and expected to be provided prior to the review process, no later than the opening conference.

Agencies should be prepared for the Computer Security Reviewers to use the preceding resources as part of the on-site review. As necessary, agency management approval must be obtained prior to the on-site review, if agency policies and procedure contradict any of these methods.

2.8 Corrective Action Plan

The CAP must be updated and submitted semi-annually on the latest version to the Office of Safeguards (see Section 7.3, Corrective Action Plan) until all review findings are accepted and closed by the Office of Safeguards.

The CAP must include a brief explanation of actions already taken or planned to resolve the finding. For all outstanding findings, the agency must detail planned actions and associated milestones for resolution.

All findings must be addressed in a timely fashion. The Office of Safeguards will identify deadlines for resolution based upon the risk associated with each finding.

Outstanding issues must be resolved and addressed in the next reporting cycle of the

CAP.

2.9 Voluntary Termination of Receipt of FTI

2.9.1 Termination Documentation

When an agency no longer requires FTI, notify Safeguards at SafeguardReports@irs.gov by providing the following:

1. Copies of notifications to all agencies from which FTI is received, that FTI will no longer be requested, and

2. Letter from the Head of Agency certifying that all residual FTI has been destroyed.

(See Section 8.0 Disposal of FTI – IRC 6103(p)(4)(F))

Once documentation is reviewed, the Office of Safeguards will send an acknowledgement of the agency’s termination, instructions on Safeguard reporting and on-site review obligations. Instructions for reinstatement will be included in the acknowledgement letter.

2.9.2 Archiving FTI Procedure (for agencies terminating receipt of FTI but required by statute to retain FTI for designated periods)

If residual FTI is required to be retained by statute for a designated period (e.g., 5 or 10 years), then agencies must:

Insure that a currently authorized agency and/or contractor retain FTI in accordance with Publication 1075 security standards

Provide copies of notifications as shown in 2.9.1 (1. copies of notifications requesting termination of FTI) above

Submit an annual SSR each year during the retention period

Continue to be subject to periodic Safeguard Reviews

Letter from Head of Agency certifying that all residual FTI has been destroyed when the retention period has ended

Recordkeeping Requirement – IRC 6103 (p)(4)(A) Section 3.0

3.0 Recordkeeping Requirement – IRC 6103 (p)(4)(A)

3.1 General

Federal, state, and local agencies, bodies, commissions, and agents authorized under IRC 6103 to receive FTI are required by IRC 6103(p)(4)(A) to establish a permanent system of standardized records of requests made by or to them for disclosure of FTI.

For additional guidance, see Exhibit 2, USC Title 26, IRC 6103(p)(4).

This recordkeeping must include internal requests among agency employees as well as requests outside of the agency. These records are required to track the movement of FTI. The records are to be maintained for five years or the agency’s applicable records control schedule must be followed, whichever is longer. The Safeguards website contains guidance, job aids, helpful tools, and frequently asked questions to assist agencies in meeting safeguard requirements; see http://www.irs.gov/uac/Safeguards- Program.

The agency must establish, maintain, and update at least annually, an inventory that contains a listing of all programs and information systems identified as collecting, using, maintaining, or sharing FTI. Provide each update of the FTI inventory to the Chief Information Officer or information security official at least annually to support the establishment of information security requirements for all new or modified information systems containing FTI.

Records must be maintained in accordance with IRS audit log retention requirements for electronic and non-electronic files. For additional guidance, see Exhibit 9, Record Retention Schedules.

3.2 Electronic and Non-Electronic FTI Logs

The agency must establish a tracking system to identify and track the location of electronic and non-electronic FTI from receipt until it is destroyed. The FTI log may include tracking elements, such as:

Taxpayer Name or other identifier*

Tax year(s)

Type of information (e.g., revenue agent reports, Form 1040, work papers)

The reason for the request

Date requested

Date received

Exact location of the FTI

Who has had access to the data

If disposed of, the date and method of disposition

*To the extent possible, do not include FTI in the log. If FTI is used, the log must be secured in accordance with all other safeguards requirements.

http://www.irs.gov/uac/Safeguards-Program

Recordkeeping Requirement – IRC 6103 (p)(4)(A) Section 3.0

If the authority to make further disclosures is present (e.g., agents/contractors), information disclosed outside the agency must be recorded on a separate list or log.

The log must reflect to whom the disclosure was made, what was disclosed, and why and when it was disclosed. Agencies transmitting FTI from one mainframe computer to another, as in the case of the SSA sending FTI to state human services agencies, need only identify the bulk records transmitted. This identification will contain the approximate number of taxpayer records, the date of the transmissions, the best possible description of the records, and the name of the individual making/receiving the transmission.

Figure 1 – Sample FTI Log

Non-Electronic Recordkeeping Log

Date Requested

Date Received

Taxpayer Name

Tax Year(s)

Type of Information

Reason for Request

Exact Location

Who has access?

Disposition Date

Disposition Method

3.3 Converted Media

Conversion of FTI from paper to electronic media (scanning) or from electronic media to paper (print screens or printed reports) also requires tracking from creation to destruction of the converted FTI. All converted FTI must be tracked on logs containing the fields detailed in Section 3.2, depending upon the current form of the FTI, electronic or non-electronic.

3.4 Recordkeeping of Disclosures to State Auditors

When disclosures are made by a state tax agency to state auditors, recordkeeping requirements pertain only in instances where the auditors use FTI for further scrutiny and inclusion in their work papers. In instances where auditors read large volumes of records containing FTI, whether in paper or electronic format, the state tax agency need only identify bulk records examined. This identification will contain the approximate number of taxpayer records, the date of inspection, a description of the records, and the name of the individual(s) making the inspection. Recordkeeping log samples are provided in Section 3.2.

Disclosure of FTI to state auditors by child support enforcement and human services agencies is not authorized by statute. FTI in case files must be removed prior to access by the auditors

Secure Storage – IRC 6103 (p)(4)(B) Section 4 .0

4.0 Secure Storage—IRC 6103(p)(4)(B)

4.1 General

Security may be provided for a document, an item, or an area in a number of ways.

These include but are not limited to locked containers of various types, vaults, locked rooms, locked rooms that have reinforced perimeters, locked buildings, guards, electronic security systems, fences, identification systems, and control measures.

How the required security is provided depends on the facility, the function of the activity, how the activity is organized, and what equipment is available. Proper planning and organization will enhance the security while balancing the costs.

The IRS has categorized federal tax and privacy information as moderate risk. The minimum protection standards (MPS) must be used as an aid in determining the method of safeguarding FTI. These controls are intended to protect FTI in paper and electronic form.

4.2 Minimum Protection Standards

Minimum protection standards (MPS) establish a uniform method of physically protecting data and systems as well as non-electronic forms of FTI. This method contains minimum standards that will be applied on a case-by-case basis. Because local factors may require additional security measures, management must analyze local circumstances to determine location, container, and other physical security needs at individual facilities. MPS have been designed to provide management with a basic framework of minimum security requirements.

The objective of these standards is to prevent unauthorized access to FTI. MPS thus requires two barriers. Example barriers under the concept of MPS are outlined in the following table. Each topic represents one barrier and should be used as a starting point to identify two barriers of MPS to protect FTI.

Secure Storage – IRC…