Safeguards for Protecting Federal Tax Returns

Agency decision

Ask Donna

What actually matters in this document.

Text

Publication 1075

Tax Information

Security Guidelines

For Federal, State

and Local Agencies

Safeguards for Protecting Federal Tax Returns

and Return Information

IRS Mission Statement

Provide America’s taxpayers top-quality service by helping them understand and meet

their tax responsibilities and enforce the law with integrity and fairness to all.

Office of Safeguards Mission Statement

The Mission of Safeguards is to promote taxpayer confidence in the integrity of the tax

system by ensuring the confidentiality of IRS information provided to federal, state, and

local agencies. Safeguards verifies compliance with Internal Revenue Code (IRC) §

6103(p)(4) safeguard requirements through the identification and mitigation of any risk of

loss, breach or misuse of Federal Tax Information (FTI) held by external government

agencies.

Office of Safeguards Vision Statement

To serve as a trusted advisor to our Partners, ensuring they have full understanding and

insight into FTI requirements and their risk profile, obtain consistent and timely guidance

from a “single voice” and receive service and support that is aligned to their risk profile.

We will drive the customer experience and FTI compliance via a collaborative and

empowered culture and a cross-trained workforce that is built around a risk-based

operating model that integrates infrastructure and processes to enable efficient and

effective operations.

Contents

IRS Mission Statement_________________________________________________ 2

Office of Safeguards Mission Statement __________________________________ 2

Office of Safeguards Vision Statement ___________________________________ 2

Highlights for November 2021 Revision__________________________________ 12

Security and Privacy Control Table _____________________________________ 17

INTRODUCTION _____________________________________________________ 23

General__________________________________________________________________ 23

Overview of Publication 1075_________________________________________________ 24

SAFEGUARD RESOURCES____________________________________________ 24

Safeguards Website ________________________________________________________ 24

Safeguards Mailbox ________________________________________________________ 25

KEY DEFINITIONS ___________________________________________________ 25

Federal Tax Information _____________________________________________________ 25

Return and Return Information________________________________________________ 26

Personally Identifiable Information (PII) _________________________________________26

Information Received from Taxpayers or Third Parties _____________________________27

Access __________________________________________________________________ 27

Cloud Computing __________________________________________________________ 27

Inadvertent Access_________________________________________________________ 27

Inadvertent Disclosure ______________________________________________________ 27

Incidental Access __________________________________________________________ 27

Unauthorized Access _______________________________________________________ 27

Unauthorized Disclosure ____________________________________________________ 28

Need-to-Know ____________________________________________________________ 28

Adverse Action ____________________________________________________________ 28

Disciplinary Action _________________________________________________________ 28

Personnel Sanction ________________________________________________________ 28

1.0 FEDERAL TAX INFORMATION, REVIEWS and OTHER REQUIREMENTS ____ 29

1.1 General _________________________________________________________ 29

1.2 Authorized Use of FTI _____________________________________________ 29

1.3 Secure Data Transfer ______________________________________________ 30

1.4 State Tax Agency Limitations _______________________________________ 30

1.5 Coordinating Safeguards within an Agency ___________________________ 31

1.6 Safeguard Reviews _______________________________________________ 31

1.6.1 Before the Review _____________________________________________________ 31

1.6.2 During the Review _____________________________________________________ 32

1.6.3 After the Review ______________________________________________________ 32

1.7 Termination of FTI ________________________________________________ 33

1.7.1 Agency Request ______________________________________________________ 33

1.7.1.1 Termination Documentation _______________________________________________ 33

1.7.1.2 Archiving FTI Procedure __________________________________________________ 34

1.7.2 FTI Suspension, Termination and Administrative Review_______________________34

1.8 Reporting Improper Inspections or Disclosures ________________________ 34

1.8.1 Terms ______________________________________________________________ 34

1.8.1.1 Data Incident ____________________________________________________________ 34

1.8.1.2 Data Breach _____________________________________________________________ 35

1.8.2 General _____________________________________________________________ 35

1.8.3 Office of Safeguards Notification Process___________________________________36

1.8.4 Incident Response Procedures ___________________________________________ 37

1.8.5 Incident Response Notification to Impacted Individuals ________________________37

1.9 Disclosure to Other Persons ________________________________________ 38

1.9.1 General _____________________________________________________________ 38

1.9.2 Authorized Disclosure Precautions ________________________________________38

1.9.3 External Personnel Security _____________________________________________ 38

1.9.4 Disclosing FTI to Contractors or Sub-Contractors_____________________________38

1.9.5 Re-Disclosure Agreements ______________________________________________ 40

1.10 Return Information in Statistical Reports ____________________________ 40

1.10.1 General ____________________________________________________________ 40

1.10.2 Making a Request under IRC § 6103(j)____________________________________41

1.10.3 State Tax Agency Statistical Analysis _____________________________________41

2.0 PHYSICAL SECURITY REQUIREMENTS ______________________________ 42

2.A Recordkeeping Requirement – IRC § 6103(p)(4)(A) _____________________ 42

2.A.1 General _____________________________________________________________ 42

2.A.2 Logs of FTI (Electronic and Non-Electronic Receipts) _________________________42

Figure 1 – Sample FTI Logs__________________________________________________ 43

2.A.3 Converted Media______________________________________________________ 43

2.A.4 Recordkeeping of Disclosures to State Auditors______________________________43

2.B Secure Storage – IRC § 6103(p)(4)(B) ________________________________ 43

2.B.1 General _____________________________________________________________ 43

2.B.2 Minimum Protection Standards___________________________________________ 44

Table 1 – Minimum Protection Standards _______________________________________44

2.B.3 Restricted Area Access_________________________________________________ 45

2.B.3.1 Visitor Access Logs ______________________________________________________ 45

Figure 2 – Visitor Access Log ____________________________________________________ 46

2.B.3.2 Authorized Access List ___________________________________________________ 46

2.B.3.3 Controlling Access to Areas Containing FTI __________________________________ 47

2.B.3.4 Control and Safeguarding Keys and Combinations ____________________________ 47

2.B.3.5 Locking Systems for Secured Areas ________________________________________ 48

2.B.4 FTI in Transit_________________________________________________________ 48

2.B.4.1 Security During Office Moves ______________________________________________ 48

2.B.5 Physical Security of Computers, Electronic and Removable Media _______________48

2.B.6 Media Off-Site Storage Requirements _____________________________________49

2.B.7 Alternate Work Site ____________________________________________________ 49

2.B.7.1 Equipment ______________________________________________________________ 49

2.B.7.2 Storing Data ____________________________________________________________ 50

2.B.7.3 Other Safeguards ________________________________________________________ 50

2.C Restricting Access – IRC § 6103(p)(4)(C) _____________________________ 50

2.C.1 General _____________________________________________________________ 50

2.C.2 Policies and Procedures ________________________________________________ 51

2.C.3 Background Investigation Minimum Requirements ___________________________53

2.C.3.1 Background Investigation Requirement Implementation _______________________ 54

2.C.4 Personnel Actions_____________________________________________________ 54

2.C.4.1 Personnel Transfer_______________________________________________________ 54

2.C.4.2 Personnel Sanctions _____________________________________________________ 55

2.C.4.3 Personnel Termination____________________________________________________ 55

2.C.5 Commingling of FTI ___________________________________________________ 55

2.C.5.1 Commingling of Electronic Media __________________________________________ 56

2.C.6 Access to FTI via State Tax Files or Through Other Agencies___________________56

2.C.7 Offshore Operations ___________________________________________________ 57

2.C.8 Controls Over Processing_______________________________________________ 57

2.C.8.1 Agency-owned and Operated Facility _______________________________________ 57

2.C.8.2 Agency, Contractor or Sub-Contractor Shared Facilities _______________________ 57

2.C.9 Service Level Agreements (SLA) _________________________________________58

2.C.10 Review Availability of Contractor and Sub-Contractor Facilities_________________59

2.C.11 Restricting Access – Other Disclosures ___________________________________59

2.C.11.1 Child Support Agencies—IRC §§ 6103(l)(6), (l)(8) and (l)(10)____________________ 59

2.C.11.2 Human Services Agencies—IRC § 6103(l)(7)_________________________________ 60

2.C.11.3 Deficit Reduction Agencies—IRC § 6103(l)(10) _______________________________ 60

2.C.11.4 Centers for Medicare and Medicaid Services—IRC § 6103(l)(12)(C) ______________ 60

2.C.11.5 Disclosures under IRC § 6103(l)(20) ________________________________________ 60

2.C.11.6 Disclosures under IRC § 6103(l)(21) ________________________________________ 60

2.C.11.7 Disclosures under IRC § 6103(i) ___________________________________________ 61

2.C.11.8 Disclosures under IRC § 6103(m)(2)________________________________________ 61

2.D Other Safeguards - IRC § 6103(p)(4)(D) _______________________________ 61

2.D.1 General _____________________________________________________________ 61

2.D.2 Training Requirements _________________________________________________ 61

Table 2 – Training Requirements _________________________________________________ 62

2.D.2.1 Disclosure Awareness Training ____________________________________________ 62

2.D.2.2 Disclosure Awareness Training Products ____________________________________ 64

2.D.3 Internal Inspections and On-Site Reviews __________________________________64

2.D.4 Recordkeeping____________________________________________________________ 65

2.D.5 Secure Storage ___________________________________________________________ 65

2.D.6 Limited Access ___________________________________________________________ 65

2.D.7 Disposal _________________________________________________________________ 66

2.D.8 Computer Systems Security ________________________________________________ 66

2.D.9 Plan of Action and Milestones (POA&M) ______________________________________ 66

2.E Reporting Requirements – IRC § 6103(p)(4)(E) _________________________ 66

2.E.1 General _____________________________________________________________ 66

2.E.2 Report Submission Instructions __________________________________________ 66

2.E.3 Encryption Requirements _______________________________________________ 67

2.E.4 Safeguards Security Reports (SSR) _______________________________________67

2.E.4.1 Initial SSR Submission Instructions – New Agency Responsibilities _____________ 68

Table 3 – SSR Evidentiary Documentation ______________________________________69

2.E.4.2 Agencies Requesting New FTI Data Streams _________________________________ 71

2.E.4.3 Annual SSR Update Submission Instructions_________________________________ 72

2.E.4.4 SSR Submission Dates ___________________________________________________ 72

Table 4 - SSR Submission Dates __________________________________________________ 73

2.E.5 Corrective Action Plan _________________________________________________ 73

2.E.5.1 CAP Submission Instructions ______________________________________________ 74

2.E.5.2 CAP Submission Dates ___________________________________________________ 75

Table 5 – CAP Submission Dates _________________________________________________ 75

2.E.6 Notification Reporting Requirements ______________________________________76

Table 6 – Notification Reporting __________________________________________________ 76

2.E.6.1 Cloud Computing ________________________________________________________ 76

2.E.6.2 Contractor or Sub-Contractor Access _______________________________________ 77

2.E.6.3 Tax Modeling ____________________________________________________________ 77

2.E.6.4 Live Data Testing ________________________________________________________ 77

2.F Disposing of FTI – IRC § 6103(p)(4)(F) ________________________________ 77

2.F.1 General _____________________________________________________________ 77

2.F.2 Returning IRS Information to the Source ___________________________________78

2.F.3 Destruction and Disposal _______________________________________________ 78

Table 7 - FTI Destruction Methods ________________________________________________ 78

2.F.3.1 Media Sanitization________________________________________________________ 79

2.F.4 Other Precautions _____________________________________________________ 79

3.1 General_______________________________________________________________ 81

3.2 Assessment Process ____________________________________________________ 81

Table 8 – Assessment Methodologies _____________________________________________ 82

3.3 Technology-Specific Requirements _________________________________________82

3.3.1 Cloud Computing __________________________________________________________ 82

3.3.2 Email Communications _____________________________________________________ 83

3.3.3 Facsimile and Facsimile Devices _____________________________________________ 84

3.3.4 Mobile Devices ____________________________________________________________ 85

3.3.5 Multifunction Devices (MFDs) and High-Volume Printers (HVPs) __________________ 85

3.3.6 Network Boundary and Infrastructure _________________________________________ 85

3.3.7 Virtual Desktop Infrastructure _______________________________________________ 86

3.3.8 Public-Facing Systems _____________________________________________________ 86

4.0 NIST 800-53 SECURITY AND PRIVACY CONTROLS _____________________ 88

4.1 ACCESS CONTROL ____________________________________________________ 88

AC-1 Access Control Policy and Procedures _______________________________________ 88

AC-2 Account Management ______________________________________________________ 88

AC-3 Access Enforcement _______________________________________________________ 90

AC-4 Information Flow Enforcement_______________________________________________ 91

AC-5 Separation of Duties _______________________________________________________ 91

AC-6 Least Privilege ____________________________________________________________ 91

AC-7: Unsuccessful Logon Attempts ______________________________________________ 92

AC-8: System Use Notification ___________________________________________________ 93

AC-11: Device Lock_____________________________________________________________ 93

AC-12: Session Termination _____________________________________________________ 94

AC-14: Permitted Actions Without Identification or Authentication _____________________ 94

AC-17: Remote Access__________________________________________________________ 94

AC-18: Wireless Access _________________________________________________________ 95

AC-19: Access Control for Mobile Devices _________________________________________ 96

AC-20: Use of External Systems __________________________________________________ 96

AC-21: Information Sharing ______________________________________________________ 97

AC-22: Publicly Accessible Content _______________________________________________ 97

AC-23: Data Mining Protection ___________________________________________________ 98

4.2 AWARENESS AND TRAINING ____________________________________________ 99

AT-1: Awareness and Training Policy and Procedures _______________________________ 99

AT-2: Awareness Training _______________________________________________________ 99

AT-3: Role-Based Training ______________________________________________________ 100

AT-4: Training Records ________________________________________________________ 101

AT-6: Training Feedback _______________________________________________________ 101

4.3 AUDIT AND ACCOUNTABILITY __________________________________________ 102

AU-1: Audit and Accountability Policy and Procedures ______________________________ 102

AU-2: Audit Events ____________________________________________________________ 102

AU-3: Content of Audit Records _________________________________________________ 103

AU-4: Audit Storage Capacity ___________________________________________________ 103

AU-5: Response to Audit Processing Failures _____________________________________ 103

AU-6: Audit Review, Analysis and Reporting_______________________________________ 104

AU-7: Audit Reduction and Report Generation _____________________________________ 104

AU-8: Time Stamps ____________________________________________________________ 105

AU-9: Protection of Audit _______________________________________________________ 105

AU-11: Audit Record Retention __________________________________________________ 105

AU-12: Audit Generation _______________________________________________________ 105

AU-16: Cross-Organizational Auditing Logging ____________________________________ 106

4.4 ASSESSMENT, AUTHORIZATION AND MONITORING________________________107

CA-1: Assessment, Authorization and Monitoring Policy and Procedures ______________ 107

CA-2: Control Assessments_____________________________________________________ 107

CA-3: Information Exchange ____________________________________________________ 108

CA-5: Plan of Action and Milestones _____________________________________________ 108

CA-6: Authorization ___________________________________________________________ 109

CA-7: Continuous Monitoring ___________________________________________________ 109

CA-8: Penetration Testing ______________________________________________________ 110

CA-9: Internal System Connections ______________________________________________ 110

4.5 CONFIGURATION MANAGEMENT _______________________________________112

CM-1: Configuration Management Policy and Procedures ___________________________ 112

CM-2: Baseline Configuration ___________________________________________________ 112

CM-3: Configuration Change Control _____________________________________________ 113

CM-4: Security and Privacy Impact Analyses ______________________________________ 114

CM-5: Access Restrictions for Change____________________________________________ 114

CM-6: Configuration Settings ___________________________________________________ 115

CM-7: Least Functionality ______________________________________________________ 115

CM-8: System Component Inventory _____________________________________________ 116

CM-9: Configuration Management Plan ___________________________________________ 117

CM-10: Software Usage Restrictions _____________________________________________ 117

CM-11: User-Installed Software __________________________________________________ 118

CM-12: Information Location ____________________________________________________ 118

CM-13: Data Action Mapping ____________________________________________________ 118

CM-14: Signed Components ____________________________________________________ 118

4.6 CONTINGENCY PLANNING _____________________________________________ 119

CP-1: Contingency Planning Policy and Procedures ________________________________ 119

CP-2: Contingency Plan ________________________________________________________ 119

CP-3: Contingency Training_____________________________________________________ 120

CP-4: Contingency Plan Testing _________________________________________________ 121

CP-9: System Backup __________________________________________________________ 121

CP-10: System Recovery and Reconstitution ______________________________________ 122

4.7 IDENTIFICATION AND AUTHENTICATION _________________________________123

IA-1: Identification and Authentication Policy and Procedures ________________________ 123

IA-2: Identification and Authentication (Organizational Users) ________________________ 123

IA-3: Device Identification and Authentication _____________________________________ 124

IA-4: Identifier Management _____________________________________________________ 125

IA-5: Authenticator Management_________________________________________________ 125

IA-6: Authenticator Feedback ___________________________________________________ 127

IA-7: Cryptographic Module Authentication________________________________________ 128

IA-8: Identification and Authentication (Non-Organizational Users) ____________________ 128

IA-9: Service Identification and Authentication _____________________________________ 128

IA-11: Re-Authentication _______________________________________________________ 129

IA-12: Identity Proofing_________________________________________________________ 129

4.8 INCIDENT RESPONSE _________________________________________________ 131

IR-1: Incident Response Policy and Procedures ____________________________________ 131

IR-2: Incident Response Training ________________________________________________ 131

IR-3: Incident Response Testing _________________________________________________ 132

IR-4: Incident Handling _________________________________________________________ 132

IR-5: Incident Monitoring _______________________________________________________ 133

IR-6: Incident Reporting ________________________________________________________ 133

IR-7: Incident Response Assistance ______________________________________________ 134

IR-8: Incident Response Plan____________________________________________________ 134

IR-9: Information Spillage Response _____________________________________________ 135

4.9 MAINTENANCE _______________________________________________________ 136

MA-1: System Maintenance Policy and Procedures _________________________________ 136

MA-2: Controlled Maintenance __________________________________________________ 136

MA-3: Maintenance Tools_______________________________________________________ 137

MA-4: Nonlocal Maintenance ____________________________________________________ 137

MA-5: Maintenance Personnel ___________________________________________________ 138

MA-6: Timely Maintenance ______________________________________________________ 139

4.10 MEDIA PROTECTION _________________________________________________ 140

MP-1: Media Protection Policy and Procedures ____________________________________ 140

MP-2: Media Access ___________________________________________________________ 140

MP-3: Media Marking __________________________________________________________ 140

MP-4: Media Storage___________________________________________________________ 140

MP-5: Media Transport _________________________________________________________ 141

MP-6: Media Sanitization _______________________________________________________ 141

MP-7: Media Use ______________________________________________________________ 142

4.11 PHYSICAL AND ENVIRONMENTAL PROTECTION _________________________143

PE-1: Physical and Environmental Policy and Procedures ___________________________ 143

PE-2: Physical Access Authorizations ____________________________________________ 143

PE-3: Physical Access Control __________________________________________________ 143

PE-4: Access Control for Transmission ___________________________________________ 144

PE-5: Access Control for Output Devices _________________________________________ 144

PE-6: Monitoring Physical Access _______________________________________________ 145

PE-8: Visitor Access Records ___________________________________________________ 145

PE-16: Delivery and Removal____________________________________________________ 145

PE-17: Alternate Work Site______________________________________________________ 145

4.12 PLANNING __________________________________________________________ 147

PL-1: Planning Policy and Procedures ____________________________________________ 147

PL-2: System Security and Privacy Plans _________________________________________ 147

PL-4: Rules of Behavior ________________________________________________________ 149

PL-8: Security and Privacy Architectures _________________________________________ 149

4.13 PROGRAM MANAGEMENT ____________________________________________ 151

PM-1: Information Security Program Plan _________________________________________ 151

PM-2: Information Security Program Leadership Role _______________________________ 151

PM-3: Information Security and Privacy Resources _________________________________ 152

PM-4: Plan of Action and Milestones Process ______________________________________ 152

PM-5: System Inventory ________________________________________________________ 152

PM-7: Enterprise Architecture ___________________________________________________ 153

PM-9: Risk Management Strategy ________________________________________________ 153

PM-10: Authorization Process ___________________________________________________ 154

PM-12: Insider Threat Program __________________________________________________ 154

PM-14: Testing, Training and Monitoring __________________________________________ 154

PM-18: Privacy Program Plan ___________________________________________________ 155

PM-19: Privacy Program Leadership Role _________________________________________ 155

PM-21: Accounting of Disclosures _______________________________________________ 156

PM-29: Risk Management Program Leadership Roles _______________________________ 156

4.14 PERSONNEL SECURITY ______________________________________________ 157

PS-1: Personnel Security Policy and Procedures ___________________________________ 157

PS-2: Position Risk Designation _________________________________________________ 157

PS-3: Personnel Screening _____________________________________________________ 157

PS-4: Personnel Termination ____________________________________________________ 158

PS-5: Personnel Transfer _______________________________________________________ 158

PS-6: Access Agreements ______________________________________________________ 158

PS-7: External Personnel Security _______________________________________________ 159

PS-8: Personnel Sanctions _____________________________________________________ 159

PS-9: Position Descriptions _____________________________________________________ 159

4.15 PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY

_______________________________________________________________________ 160

PT-1: Personally Identifiable Information Processing and Transparency Policy and

Procedures___________________________________________________________________ 160

PT-2: Authority to Process Personally Identifiable Information _______________________ 160

4.16 RISK ASSESSMENT __________________________________________________ 161

RA-1: Risk Assessment Policy and Procedures ____________________________________ 161

RA-3: Risk Assessment ________________________________________________________ 161

RA-5: Vulnerability Monitoring and Scanning ______________________________________ 162

RA-7: Risk Response __________________________________________________________ 163

RA-8: Privacy Impact Assessments ______________________________________________ 163

4.17 SYSTEM AND SERVICES ACQUISITION _________________________________163

SA-1: System and Services Acquisition Policy and Procedures _______________________ 163

SA-2: Allocation of Resources___________________________________________________ 164

SA-3: System Development Life Cycle ____________________________________________ 164

SA-4: Acquisition Process ______________________________________________________ 165

SA-5: System Documentation ___________________________________________________ 166

SA-8: Security Engineering Principles ____________________________________________ 167

SA-9: External System Services _________________________________________________ 167

SA-10: Developer Configuration Management______________________________________ 168

SA-11: Developer Testing and Evaluation _________________________________________ 169

SA-15: Development Process, Standards and Tools ________________________________ 169

SA-22: Unsupported System Components ________________________________________ 170

4.18 SYSTEM AND COMMUNICATIONS PROTECTION__________________________171

SC-1: System and Communications Protection Policy and Procedures ________________ 171

SC-2: Application Partitioning ___________________________________________________ 171

SC-4: Information in Shared System Resources ____________________________________ 171

SC-7: Boundary Protection _____________________________________________________ 171

SC-8: Transmission Confidentiality and Integrity ___________________________________ 174

SC-10: Network Disconnect _____________________________________________________ 174

SC-12: Cryptographic Key Establishment and Management __________________________ 175

SC-13: Cryptographic Protection ________________________________________________ 175

SC-15: Collaborative Computing Devices and Applications __________________________ 175

SC-17: Public Key Infrastructure Certificates ______________________________________ 175

SC-18: Mobile Code ___________________________________________________________ 176

SC-20: Secure Name/Address Resolution Service (Authoritative Source) _______________ 176

SC-21: Secure Name/Address Resolution Service (Recursive or Caching Resolver) ______ 176

SC-22: Architecture and Provisioning for Name/Address Resolution Service ___________ 177

SC-23: Session Authenticity ____________________________________________________ 177

SC-28: Protection of Information at Rest __________________________________________ 177

SC-35: External Malicious Code Identification______________________________________ 178

SC-39: Process Isolation _______________________________________________________ 178

SC-45: System Time Synchronization ____________________________________________ 178

4.19 SYSTEM AND INFORMATION INTEGRITY ________________________________179

SI-1: System and Information Integrity Policy and Procedures ________________________ 179

SI-2: Flaw Remediation_________________________________________________________ 179

SI-3: Malicious Code Protection _________________________________________________ 180

SI-4: System Monitoring ________________________________________________________ 181

SI-5: Security Alerts, Advisories and Directives ____________________________________ 183

SI-7: Software, Firmware and Information Integrity _________________________________ 183

SI-8: Spam Protection __________________________________________________________ 184

SI-10: Information Input Validation _______________________________________________ 184

SI-11: Error Handling __________________________________________________________ 184

SI-12: Information Management and Retention _____________________________________ 184

SI-16: Memory Protection_______________________________________________________ 185

4.20 SUPPLY CHAIN RISK MANAGEMENT____________________________________186

SR-1: Supply Chain Risk Management Policy and Procedures ________________________ 186

SR-2: Supply Chain Risk Management Plan _______________________________________ 186

SR-3: Supply Chain Controls and Processes ______________________________________ 186

SR-6: Supplier Assessments and Reviews ________________________________________ 187

SR-10: Inspection of Systems and Components ____________________________________ 187

SR-11: Component Authenticity _________________________________________________ 187

Exhibit 1 IRC §§ 6103(a) and (b) _______________________________________ 188

Exhibit 2 IRC § 6103(p)(4) ____________________________________________ 192

Exhibit 3 Code of Federal Regulations (CFR) § 301.6103(p)(7)-1 [T.D. 9445, 74 FR

6830, Feb. 11, 2009] _________________________________________________ 194

Exhibit 4 IRC §§ 7213 and 7213A – Sanctions for Unauthorized Disclosure and

Access____________________________________________________________ 196

Exhibit 5 IRC § 7431 - Civil Damages for Unauthorized Inspection or Disclosure of

Returns and Return Information _______________________________________ 198

Exhibit 6 Contractor 45-Day Notification Procedures ______________________ 200

Exhibit 7 Safeguarding Contract Language______________________________ 202

Exhibit 8 Warning Banner Examples ___________________________________ 205

Exhibit 9 Record Retention Schedules__________________________________ 206

Table 9 - Record Retention Schedules ____________________________________________ 206

GLOSSARY AND KEY TERMS ________________________________________ 207

INDEX ____________________________________________________________ 214

Highlights for November 2021 Revision

This publication revises and supersedes Publication 1075 (November 2016) and is effective 6 months

after the publication date. Feedback for Publication 1075 is highly encouraged. Please send any

comments to SafeguardReports@irs.gov, using “Publication 1075 comment/feedback” in the subject line.

Editorial changes have been made throughout to update references and terms. Web and citation

references were added/updated throughout to make the text easier to research in electronic format.

Following are the highlighted changes:

1) Publication 1075 has been reformatted, and all sections have been renumbered. Section 1.0 is

Federal Tax Information, Reviews and Other Requirements; Section 2.0 is Physical Security

Requirements and is numbered to include the applicable IRC § 6103 subsections, the key

Safeguarding elements; Section 3.0 is CyberSecurity Requirements; and Section 4.0 is the NIST

800-53 Revision 5 Security and Privacy Controls.

2) Section 4.0, NIST (National Institutes of Standards and Technology) 800-53 Security and Privacy

Controls has been updated to align with NIST 800-53 Revision 5 Security and Privacy controls.

Some controls have been added, but all have been reviewed and/or updated.

3) Privacy controls previously in NIST 800-53 Rev 4 Appendix J, are now fully integrated into the

NIST controls.

4) NIST SP 800-63, Digital Identity Guidelines, requirements have been adapted into this revision.

5) Treasury Directive 85-01 defined requirements have been included in several Section 4.0 NIST

800-53 Security and Privacy Controls and are shown as IRS-Defined.

6) Security and Privacy Control Table has been added for reference. This table identifies the

controls, which are privacy related, which overlap with physical controls and identifies those

controls new to this revision of the Publication 1075.

7) Many instances of “should” throughout the document have been changed to “must”.

8) Key Definitions “Information Spillage”, Access, “Unauthorized Inadvertent Access and Incidental

Access” have been added. “Unauthorized Disclosure and Need-to-Know have been updated for

clarification. The term “Access” was also added.

9) Section 1.2, Authorized Use of FTI has been updated.

10) Section 1.6, Safeguards Reviews now includes the terms “on-site, remote, or a combination of

both (hybrid)” as types of assessments and descriptions for on-site reviews and remote reviews.

11) Former Section 2.7, Conducting the Review, has been split into the current Sections 1.6.1, Before

the Review, 1.6.2, During the Review and 1.6.3 After the Review, and updated to reflect current

on-site review procedures.

12) Former Section 2.7.2, Computer Security Review has been removed and incorporated into

Section 3.2 Assessment Process.

13) Former Tables 1 and 2 – Safeguard Review Cycle and IT Testing Techniques have been

removed and incorporated into Section 3.2, Assessment Process.

14) Former Section 2.9, Termination of FTI, has been changed to Section 1.7, Termination of FTIAgency Request.

15) Sections 1.8, Reporting Improper Inspections or Disclosures, 1.9 Disclosures to Other Persons

and 1.10 Return Information in Statistical Reports, formerly Sections 10, 11 and 12 have been

relocated to the front of Publication 1075.

16) Sections 1.8.1, Terms, 1.8.1.1 Incident and 1.8.1.2 Data Breach are new items.

17) Section 1.8.2, General – Reporting Improper Inspections or Disclosures, was updated to include

information regarding spillage and was also updated to reflect the NIST IR Control requirements.

18) Section 1.8.4, Incident Response Procedures now includes requirement for tabletop incident

response testing from NIST IR-3 and the requirement to track and document incidents from NIST

IR-5.

19) The requirement in former Section 3.1, General Recordkeeping Requirement (now Section

2.A.1), for an inventory of IT systems has been removed. Please see NIST Controls CM-8,

System Component Inventory and PM-5, System Inventory, for guidance.

20) Section 2.A.2, Logs of FTI (Electronic and Non-Electronic Receipts), has been updated and

references NIST Control AU-2, Audit Events. Additionally, Figure 1 – Sample FTI Logs was

updated to include the Electronic Receipts Sample log.

21) Section 2.B.2, Minimum Protection Standards, was updated to include requirements for MFDs or

High-Volume Printers.

22) Created new heading for Section 2.B.3.1, Visitor Access Logs and included previous Section 4.2

information.

23) Section 2.B.3.1, Visitor Access Logs, has been updated for clarity and adds retention

requirement.

24) Section 2.B.3.2, Authorized Access List has been updated for clarity. The Authorized Access List

must be reviewed monthly or upon occurrence or potential indication of an event such as a

possible security breach or personnel change.

25) Section 2.B.3.3, Controlling Access to Areas Containing FTI, has been updated for clarity. The

agency must maintain a policy addressing issuance of appropriate authorization credentials,

including badges, identification cards or smart cards. This policy must include proper use and

accountability requirements.

26) Section 2.B.4.1, Security During Office Moves, has been added.

27) Section 2.B.7, Alternate Work Site was formerly Section 4.7, Telework Locations.

28) Section 2.B.7, Alternate Work Site, no longer includes requirement for agency inspections of

telework locations

29) Section 2.C.1 General - Restricting Access has been updated to include requirements for auditing

controls.

30) Section 2.C.2, Policies and Procedures has been added and includes required policies and

procedures related to physical controls. New policies and procedures include Access Control,

Audit and Accountability, Media Protection, Privacy Authorization, Physical and Environmental

Security, and Personnel Security. Insider Threat Program and Privacy Program plans have also

been included.

31) Section 2.C.3, Background Investigation Minimum Requirements has been changed to reflect

updated requirement for reinvestigations to be conducted every five (5) years (previously 10

years).

32) Section 2.C.3, Background Investigation Minimum Requirements, was rearranged for clarity.

33) Section 2.C.3.1, Background Investigation Requirement Implementation – Removed first

paragraph that referenced a one-year implementation period beginning with the last revision of

the Publication 1075.

34) Added new Section 2.C.4, Personnel Actions, which includes new Section 2.C.4.1, Personnel

Transfer (PS-5), Section 2.C.4.2 Personnel Sanctions (PS-8) and Section 2.C.4.3, Personnel

Terminations (PS-4).

35) Added new Section 2.C.7, Offshore Operations, which contains some information that was

previously included in former Section 5.3 Access to FTI via State Tax Files or Through Other

Agencies.

36) Section 2.C.9, Service Level Agreements (SLA) was formerly Section 5.4.2.2, Consolidated Data

Centers and has been updated to reflect more inclusive language, state support functions and

includes requirement for Exhibit 7 language.

37) Section 2.D.2.1, Disclosure Awareness Training, has been updated to include the prohibition of

FTI in training and a requirement to add role-based training and practical exercises. Training must

also include security and privacy updates at least quarterly in addition to annual awareness. The

Safeguards’ Disclosure Awareness Training video can be used to supplement training but is not

intended to fulfill all training requirements.

38) Section 2.D.2.1, Disclosure Awareness Training, has been updated to better align with NIST 80053 Controls.

39) Section 2.D.2, Table 2, Training Requirements, has been updated to include Insider Threat

Awareness Training.

40) Section 2.D.2.2, Disclosure Awareness Training Products, has been updated with current titles of

available products.

41) Section 2.D.3, Internal Inspections, has been updated to include self-certification requirements.

42) Section 2.D.9, Plan of Action and Milestones (POA&M) has been updated for clarity.

43) Section 2.E.2 Report Submission Instructions, has been updated to include the Head of Agency

may delegate authority to sign Safeguard report submissions.

44) Sections 2.E.4.4, SSR Submission Dates and 2.E.5.2 CAP Submission Dates, have been

updated to reflect the correct postal code for CNMI and associated due dates.

45) Previous Section 7.3.1 CAP Submission Instructions and Submission Dates, has been split up

into new Sections 2.E.5.1 CAP Submission Instructions and 2.E.5.2, CAP Submission Dates, for

clarity.

46) Table 6 in Section 2.E.6, Notification Reporting Requirements has been updated.

47) Section 2.E.6.1 Cloud Computing, and Section 2.E.6.4 Live Data Testing have been updated for

clarity.

48) Removed former Section 7.4.2 Consolidated Data Center.

49) Removed former Section 7.4.4, Data Warehouse Processing.

50) Removed former Section 7.4.5, Non-Agency-owned Information Systems.

51) Removed former Section 7.4.8 Virtualization of Information Technology Systems.

52) Section 2.F.4, Other Precautions, has been updated to reflect annual requirement to validate and

maintain most recent copy of NAID certification.

53) Former Section 9.4.5, Interactive Voice Response, has been incorporated into Section 3.3.8,

Public-Facing Systems (NIST SP 800-63-3).

54) Former Section, 9.4.7, Media Sanitization is now moved to Section 2.F.3.1, under Destruction

and Disposal.

55) Former Sections 9.4.11, Storage Area Networks and 9.4.12, System Component Inventory,

9.4.14, Virtualization Requirements, 9.4.15, VoIP Systems and 9.4.18, Wireless Networks, have

been removed, as the base requirements are included in NIST controls.

56) Section 3.3.8, Public-Facing Systems, has been added and includes guidance from NIST SP

800-63-3, Digital Identity Guidelines.

57) Former Section 10.5, FTI Suspension, Termination and Administrative Review language was

changed and moved to Section 1.7.2.

58) Control IA-2, Identification and Authentication (Organizational Users), Multifactor authentication is

now required for all privileged and non-privileged accounts.

59) Exhibit 6, Contractor 45-Day Notification Procedures, has updated the signature requirement to

include the Head of Agency, or their delegate.

60) Exhibit 7 has been updated to include Exhibit 7a, Safeguarding Contract Language for General

Services and Exhibit 7b, Safeguarding Contract Language for Technology Services.

61) Exhibits 7a and 7b have been updated to include Data Incident Response language.

62) Exhibit 10, Data Warehouse Security Requirements has been removed. Please see the

Safeguards Website for technical guidance.

63) Exhibit 11, Media Sanitization Techniques has been removed. Please see NIST 800-88,

Guidelines for Media Sanitization for approved sanitization techniques. Also see MP-6.

64) Glossary and Key Terms has been updated to include the terms Access, Contractor, External

Systems, Inadvertent and Incidental Access, Information Spillage, Insider Threat, Mobile Code,

Mobile Device, Need-to-Know, Object, Remote Access, Subject, Unauthorized Access and

Unauthorized Disclosure.

65) Glossary and Key Terms - The definition for Personally Identifiable Information (PII) has been

updated to clarify that for the purposes of Publication 1075 and Safeguarding requirements, PII is

FTI.

66) Agencies must wipe mobile devices after 10 (ten) unsuccessful login attempts. See AC-7, CE-2.

67) Agencies must employ data mining prevention and detection techniques. See AC-23.

68) Added penetration testing requirements. See CA-8.

69) Perform security and privacy compliance checks prior to allowing connections. See CA-9, CE-1.

70) Multi-factor authentication is required to be at Authenticator Assurance Level 2 as defined in NIST

SP 800-63. See IA-2, CE-6.

71) Password complexity requirements have been updated. See IA-5.

72) Agencies must provide training specific training for incidents related to breaches. See IR-2, CE-3.

73) Coordination with contractors, data centers, counties, and other agencies is required for incidents

involving Federal Tax Information. See IR-4, CE-8.

74) A custodian must be identified when transporting controls outside of controlled areas. See MP-5,

CE-3.

75) Major change to PE-6. The requirement moved from annually to monthly for inspection of

physical access logs.

76) Perimeter security checks are required daily for exfiltration of information. See PE-3, CE-2.

77) New Control Enhancement for Defense in Depth. See PL-8, CE-1.

78) Agency contractors (including sub-contractors) must remove data within 7 (seven) calendar days

of contract termination. See SA-4, CE-12.

79) Control Enhancement to restrict the accessing, processing, storage, and transmission of FTI to

the United States and its territories. See SA-9, CE-5.

80) Change from specifying FIPS 140-3 to latest FIPS validated mechanisms. See SC-13.

81) Added visibility of encrypted communications to system monitoring requirements. See SI-4, CE10.

AC-2

AC-3

AC-4

AC-5

AC-6

AC-7

AC-8

AC-11

AC-12

AC-14

AC-17

AC-18

AC-19

AC-20

AC-21

AC-22

AC-23

AT-1

AT-2

AT-3

AT-4

AT-6

AU-1

AU-2

AU-3

AU-4

AU-5

AU-6

AU-7

AU-8

AU-9

Information

Technology

Access Control Policy and

Procedures

Account Management

Access Enforcement

Information Flow Enforcement

Separation of Duties

Least Privilege

Physical

AC-1

Control Name

Privacy-Related

Control

Number

Control

Enhancements

Security and Privacy Control Table

Physical

Security

Reference

Section

Unsuccessful Logon Attempts

System Use Notification

Device Lock

Session Termination

Permitted Actions Without

Identification or Authentication

Remote Access

Wireless Access

Access Control for Mobile

Devices

Use of External Systems

Information Sharing

Publicly Accessible Content

Data Mining Protection*

Awareness and Training Policy

and Procedures

Awareness Training

Role-Based Training

Training Records

Training Feedback*

Audit and Accountability Policy

and Procedures

Audit Events

Content of Audit Records

Audit Storage Capacity

Response to Audit Processing

Failures

Audit Review, Analysis and

Reporting

Audit Reduction and Report

Generation

Time Stamps

Protection of Audit

Need-toKnow

Exhibit 8

2.B.7

2.B.7.1

Exhibit 7

3.3.8

2.C.2

2.D.2.1

2.C.2

2.C.1

CA-2

CA-3

CA-5

CA-6

CA-7

CA-8

CA-9

CM-1

CM-2

CM-3

CM-4

CM-5

CM-6

CM-7

CM-8

CM-9

CM-10

CM-11

CM-12

CM-13

CM-14

CP-1

CP-2

CP-3

CP-4

CP-9

CP-10

IA-1

IA-2

IA-3

Information

Technology

Physical

Audit Record Retention

Audit Generation

Cross-Organizational Auditing*

Assessment, Authorization and

Monitoring Policy and Procedures

Assessments

System Interconnections

Plan of Action and Milestones

Authorization

Continuous Monitoring

Penetration Testing

Internal System Connections*

Configuration Management Policy

and Procedures

Baseline Configuration

Configuration Change Control

Security and Privacy Impact

Analyses

Access Restrictions for Change

Configuration Settings

Least Functionality

System Component Inventory

Configuration Management Plan

Software Usage Restrictions

User-Installed Software

Information Location*

Data Action Mapping*

Signed Components*

Contingency Planning Policy and

Procedures

Contingency Plan

Contingency Training

Contingency Plan Testing

System Backup

System Recovery and

Reconstitution

Identification and Authentication

Policy and Procedures

Identification and Authentication

(Organizational Users)

Device Identification and

Authentication

Privacy-Related

AU-11

AU-12

AU-16

CA-1

Control Name

Control

Enhancements

Control

Number

2.D.3

2.D.9

2.C.1

Physical

Security

Reference

Section

2.C.1

3.2

2.B.6

IA-8

IA-9

IA-11

IA-12

IR-1

IR-2

IR-3

IR-4

IR-5

IR-6

IR-7

IR-8

IR-9

MA-1

MA-2

MA-3

MA-4

MA-5

MA-6

MP-1

MP-2

MP-3

MP-4

MP-5

MP-6

MP-7

PE-1

PE-2

PE-3

PE-4

PE-5

Information

Technology

Physical

Identifier Management

Authenticator Management

Authenticator Feedback

Cryptographic Module

Authentication

Identification and Authentication

(Non-Organizational Users)

Service Identification and

Authentication*

Re-Authentication*

Identity Proofing*

Incident Response Policy and

Procedures

Incident Response Training

Incident Response Testing

Incident Handling

Incident Monitoring

Incident Reporting

Incident Response Assistance

Incident Response Plan

Information Spillage Response

System Maintenance Policy and

Procedures

Controlled Maintenance

Maintenance Tools

Nonlocal Maintenance

Maintenance Personnel

Timely Maintenance*

Media Protection Policy and

Procedures

Media Access

Media Marking

Media Storage

Media Transport

Media Sanitization

Media Use*

Physical and Environmental

Policy and Procedures

Physical Access Authorizations

Physical Access Control

Access Control for Transmission

Access Control for Output

Privacy-Related

IA-4

IA-5

IA-6

IA-7

Control Name

Control

Enhancements

Control

Number

Physical

Security

Reference

Section

2.C.2

2.D.2.1

1.8.4

1.8.2

2.B.3.2

2.B.3.3

2.C.2

2.C.11

2.B.6

2.B.4

2.F.3.1

2.B.7.1

2.C.2

2.B.3.2

2.B.3

2.B.2

2.B.3.3

PE-6

PE-8

PE-16

PE-17

PL-1

PL-2

PL-4

PL-8

PM-1

PM-2

PM-3

PM-4

PM-5

PM-7

PM-9

PM-10

PM-12

PM-14

PM-18

PM-19

PM-21

PM-29

PS-1

PS-2

PS-3

PS-4

PS-5

PS-6

PS-7

PS-8

PS-9

PT-1

Information

Technology

Physical

Devices

Monitoring Physical Access

Visitor Access Records

Delivery and Removal

Alternate Work Site

Planning Policy and Procedures

Security and Privacy Plans

Rules of Behavior

Security and Privacy

Architectures

Information Security Program

Plan*

Information Security Program

Roles

Information Security and Privacy

Resources*

Plan of Action and Milestones

Process*

System Inventory*

Enterprise Architecture*

Risk Management Strategy*

Authorization Process

Insider Threat Program*

Testing, Training and Monitoring*

Privacy Program Plan*

Privacy Program Roles*

Accounting of Disclosures*

Risk Management Program

Leadership Roles*

Personnel Security Policy and

Procedures

Position Risk Designation

Personnel Screening

Privacy-Related

Control Name

Control

Enhancements

Control

Number

Physical

Security

Reference

Section

2.B.3.2

2.B.3.1

2.B.4

2.B.7

2.E.4

2.D.9

2.C.2

2.D.2

2.C.2

Personnel Termination

Personnel Transfer

Access Agreements

External Personnel Security

Personnel Sanctions

Position Descriptions*

Personally Identifiable Information

Processing and Transparency

Policy and Procedures*

2.C.2

2.C.4.3

2.C.4.1

2.C.2

1.9.3

2.C.4.2

RA-1

RA-3

RA-5

RA-7

RA-8

SA-1

SA-2

SA-3

SA-4

SA-5

SA-8

SA-9

SA-10

SA-11

SA-15

SA-22

SC-1

SC-2

SC-4

SC-7

SC-8

SC-10

SC-12

SC-13

SC-15

SC-17

SC-18

Information

Technology

Physical

Authority to Process Personally

Identifiable Information*

Risk Assessment Policy and

Procedures

Risk Assessment

Vulnerability Scanning

Risk Response*

Privacy Impact Assessments*

System and Services Acquisition

Policy and Procedures

Allocation of Resources

System Development Life Cycle

Acquisition Process

Information System

Documentation

Security Engineering Principles

External System Services

Developer Configuration

Management

Developer Security Testing and

Evaluation

Development Process, Standards

and Tools*

Unsupported System

Components

System and Communications

Protection Policy and Procedures

Application Partitioning

Information in Shared System

Resources

Boundary Protection

Transmission Confidentiality and

Integrity

Network Disconnect

Cryptographic Key Establishment

and Management

Cryptographic Protection

Collaborative Computing Devices

and Applications

Public Key Infrastructure

Certificates

Mobile Code

Privacy-Related

PT-2

Control Name

Control

Enhancements

Control

Number

Physical

Security

Reference

Section

2.E.4.1

2.C.7

SC-21

SC-22

SC-23

SC-28

SC-35

SC-39

SC-45

SI-1

SI-2

SI-3

SI-4

SI-5

SI-7

SI-8

SI-10

SI-11

SI-12

SI-16

SR-1

SR-2

SR-3

SR-6

SR-10

SR-11

Information

Technology

Physical

Secure Name/Address Resolution

Service (Authoritative Source)*

Secure Name/Address Resolution

Service (Recursive or Caching

Resolver)*

Architecture and Provisioning for

Name/Address Resolution

Service*

Session Authenticity

Protection of Information at Rest

External Malicious Code

Identification*

Process Isolation*

System Time Synchronization*

System and Information Integrity

Policy and Procedures

Flaw Remediation

Malicious Code Protection

System Monitoring

Security Alerts, Advisories and

Directives

Software, Firmware and

Information Integrity*

Spam Protection

Information Input Validation

Error Handling

Information Management and

Retention*

Memory Protection

Policy and Procedures

Supply Chain Risk Management

Plan

Supply Chain Controls and

Processes

Supplier Assessments and

Reviews

Inspection of Systems or

Components

Component Authenticity

Privacy-Related

SC-20

Control Name

Control

Enhancements

Control

Number

*New to this revision of Publication 1075

Physical

Security

Reference

Section

INTRODUCTION

General

To foster a tax system based on voluntary compliance, the public must maintain a high degree of

confidence that the personal and financial information furnished to the Internal Revenue Service (IRS) is

protected against unauthorized use, inspection, or disclosure.

The IRS must administer the disclosure provisions of the Internal Revenue Code (IRC) according to the

spirit and intent of these laws, ever mindful of the public trust. The IRC defines and protects the

confidential relationship between the taxpayer and the IRS and makes it a crime to violate this

confidence. IRC § 7213 prescribes criminal penalties, making it a felony offense for federal and state

employees and others who illegally disclose federal tax returns and return information (FTI). Additionally,

IRC § 7213A makes the unauthorized inspection of FTI a misdemeanor, punishable by fines,

imprisonment, or both. And finally, IRC § 7431 prescribes civil damages available to the taxpayer upon

notification that a criminal indictment or the existence of information that an unauthorized inspection or

disclosure has occurred under IRC §§ 7213 or 7213(A).

The concerns of citizens and Congress regarding individual rights to privacy require the IRS to

continuously assess disclosure practices and the safeguards used to protect the confidential information

entrusted. While the sanctions of the IRC are designed to protect the privacy of taxpayers, the IRS

recognizes the importance of cooperating to the fullest extent permitted by law with other federal, state,

and local authorities in their administration and enforcement of laws.

Those agencies or agents that legally receive FTI directly from either the IRS or from secondary sources

(e.g., Social Security Administration [SSA]), pursuant to IRC § 6103 or by an IRS-approved exchange

agreement must have adequate programs in place to protect the data received. Furthermore, as agencies

procure contractor or sub-contractor services, it becomes equally important that contractors or subcontractors protect that information from unauthorized use, access, and disclosure.

IRS Safeguards reports and related communications in possession of federal, state, and local agencies

are considered the property of the IRS and may not be disclosed to anyone outside the agency and are

subject to disclosure restrictions under federal law and IRS rules and regulations. This includes, but is not

limited to, Preliminary Findings Report (PFR); Safeguard Review Report (SRR); Safeguard Security

Report (SSR) and Corrective Action Plan (CAP).

Release of any IRS Safeguards document requires the express permission of the Internal Revenue

Service. Requests received through Sunshine and/or Information Sharing/Open Records provisions must

be referred to the federal Freedom of Information Act (FOIA) statute for processing. State and local

agencies receiving such requests must refer the requestor to the instructions to file a FOIA request with

the IRS. Federal agencies must follow established procedures that require consultation before citing FOIA

exemptions on IRS agency records, or directly refer the FOIA request to IRS for processing.

The intent of this requirement is to address any public request for sensitive information and prevent

disclosure of data that would put FTI at risk. The agency may still distribute these reports internally and

within other state agencies, or to auditors or oversight panels as required to either take corrective actions

or report status without further IRS approval.

Additional guidance may be found at, https://www.irs.gov/uac/IRS-Freedom-of-Information, and questions

should be referred to the Safeguards mailbox at Safeguardreports@irs.gov.

Overview of Publication 1075

This publication provides guidance to ensure the policies, practices, controls, and safeguards employed

by recipient agencies, agents, contractors, or sub-contractors adequately protect the confidentiality of FTI.

Enterprise security policies address the purpose, scope, roles, responsibilities, management commitment,

coordination among organizational entities and compliance to implement all applicable security controls.

This document contains the managerial, operational, and technical security controls that must be

implemented as a condition of receipt of FTI.

The guidelines outlined herein apply to all FTI, no matter the amount or the media in which it is recorded.

FTI must be afforded the same levels of protection regardless of it residing on paper or electronic form.

Systematic, procedural, or manual security policies must minimize circumvention.

A mutual interest exists in our responsibility to ensure that FTI is disclosed only to persons authorized and

used only as authorized by statute or regulation. The IRS is confident of your diligence in this area and

believes that this publication will be a helpful resource.

Conforming to these guidelines meets the safeguard requirements of IRC § 6103(p)(4) and makes our

joint efforts beneficial.

Requirements throughout this document apply to all organizational segments of an agency receiving FTI.

It is the agency’s responsibility to ensure all functions within the agency, including consolidated data

centers, contractors, and sub-contractors (where allowed by federal statute) with access to FTI,

understand and implement the requirements in this publication.

This publication provides the preliminary steps to consider before submitting a request to receive FTI,

requirements for proper protection, expectations from the IRS and considerations that may be helpful in

establishing a program to protect FTI. The exhibits in this publication are provided for additional guidance.

IRS Safeguards is responsible for all interpretations of safeguarding requirements. Publication 1075

requirements may be supplemented or modified between editions of Publication 1075 via guidance

issued by Safeguards and posted on the Safeguards website.

SAFEGUARD RESOURCES

Safeguards Website

Safeguards maintains Publication 1075, templates, guidance and frequently asked questions online at

http://www.irs.gov/uac/Safeguards-Program. Agencies are highly encouraged to regularly visit the website

for updates.

The website contains many resources to assist agencies with meeting Publication 1075 requirements.

Examples of the website’s features include:

•

Safeguard alerts and technical assistance documents

•

Recommendations on how to comply with Publication 1075 requirements

•

Reporting requirement templates (e.g., SSR) and guidance

•

Instructions for reporting unauthorized accesses, disclosures, or data breaches

•

Internal inspections report templates and instructions

•

IRS disclosure awareness videos and resources

•

Review Preparation Questionnaire (RPQ)

•

Cybersecurity requirements documented in Safeguard Computer Security Evaluation Matrix

(SCSEM) templates organized by technology or topic

•

Nessus audit files

Safeguards Mailbox

The Safeguards Mailbox is an acceptable alternative for communicating information or questions to the

Office of Safeguards relative to safeguarding requirements and Publication 1075. The Mailbox is located

at SafeguardReports@irs.gov. The Office of Safeguards requires that all reports, when sent to the Office

of Safeguards via email, be transmitted using IRS-approved encryption methods as described in Section

2.E.3 Encryption Requirements. Below are items that are appropriate for submission to the Mailbox:

•

Safeguards Reports and Extension Requests

•

45-Day Notifications

•

Publication 1075 Technical Inquiries

•

Re-Disclosure Agreements

•

Data Incident Reporting

•

Ad hoc Points of Contact changes

KEY DEFINITIONS

This section establishes a baseline of key terms used throughout this publication. For additional

definitions of terms and phrases, refer to Glossary and Key Terms.

Federal Tax Information

Safeguarding FTI is critically important to continuously protect taxpayer confidentiality as required by IRC

§ 6103. FTI consists of federal tax returns and return information (and information derived from it) that is

in the agency’s possession or control that is covered by the confidentiality protections of the IRC and

subject to the IRC § 6103(p)(4) safeguarding requirements including IRS oversight. FTI is categorized as

Sensitive But Unclassified (SBU) information and may contain personally identifiable information (PII).

FTI includes return or return information received directly from the IRS or obtained through an authorized

secondary source such as Social Security Administration (SSA), Federal Office of Child Support

Enforcement (OCSE), Bureau of the Fiscal Service (BFS) or Centers for Medicare and Medicaid Services

(CMS) or another entity acting on behalf of the IRS pursuant to an IRC § 6103(p)(2)(B) Agreement.

FTI includes any information created by the recipient that is derived from federal return or return

information received from the IRS or obtained through a secondary source.

FTI may not be masked to change the character of information to circumvent IRC § 6103 confidentiality

requirements.

Return and Return Information

IRC § 6103(b)(1) defines a return as any tax or information return, estimated tax declaration or refund

claim (including amendments, supplements, supporting schedules, attachments or lists) required by or

permitted under the IRC and filed with the IRS by, on behalf of, or with respect to any person or entity.

Examples of returns include forms filed on paper or electronically, such as Forms 1040, 941, 1120 and

other informational forms, such as 1099 or W -2. 1 Forms include supporting schedules, attachments or

lists that are supplemental to or part of such a return.

Return information, in general, is any information collected or generated by the IRS regarding any

person’s liability or possible liability under the IRC. IRC § 6103(b)(2)(A) defines return information very

broadly. It includes but is not limited to:

•

Information that IRS obtained from any source or developed through any means that relates to

the potential liability of any person under the IRC for any tax, penalty, interest, fine, forfeiture or

other imposition or offense

•

Information extracted from a return, including names of dependents or the location of business

•

The taxpayer’s name, address, and identification number

•

Information collected by the IRS about any person’s tax affairs, even if identifiers, such as name,

address and identification number are deleted

•

Status of whether a return was filed, under examination or subject to other investigation or

processing, including collection activities

•

Information contained on transcripts of accounts

Personally Identifiable Information (PII)

FTI may include Personally Identifiable Information (PII). FTI may include the following PII elements:

•

Name of a person with respect to whom a return is filed

•

Taxpayer mailing address

•

Taxpayer identification number

•

Email addresses

•

Telephone numbers

•

Social Security Numbers

•

Bank account numbers

•

Date and place of birth

•

Mother’s maiden name

1 Refer to IRS.gov for a complete catalog of IRS forms

•

Biometric data (e.g., height, weight, eye color, fingerprints)

•

Any combination of the above

For the purposes of Publication 1075 and Safeguarding requirements, PII is FTI when provided by the

IRS or a secondary source (i.e., SSA, BFS).

Information Received from Taxpayers or Third Parties

Copies of tax returns or return information provided to the agency directly by the taxpayer or their

representative (e.g. W-2’s, Form 1040, etc.) or obtained from public information files (e.g. federal tax lien

on file with the county clerk, Offers in Compromise available for public inspection, court records, etc.) is

not protected FTI that is subject to the safeguarding requirements of IRC § 6103(p)(4). If the agency

independently verifies FTI provided by the IRS or a secondary source (i.e., SSA, BFS) with the taxpayer

or a third-party source (linked to the taxpayer), the verified information is no longer FTI as long as the IRS

source information is replaced or overwritten with the newly provided information.

Access

Access means when an individual: (1) enters a restricted or locked area, room, container, or system

containing federal tax information; or (2) obtains, acquires, receives, examines, uses, or gains knowledge

of federal tax information, by physical, electronic, or any other methods.

Users (e.g., system administrators, database administrators) have access to FTI if they have the ability to

modify or bypass security controls protecting FTI (to include decryption keys).

Cloud Computing

Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared

pool of configurable, computing resources (e.g., networks, servers, storage, applications and services)

that can be rapidly provisioned and released with minimal management effort or service provider

interaction.

Inadvertent Access

Access to FTI without authority that is non-willful and unanticipated or accidental.

Inadvertent Disclosure

Accidental exposure of information to a person not authorized access.

Incidental Access

Access to FTI without a need-to-know that may occur in extraordinary circumstances (i.e., system failure,

data incident response, disaster response).

Unauthorized Access

Unauthorized access occurs when a person gains logical or physical access to FTI without authority

under IRC § 6103 and without a need-to-know (which would include but is not limited to agency

employees with no need to know and/or janitors and security guards when there is no second barrier

securing the federal tax information as well as developers/administrators of electronic

systems/applications receiving, processing, storing or transmitting federal tax information).

Access to FTI is permitted only to individuals who require the FTI to perform their official duties and as

authorized under the IRC. FTI must never be indiscriminately disseminated, even within the recipient

agency, body, or commission. Agencies must evaluate the need for FTI before the data is requested or

disseminated. Inadvertent access is access to FTI without authority and is non-willful. Willful access to

FTI by a person without authorization or need-to-know may be prosecuted under IRC § 7213A.

Unauthorized Disclosure

Unauthorized disclosure occurs when a person with access to FTI discloses it to another person without

authority under IRC § 6103.

An unauthorized disclosure has occurred when FTI is knowingly or due to gross negligence provided to

an individual who does not have the statutory right to have access to it under the IRC. Even without

willfulness or gross negligence FTI is not to be disclosed to entities or individuals who are not authorized

by IRC § 6103 to have it. Inadvertent disclosure is disclosure of FTI without authority and is non-willful.

Willful disclosure of FTI to a person without authorization or need-to-know may be prosecuted under IRC

§ 7213.

Need-to-Know

Need-to-know is established when individuals require FTI to perform their official duties and are

authorized under the IRC.

Limiting access to individuals on a need-to-know basis reduces opportunities to “browse” or improperly

view FTI. Restricting access to designated personnel minimizes improper access or disclosure. FTI

disclosures must be limited to what is essential to accomplish official duties.

Adverse Action

An adverse action includes a suspension of 15 days or more, a reduction in pay, or termination of

employment.

Disciplinary Action

A disciplinary action includes an admonishment, written reprimand, or suspension of 14 days or less.

Personnel Sanction

A disciplinary or adverse action for individuals failing to comply with established information security

policies and procedures constitutes a personnel sanction.

1.0 FEDERAL TAX INFORMATION, REVIEWS and OTHER REQUIREMENTS

1.1 General

IRC § 6103 is a confidentiality statute and generally prohibits the disclosure of FTI (see Exhibit 1, IRC §

6103(a) and (b), for general rules and definitions). Exceptions to the general rule authorize disclosure of

FTI to certain federal, state, and local agencies. Generally, these disclosures are made by the IRS in

response to written requests signed by the head of the requesting agency or an authorized delegate. FTI

so disclosed may be used by the receiving agency solely for the purpose described in the exception

authorizing the disclosure. The statutes providing authorization to disclose FTI contain specific conditions

that may require different procedures in maintaining and using the information. These conditions are

outlined under specific sections in this publication.

As a condition of receiving FTI, the receiving agency must show, to the satisfaction of the IRS, the ability

to protect the confidentiality of that information. Certain safeguards must be implemented to prevent

unauthorized access and use. Besides written requests, the IRS may require formal agreements that

specify, among other things, how the information will be protected. An agency must ensure its safeguards

will be ready for immediate implementation upon receipt of FTI. Copies of the initial and subsequent

requests for data and any formal agreement must be retained by the agency a minimum of five (5) years

as a part of its recordkeeping system.

Agencies must always maintain the latest SSR on file. The initial request for FTI must be followed by

submitting a SSR to Safeguards at least 90 days before the scheduled or requested receipt of FTI (see

Section 2.E, Reporting Requirements—6103(p)(4)(E)). The SSR must include processing and safeguard

procedures for all FTI received and distinguish between agency programs and functional organizations

using FTI. Multiple organizations, divisions or programs within a federal agency using FTI must be

consolidated into a single report for that agency at the direction of Safeguards.

Agencies entering into an agreement to disclose FTI to agents, contractors, or sub-contractors requires

advance notice to IRS Safeguards (see Section 2.E.6 Notification Reporting Requirements and Section

1.9.4, Disclosing FTI to Contractors or Sub-Contractors.)

Agencies must exercise care in outlining their safeguard program. Reports that lack clarity or sufficient

information will be returned to the submitting agency for additional documentation.

1.2 Authorized Use of FTI

Any agency that receives FTI for an authorized use may not use that information in any manner or for any

purpose not consistent with that authorized use. If an agency needs FTI for a different authorized use

under a different provision of IRC § 6103, a separate request must be sent to IRS Disclosure.

An unauthorized secondary use of FTI is specifically prohibited and may result in discontinuation of

disclosures to the agency and imposition of civil or criminal penalties on the responsible officials.

The Office of Safeguards validates that an agency’s “need and use” of FTI conforms with the governing

provisions allowing the disclosure of FTI. The agency’s SSR must describe the purpose(s) for which FTI

is collected, used, maintained and shared.

1.3 Secure Data Transfer

The IRS established a Secure Data Transfer (SDT) program to provide encrypted electronic transmission

of FTI between the IRS and trading partners. For support with establishing an IRS SDT account, please

submit an SDT Customer Support Request. Complete information on establishing an SDT account is

available in the SDT Handbook. The SDT Handbook is available from a local IRS governmental liaison or

a request to the Safeguards mailbox.

Only the following types of documents will be accepted via SDT:

•

Control File (.txt)

•

Adobe (.pdf)

•

Word Document (.doc or .docx)

•

Excel Document (.xls or.xlsx)

•

Zipped File (.zip)

Contact the SafeguardReports@irs.gov mailbox for specific details on how to submit information via SDT.

1.4 State Tax Agency Limitations

FTI may be obtained per IRC § 6103(d) by state tax agencies only to the extent the information is needed

for and is reasonably expected to be used for state tax administration. An agency’s records must include

some account of the result of its use of FTI (e.g., disposition of closed cases and summary of revenues

generated) or include reasons why the information was not used. If any agency continually receives FTI

that it is unable to use for any reason, it must contact the IRS official liaison and discuss the need to stop

the receipt of this FTI.

State tax agencies using FTI to conduct statistical analysis, tax modeling or revenue projections must

notify the IRS by submitting a signed Need and Use Justification Statement for Use of Federal Tax

Information form and follow the established guidelines (available through the assigned Governmental

Liaison).

Annually, the agency must provide updated information in the SSR regarding its modeling activities that

include FTI. In the SSR, the agency must describe:

•

Any use of FTI that is in addition to what was described in the original Need and Use

Justification Form

•

Any new, previously unreported internal tax administration compilations that include FTI

•

Changes to the listing of authorized employees (Attachment B to the Need and Use

Justification Form)

If the agency intends to use a contractor or sub-contractor for conducting statistical analysis, tax modeling

or revenue projections, it must submit a 45-day notification (see Section 1.9.4, Disclosing FTI to

Contractors or Sub-Contractors) prior to contractor or sub-contractor access to the FTI. The agency’s

SSR must detail the use of FTI for this purpose. In addition, the agency must submit a separate statement

detailing the methodology used and data to be used by the contractor or sub-contractor. The Office of

Safeguards and Statistics of Income functions will review the information provided to confirm that

adequate safeguarding protocols are in place and that the modeling methodology to be used to remove

taxpayer identifying information is appropriate.

1.5 Coordinating Safeguards within an Agency

Because of the diverse purposes that authorized disclosures may be made to an agency and the division

of responsibilities among different components of an agency, FTI may be received and used by several

quasi-independent units within the agency’s organizational structure. Where there is such a dispersal of

FTI, the agency must centralize safeguarding responsibilities to the greatest extent practical and establish

and maintain uniform safeguard standards consistent with IRS guidelines. The official(s) assigned these

responsibilities must hold a position high enough in the agency’s organizational structure to ensure

compliance with the agency safeguard standards and procedures.

The selected official(s), or point(s) of contact (POC(s)) must also be responsible for ensuring that internal

inspections are conducted, submission of required safeguard reports to the IRS, properly reporting any

data breach incidents, disclosure awareness training and for any necessary liaison with the IRS.

1.6 Safeguard Reviews

A safeguard review is an on-site, remote, or a combination of both (hybrid) evaluation of the use of FTI

and the measures employed by the receiving agency and its agents (where authorized) to protect the

data.

•

On-site reviews: Disclosure Enforcement Specialists (DES), Cybersecurity Reviewers (CSR),

and Management Officials will conduct an on-site evaluation of the security and privacy controls

implemented by the agency and all supporting parties. Assessment techniques include, but are

not limited to visual inspections, observations, interviews, document exchange, and automated

scanning.

•

Remote reviews: Disclosure Enforcement Specialists, Cybersecurity Reviewers, and

Management Officials will conduct a remote evaluation of the security and privacy controls

implemented by the agency and all supporting parties using secured collaborative technologies

(e.g., screen-sharing capabilities, teleconferences, video enabled software, etc.). Assessment

techniques include, but are not limited to visual inspections, observations, interviews, document

exchange, and automated scanning.

This review includes all FTI received whether from the IRS or a secondary source such as SSA, Bureau

of the Fiscal Service or another agency (see Federal Tax Information). Safeguard reviews are conducted

to determine the adequacy of safeguards as opposed to evaluating an agency’s programs. Several

factors will be considered when determining the need for a review, the type of review, and the frequency

of which a review will be conducted.

1.6.1 Before the Review

The IRS initiates the review by communication with an agency point of contact (POC) as reported by the

agency in the SSR. The preliminary discussion will be followed by a formal engagement letter to the

agency head, which provides official notification of the planned safeguard review.

This engagement letter outlines what the review will encompass. Additional requests for specific

information will be provided to the agency POC. These requests may include a list of records to be

reviewed (e.g., training manuals, flowcharts, policies, awareness program documentation and

organizational charts relating to the processing of FTI). Prior to the review, the agency POC will receive

information regarding the manner in which the review will be conducted (e.g., on-site and/or remote), the

scope and purpose of the review, a list of the specific areas to be reviewed and agency personnel to be

interviewed.

A Preliminary Security Evaluation (PSE) call will be held to determine the scope of the review (see NIST

Control PM-5 CE-1, Inventory of PII). The electronic flow of FTI will be discussed to provide the review

team with a thorough understanding of the location and use of FTI throughout the agency’s infrastructure.

During the call primary POCs will be introduced, the scope of the review will be defined, assessment

logistics will be discussed, and any questions will be answered. Participants should include agency IT

staff knowledgeable about the location and flow of FTI throughout the agency as well as staff or

contractors from other locations such as consolidated data centers. Additionally, mini-PSE calls for

contractors, sub-contractors, off-site locations, etc. may be needed to obtain additional information in

determining the review scope. Requests for additional information and clarification to include automated

scanning procedures will be discussed after the PSE call(s) and a proposed scope will be provided.

1.6.2 During the Review

The review process validates the accuracy of the SSR and conformance with the current version of

Publication 1075 requirements and National Institute of Standards and Technology (NIST) Special

Publication 800-53. At the opening conference, review procedures will be communicated, followed by a

data flow discussion, and confirming the flow of FTI (see NIST Control PM-5 CE-1, Inventory of PII).

Observing actual operations is a required step in the review process. Sites to be reviewed will be based

on the flow of the FTI, which may include, but are not limited to, field offices, consolidated data centers,

off-site storage facilities, disaster recovery sites, contractor and sub-contractor sites.

Review methods may include but are not limited to:

•

Spot check agency records for FTI

•

Employee interviews

•

Facility tours

•

Document review

•

Automated/manual testing (See Safeguards website for tools used for automated testing)

•

Remote assessment tools

Agencies must facilitate execution of the review methods utilized by Safeguards staff. Agency

management approval must be obtained prior to review, if agency policies and procedures contradict any

of these methods.

The agency POC will be advised the of critical issues and findings as the review progresses. A briefing

will be held with the POC to go over the Preliminary Findings Report (PFR) before the closing conference.

The closing conference is held upon completion of the agency’s review, where the PFR is issued to

provide the agency an overview of the findings identified during the review.

1.6.3 After the Review

An SRR and CAP will be issued within 45 days of the closing conference to document the review findings.

Requests for corrections to the SRR must be emailed to the SafeguardReports@irs.gov mailbox. The

Office of Safeguards will respond with an acknowledgement and a determination.

Each finding will be identified with a criticality level that identifies potential risk to loss, breach or

disclosure of FTI.

Safeguards Finding Criticality Definitions

Impact Level

Limited

Moderate

Significant

Critical

Definition

The potential impact is Limited if the vulnerability could be expected

to have a low or minimal adverse effect on the ability to maintain the

confidentiality and integrity of FTI.

The potential impact is Moderate if the vulnerability could be

expected to have a demonstratable adverse effect on the ability

to maintain the confidentiality and integrity of FTI.

The potential impact is Significant if the vulnerability could be

expected to have severe and/or imminent adverse effect on the ability

to maintain the confidentiality and integrity of FTI.

The potential impact is Critical if the vulnerability has an immediate

adverse effect on the confidentiality and integrity of FTI.

All findings must be addressed in a timely fashion. The Office of Safeguards will identify deadlines for

resolution based upon the risk associated with each finding. Outstanding issues must be resolved and

addressed in the next reporting cycle of the CAP.

If the Agency has any critical findings, the agency must submit a mitigation plan to Safeguards within 7

days from the closing conference date. Safeguards will report the critical findings along with your agency

plan to the Treasury Inspector General for Tax Administration (TIGTA).

The CAP must be updated and submitted semi-annually using the last CAP issued by the Office of

Safeguards (see Section 2.E.5, Corrective Action Plan) until all review findings are accepted as closed.

If an agency has a CAP due within 60 days of the review, that CAP is not required because the remaining

open findings will be handled as part of the upcoming on-site or remote Safeguard Review

Each CAP submission must include an explanation and/or evidence of actions already taken or planned

to resolve all outstanding findings. The agency must submit an actual or planned implementation date for

each outstanding finding.

1.7 Termination of FTI

1.7.1 Agency Request

1.7.1.1 Termination Documentation

When an agency no longer requires FTI, notify Safeguards at SafeguardReports@irs.gov by providing the

following:

1. Copies of notifications to all agencies from which FTI is received, that FTI will no longer be

requested, and

2. Letter from the Head of Agency certifying that all residual FTI has been destroyed. (See Section

2.F Disposal of FTI – IRC § 6103(p)(4)(F))

Once documentation is reviewed, the Office of Safeguards will send an acknowledgement of the agency’s

termination, instructions on Safeguard reporting and on-site review obligations. Instructions for

reinstatement will be included in the acknowledgement letter.

1.7.1.2 Archiving FTI Procedure

This section is for agencies terminating receipt of FTI but required by statute to retain FTI for designated

periods. If residual FTI is required to be retained by statute for a designated period (e.g., 5 or 10 years),

then agencies must:

•

Ensure that a currently authorized agency, contractors, or sub-contractor retain FTI in accordance

with Publication 1075 security standards

•

Provide copies of notifications as shown in Section 1.7.1.1, Termination Documentation

•

Submit an annual SSR each year while the agency has possession or oversight of the data

•

Continue to be subject to periodic Safeguard Reviews

•

Submit a letter from Head of Agency certifying that all residual FTI has been destroyed when the

retention period has ended

1.7.2 FTI Suspension, Termination and Administrative Review

The IRS may terminate or suspend disclosure of return and return information to any authorized recipient

under 6103(p)(4), if the IRS determines that:

1. The authorized recipient (or agency) has allowed an unauthorized inspection or disclosure of FTI

and has not taken adequate corrective action to prevent the recurrence of an unauthorized

inspection or disclosure; or

2. The authorized recipient does not satisfactorily maintain the safeguards prescribed by Section

6103(p)(4) and Publication 1075 and has made no adequate plan to improve its system to

maintain the safeguards satisfactorily.

Prior to terminating FTI, the IRS will notify the authorized recipient in writing and may suspend further

disclosures if it is deemed that federal tax administration would be seriously impaired.

Agencies in receipt of the termination or suspension letter may appeal the determination as outlined in

Exhibit 3, USC Title 26, CFR § 301.6103(p)(7)-1.

1.8 Reporting Improper Inspections or Disclosures

1.8.1 Terms

1.8.1.1 Data Incident

A data incident is an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the

integrity, confidentiality or availability of information or an information system; or (2) constitutes a violation

or imminent threat of violation of law, security policies, security procedures or acceptable use policies.

Incidental and inadvertent accesses are considered data incidents.

An incident involving the loss or theft of an IRS asset containing FTI, or the loss or theft of a physical

document that includes FTI, or the inadvertent disclosure of FTI, is known as a data breach. See the Data

Breach definition below. Often, an occurrence may be first identified as an incident, but later identified as

a data breach once it is determined that the incident involves FTI. This is often the case with a lost or

stolen laptop or electronic storage device.

1.8.1.2 Data Breach

A data breach is a type of incident involving a loss, theft, or inadvertent disclosure of FTI. A data breach is

defined as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any

similar occurrence where:

•

a person other than an authorized user accesses or potentially accesses FTI or,

•

an authorized user accesses or potentially accesses FTI for an unauthorized purpose.

A data breach is not limited to an occurrence where a person other than an authorized user potentially

accesses FTI by means of a network intrusion, a targeted attack that exploits website vulnerabilities, or

an attack executed through an email message or attachment. A data breach may also include the loss or

theft of physical documents that include FTI and portable electronic storage media that store FTI, the

inadvertent disclosure of FTI on a public website or an oral disclosure of FTI to a person who is not

authorized to receive that information. It may also include an authorized user accessing FTI for an

unauthorized purpose.

Some common examples of a data breach include:

•

A laptop or portable storage device storing FTI is lost or stolen.

•

An email containing FTI is inadvertently sent to the wrong person.

•

A box of documents with FTI is lost or stolen during shipping.

•

An unauthorized third party overhears agency employees discussing FTI.

•

A user with authorized access to FTI sells it for personal gain or disseminates it.

•

An IT system that maintains FTI is accessed by a malicious actor.

•

FTI is posted inadvertently on a public website.

1.8.2 General

A written policy must be established and distributed that covers incident management. The policy must

clearly state the actions that will be taken for the improper inspection or disclosure of FTI. Upon

discovering a possible improper inspection or disclosure of FTI, including breaches and incidents, by a

federal employee, a state employee or any other person, the individual making the observation or

receiving information must contact the local Treasury Inspector General for Tax Administration (TIGTA)

Field Division office, to the Special Agent-in-Charge, immediately, but no later than 24 hours after

identification of a possible issue involving FTI. See NIST IR-6, Incident Reporting and IR-8, Incident

Response Plan.

Local TIGTA Field Division Office contact information can be found on the TIGTA website at

https://www.treasury.gov/tigta/oi_office.shtml.

If unable to contact the local TIGTA Field Division, contact the Hotline Number.

Hotline Number:

800-366-4484 during normal working hours for immediate assistance.

Note: After regular business hours, call 800-589-3718. This number reaches

an answering service which answers all calls from all locations in the United

States 24 hours a day 7 days a week. The answering service will contact the

on-call TIGTA agent.

TIGTA Homepage:

https://www.treasury.gov/tigta

Mailing Address:

Treasury Inspector General for Tax Administration

Ben Franklin Station

P.O. Box 589

Washington, DC 20044-0589

For intrusions, manipulations or compromises of computer networks, as well as external cyber-based

actions that interfere with the IRS’s ability to conduct electronic tax administration, or any breach that

involves unauthorized disclosure within an IT environment, contact TIGTA Electronic Crimes &

Intelligence Division at cybercrimes@tigta.treas.gov .

Information spillage refers to instances where FTI is inadvertently placed on systems that are not

authorized to handle FTI or are not part of the agency's intended FTI workflow. Upon discovery, corrective

action is required to remove the FTI from the unintended system and ensure there were no unauthorized

accesses or disclosures. If no FTI is involved, then there is no need to report the spill to the Office of

Safeguards or TIGTA. If the agency cannot show FTI was not involved within that 24-hour period, then

the spill will need to be reported to the Office of Safeguards and TIGTA.

1.8.3 Office of Safeguards Notification Process

Concurrent to notifying TIGTA, the agency must notify the Office of Safeguards by email to Safeguards

mailbox, safeguardreports@irs.gov. To notify the Office of Safeguards, the agency must document the

specifics of the incident or breach known at that time into a data incident report, including but not limited

to:

•

Name of agency and agency POC for resolving data incident with contact information

•

Date and time the incident/breach occurred

•

Date and time the incident/breach was discovered

•

How the incident/breach was discovered

•

Description of the incident/breach and the data involved, including specific data elements, if

known

•

Potential number of FTI records involved; if unknown, provide a range if possible

•

Address where the incident/breach occurred

•

IT involved (e.g., laptop, server, mainframe)

•

Does the incident involve an unauthorized access or disclosure by an agency employee? (Y/N)

•

If a criminal indictment is not pursued, will a disciplinary or adverse action be proposed against

the agency employee involved in this unauthorized access or disclosure? (Y/N)

Reports must be sent electronically and encrypted via IRS-approved encryption techniques as outlined in

Section 2.E.3, Encryption Requirements. Use the term “data incident report” in the subject line of the

email. Do not include any FTI in the data incident report.

Even if all information is not available, immediate notification is the most important factor, not the

completeness of the data incident report. Additional information must be provided to the Office of

Safeguards as soon as it is available.

The agency will cooperate with TIGTA and Office of Safeguards investigators, providing data and access

as needed to determine the facts and circumstances of the incident.

1.8.4 Incident Response Procedures

In the event of an unauthorized disclosure or data breach, the agency must contact TIGTA and the IRS

immediately. Both TIGTA and the IRS must be contacted within 24 hours of the discovery of the

disclosure or breach. The agency must not wait to conduct an internal investigation to determine if FTI

was involved. Any internal investigation conducted by the agency should not delay the timely reporting of

the disclosure or breach.

Incident response policies and procedures required in NIST Control IR-1, Incident Response Policy and

Procedure, must be used when responding to an identified unauthorized disclosure or data breach

incident.

The Office of Safeguards will coordinate with the agency regarding appropriate follow-up actions required

to be taken by the agency to ensure continued protection of FTI. Once the incident has been addressed,

the agency will conduct a post-incident review to ensure the incident response policies and procedures

provide adequate guidance. Any identified deficiencies in the incident response policies and procedures

must be resolved as soon as reasonably possible. Additional training on any changes to the incident

response policies and procedures must be provided to all employees, including contractors, subcontractors and consolidated data center employees, immediately. See NIST Control IR-4, Incident

Handling for additional information.

The agency must test the incident response capability annually using tabletop exercises to determine the

incident response effectiveness and document the results. See NIST Control IR-3, Incident Response

Testing.

The agency must track and document system security and privacy incidents. See NIST Control IR-5,

Incident Monitoring.

1.8.5 Incident Response Notification to Impacted Individuals

The agency must provide written notification to a taxpayer whose FTI was subject to unauthorized access

or disclosure when a disciplinary or adverse action is proposed against the agency employee responsible.

The required written notification to the taxpayer must include the date of the unauthorized inspection or

disclosure and the rights of the taxpayer under IRC § 7431.

The agency must confirm to the Office of Safeguards when the required written notification to the taxpayer

is completed. In addition, the agency must inform the Office of Safeguards of any pending media releases,

including sharing a draft of the release, prior to distribution.

1.9 Disclosure to Other Persons

1.9.1 General

Disclosure of FTI is prohibited unless authorized by statute. Agencies with access to FTI are not allowed

to make further disclosures of that information to their agents, contractor, or sub-contractor unless

authorized by statute. See NIST Control AC-21, Information Sharing.

Agencies must use specific language in their contractual agreements that clearly state the requirements

necessary to protect the confidentiality of FTI and avoid ambivalence or ambiguity (see the model

language of Exhibit 7). For additional requirements on contracts, see Exhibit 6, Contractor 45-Day

Notification Procedures.

Absent specific language in the IRC or where the IRC is silent in authorizing an agency to make further

disclosures, the IRS’s position is that further disclosures are unauthorized.

1.9.2 Authorized Disclosure Precautions

When disclosure of FTI is authorized, the agency must take certain precautions prior to redisclosure to a

contractor or sub-contractor, namely:

•

Has the IRS been given sufficient notice prior to releasing FTI to a contractor or sub-contractor?

•

Has the agency been given reasonable assurance through a visitation or received a report

certifying that all security standards (physical and IT systems) have been addressed?

•

Does the contract authorizing the disclosure of FTI have the appropriate safeguard language?

See the model language of Exhibit 7, Safeguarding Contract Language.

Agencies must fully report to the IRS in their SSRs all disclosures of FTI to contractors and subcontractors. Any additional disclosures to contractors and sub-contractors must be reported using the

Notification process and reported on the next annual SSR.

An agency may not contract for the disclosure of FTI that is not authorized by IRC § 6103. Only contracts

for services that require access to FTI to perform their duties under the contract are required to comply

with these standards.

1.9.3 External Personnel Security

An external provider refers to organizations other than the agency operating or acquiring the system.

External providers include, for example, contractors or sub-contractors and other organizations providing

system development, information technology services, outsourced applications, testing/assessment

services and network and security management. Agencies must include personnel security requirements

in contracts. External providers may have personnel working at agency facilities with credentials, badges

or system privileges. Notifications of external personnel changes ensure appropriate termination of

privileges and credentials. See NIST Control PS-7, External Personnel Security.

1.9.4 Disclosing FTI to Contractors or Sub-Contractors

The agency must notify the Office of Safeguards prior to re-disclosing FTI to contractors or subcontractors. The agency must notify and obtain written approval from the Office of Safeguards prior to redisclosing FTI to sub-contractors (when the agency’s contractor uses or desires to re-disclose FTI to

another contractor). See Section 2.E, Reporting Requirements - 6103(p)(4)(E) and Section 2.E.6,

Notification Reporting Requirements, for additional information.

In addition to the notification, the agency must:

•

Establish privacy roles and responsibilities for contractors or sub-contractors and service

providers to safeguard the confidentiality and integrity of FTI.

•

Include privacy requirements in contracts and other acquisition-related documents.

•

Share FTI externally only for the purposes statutorily authorized.

•

Where appropriate, enter into a contract, an SLA, memoranda of understanding, memoranda of

agreement, letters of intent, computer matching agreement or similar agreement, with third

parties that specifically describe the FTI covered and specifically enumerate the purposes for

which the FTI may be used.

•

Monitor, audit and train its staff on the authorized uses and sharing of FTI with third parties and

on the consequences of unauthorized use or sharing of FTI.

•

Require agency notification of contractor or sub-contractor personnel changes to ensure

appropriate termination of privileges and credentials. See NIST Control PS-7, External Personnel

Security.

•

Evaluate any proposed new instances of sharing FTI with third parties to assess whether they are

authorized.

•

Require contractor or sub-contractor employ a formal sanction process for contractor employees

and, when permitted by statute, sub-contractor employees failing to comply with established

information security policies and procedures for FTI. Notification of designated agency personnel

is required within 72 hours.

If the agency requires the use of a contractor to conduct tax modeling, revenue estimation or other

statistical activities, 45-day notification requirements apply (see Section 1.9.4, Disclosing FTI to

Contractors).

The Taxpayer First Act § 2004, which added IRC § 6103(p)(9), formalizes in statute the following agency

requirements effective December 31, 2022:

• Agencies must require that contractors, sub-contractors, or other agents have requirements in effect

to provide safeguards required under IRC § 6103(p)(4) to protect FTI.

• The Taxpayer First Act also codifies agency responsibilities to conduct on-site reviews of

contractors, sub-contractors, and other agents and provide the findings of these reviews to

Safeguards as part of the report required under IRC § 6103(p)(4)(E).

• Agencies will provide the Office of Safeguards with an annual certification that each contractor, subcontractor, or other agent is in compliance with the above requirements. This certification will be

included as part of the report required under IRC § 6103(p)(4)(E).

•

Agency requirements for this new legislation will be issued prior to implementation in the form of

an Interim Guidance memorandum.

1.9.5 Re-Disclosure Agreements

When required regulatory prerequisite steps are satisfied and where appropriate, under the authority of

IRC § 6103(p)(2)(B), the IRS may execute an agreement with an agency that authorizes the re-disclosure

of FTI to another entity. These agreements are negotiated and approved by IRS Disclosure with

concurrence of the Office of Safeguards.

Agreements must include language to enforce the requirements for:

•

Incident reporting related to FTI

•

Implementing personnel sanctions for failure to comply with established information security

policy and procedures related to FTI

•

Confirmation to the agency any proposals of disciplinary and adverse action concerning

unauthorized accesses and disclosures involving FTI

•

Notification of individuals whose FTI was subject to unauthorized access or disclosure including

the date the unauthorized access or disclosure of FTI occurred.

Federal agencies authorized by statute to enter into re-disclosure agreements are required to provide a

list of all executed agreements annually in the SSR. When requested by the Office of Safeguards,

agencies must provide a copy of all re-disclosure agreements within 30 days. An electronic copy must be

sent to the Office of Safeguards via SDT. If SDT is not available, the agreements may be emailed to the

SafeguardReports@irs.gov mailbox.

1.10 Return Information in Statistical Reports

1.10.1 General

IRC § 6103 authorizes the disclosure of FTI to specific federal agencies for use in statistical reports, tax

administration purposes and certain other purposes specified in IRC § 6103(j). Statistical reports may

only be released in a form that cannot be associated with, or otherwise identify, directly or indirectly, a

particular taxpayer.

Agencies authorized to produce statistical reports must adhere to the following guidelines or an

equivalent alternative that has been approved by the IRS:

•

Access to FTI must be restricted to authorized personnel.

•

No statistical tabulation may be released outside the agency with cells containing data from fewer

than three returns. The exception to this rule is for corporation returns where no tabulation with

cells containing data for fewer than five returns may be released.

•

Statistical tabulations prepared at the state level may not be released for cells containing data for

fewer than 10 returns. Data for geographic areas below the state level such as county may not be

released with cells containing data from fewer than 20 returns. In addition, for tabular data at the

ZIP Code level, additional procedures must be employed. Individual ZIP Code areas with fewer

than 100 returns cannot be shown. Additionally, any cell in the ZIP Code table based on fewer

than 20 returns cannot be shown. Finally, individual returns that represent a large percentage of

the total of a particular cell must be excluded from the data.

•

Tabulations that would pertain to specifically identified taxpayers or that would tend to identify a

particular taxpayer, either directly or indirectly, may not be released.

1.10.2 Making a Request under IRC § 6103(j)

Federal agencies seeking statistical information from the IRS must make their requests under IRC

§ 6103(j). The requests must be addressed to:

Director, Statistics of Income Division

Internal Revenue Service, OS:P:S

1111 Constitution Avenue, NW

Washington, D.C. 20224

1.10.3 State Tax Agency Statistical Analysis

State tax agencies must provide written notification and obtain IRS approval prior to performing tax

modeling, revenue estimation or other statistical activities involving FTI. The agency must demonstrate

that the activity is required for tax administration purposes. The agency must adhere to the following

process to submit a request:

1. Contact the local IRS disclosure manager 2 and complete a Need and Use Justification for

Federal Tax Information Form.

2. The completed and signed form must be returned to the IRS disclosure manager for review and

approval. The Office of Safeguards will be notified by the IRS disclosure manager of the request

and approval.

3. Changes to the terms of the statistical analysis activities documented in the form must be

submitted to the IRS Office of Safeguards as part of the annual SSR (see Section 1.4, State Tax

Agency Limitations and Section 2.E.4, Safeguard Security Report).

4. Updates to the form must be made as requested by the IRS disclosure manager.

If the agency requires the use of a contractor to conduct tax modeling, revenue estimation or other

statistical activities, 45-day notification requirements apply (see Section 1.9.4, Disclosing FTI to

Contractors).

2 Refer to https://www.irs.gov/privacy-disclosure/irs-freedom-of-information for contact information.

2.0 PHYSICAL SECURITY REQUIREMENTS

2.A Recordkeeping Requirement – IRC § 6103(p)(4)(A)

2.A.1 General

Federal, state and local agencies, bodies, commissions and agents authorized under IRC § 6103 to

receive FTI are required by IRC § 6103(p)(4)(A) to establish a permanent system of standardized records

of requests made by or to them for disclosure of FTI. For additional guidance, see Exhibit 2, USC Title 26,

IRC § 6103(p)(4).

This recordkeeping must include internal requests among agency employees as well as requests outside

of the agency. These records are required to track the movement of FTI. The records are to be

maintained for a minimum of five (5) years. The Safeguards website contains guidance, job aids, helpful

tools and frequently asked questions to assist agencies in meeting safeguard requirements; see

http://www.irs.gov/uac/Safeguards-Program.

2.A.2 Logs of FTI (Electronic and Non-Electronic Receipts)

The agency must establish a tracking system to identify and track the location of electronic and nonelectronic FTI from receipt until it is destroyed. The FTI log may include the following tracking elements:

•

Taxpayer Identifier*

•

Tax year(s)

•

Type of information (e.g., revenue agent reports, Form 1040, work papers)

•

The reason for the request

•

Date requested

•

Date received

•

Exact location of the FTI

•

Who has had access to the data

•

If disposed of, the date and method of disposition

*To the extent possible, do not include FTI in the log. If FTI is used, the log must be secured in

accordance with all other safeguarding requirements.

If the authority to make further disclosures is present (e.g., agents/contractors/sub-contractors),

information disclosed outside the agency must be recorded on a separate list or log. The log must:

•

Reflect to whom the disclosure was made

•

What was disclosed

•

Why it was disclosed

•

When it was disclosed

Agencies transmitting FTI from one mainframe computer to another, as in the case of the SSA sending

FTI to state human services agencies, need only identify the bulk records transmitted. This identification

will contain the approximate number of taxpayer records, the date of the transmissions, the best possible

description of the records and the name of the individual making/receiving the transmission.

Figure 1 – Sample FTI Logs

FTI Log

Date

Requested

Date

Received

Taxpayer

Identifier

Tax

Year(s)

Type of

Information

Reason

for

Request

Exact

Location

Who

has

access?

Disposition

Date

Disposition

Method

Recipient/Title

Location

Disposition

Date

Disposition

Method

FTI Bulk Transfer Log

Date

Received

Control

Number/File

Name

Content

(do not

include

FTI)

Recipient/Title

Location

Number

Records

Movement

Date

2.A.3 Converted Media

Conversion of FTI from paper to electronic media (scanning) or from electronic media to paper (print

screens or printed reports) also requires tracking from creation to destruction of the converted FTI. All

converted FTI must be tracked on logs containing the fields detailed in Section 2.A.2, Logs of FTI,

(Electronic and Non-Electronic Receipts) depending upon the current form of the FTI, electronic or nonelectronic.

2.A.4 Recordkeeping of Disclosures to State Auditors

When disclosures are made by a state tax agency to state auditors, recordkeeping requirements pertain

only in instances where the auditors use FTI for further scrutiny and inclusion in their work papers. In

instances where auditors read large volumes of records containing FTI, whether in paper or electronic

format, the state tax agency need only identify bulk records examined. This identification will contain the

approximate number of taxpayer records, the date of inspection, a description of the records and the

name of the individual(s) making the inspection. Recordkeeping log samples are provided in Section

2.A.2, Logs of FTI, (Electronic and Non-Electronic Receipts).

Disclosure of FTI to auditors external to child support enforcement, human services or labor benefit

agencies is not authorized by statute. FTI in case files must be removed prior to access by the auditors.

2.B Secure Storage – IRC § 6103(p)(4)(B)

2.B.1 General

Security may be provided for a document, an item, or an area in several ways. These include but are not

limited to locked containers of various types, vaults, locked rooms, locked rooms that have reinforced

perimeters, locked buildings, guards, electronic security systems, fences, identification systems and

control measures.

How the required security is provided depends on the facility, the function of the activity, how the activity

is organized and what equipment is available. Proper planning and organization will enhance the security

while balancing the costs.

The IRS has categorized federal tax information as moderate risk. The minimum protection standards

(MPS) must be used as an aid in determining the method of safeguarding FTI. These controls are

intended to protect FTI in paper and electronic form.

2.B.2 Minimum Protection Standards

MPS establishes a uniform method of physically protecting data and systems as well as non-electronic

forms of FTI. This method contains minimum standards that will be applied on a case-by-case basis.

Because local factors may require additional security measures, management must analyze local

circumstances to determine location, container, and other physical security needs at individual facilities.

MPS have been designed to provide management with a basic framework of minimum-security

requirements.

The objective of these standards is to prevent unauthorized access to FTI. MPS thus requires two

barriers. Example barriers under the concept of MPS are outlined in the following table. Each topic

represents one barrier and must be used as a starting point to identify two barriers of MPS to protect FTI.

Table 1 – Minimum Protection Standards

Secured Perimeter

The perimeter is enclosed by slab-to-slab walls constructed of durable

materials and supplemented by periodic inspection. Any lesser-type partition

must be supplemented by electronic intrusion detection and fire detection

systems. All doors entering the space must be locked in accordance with

Locking Systems for Secured Areas. In the case of a fence/gate, the fence

must have intrusion detection devices or be continually guarded, and the

gate must be either guarded or locked with intrusion alarms.

Security Room

A security room is a room that has been constructed to resist forced entry.

The entire room must be enclosed by slab-to-slab walls constructed of

approved materials (e.g., masonry brick, concrete) and supplemented by

periodic inspection and entrance must be limited to specifically authorized

personnel. Door hinge pins must be non-removable or installed on the inside

of the room.

Badged Employee

During business hours, if authorized personnel serve as the second barrier

between FTI and unauthorized individuals, the authorized personnel must

wear picture identification badges or credentials. The badge must be clearly

displayed and worn above the waist.

Security Container

A security container is a storage device (e.g., turtle case, safe/vault, locked

IT cabinet) with a resistance to forced penetration, and a security lock with

controlled access to keys or combinations.

The MPS or “two-barrier” rule applies to FTI, beginning at the FTI itself and extending outward to

individuals without a need-to-know. MPS provides the capability to deter, delay or detect surreptitious

entry. Protected information must be containerized in areas where unauthorized employees may have

access after-hours.

As an example, an agency often desires or requires that security personnel, custodial service workers, or

landlords for non-government-owned facilities have access to locked buildings and rooms. This may be

permitted if there is a second barrier to prevent access to FTI. A security guard, custodial services worker

or landlord may have access to a locked building or a locked room if FTI is in a locked security container.

If FTI is in a locked room but not in a locked security container, the guard, janitor, or landlord may have a

key to the building but not the room.

Additional controls have been integrated into this document that map to NIST Special Publication (SP)

800-53 Revision 5. These are identified in Section 4.0, NIST 800-53 Security and Privacy Controls. Per

NIST guidelines, policies and procedures must be developed, documented and disseminated, as

necessary, to facilitate implementing physical and environmental protection controls.

Multifunction Devices (MFDs) or High-Volume Printers must be locked with a mechanism to prevent

physical access to the hard disk or meet MPS.

For additional guidance, see NIST Control PE-3, Physical Access Control.

2.B.3 Restricted Area Access

Care must be taken to deny unauthorized access to areas containing FTI during duty and non-duty hours.

This can be accomplished by creating restricted areas, security rooms or locked rooms. Additionally, FTI

in any form (computer printout, photocopies, tapes, notes) must be protected during non-duty hours. This

can be done through a combination of methods, including secured or locked perimeter, secured area or

containerization.

A restricted area is an area where entry is limited to authorized personnel (individuals assigned to the

area). All restricted areas must either meet secured area criteria or provisions must be made to store FTI

in appropriate containers during non-duty hours. Using restricted areas is an effective method for

eliminating unnecessary traffic through critical areas, thereby reducing the opportunity for unauthorized

access, disclosure, or theft of FTI. All the following procedures must be implemented to qualify as a

restricted area.

Restricted areas will be prominently posted and separated from non-restricted areas by physical barriers

that control access. The number of entrances must be kept to a minimum and must have controlled

access (e.g., electronic access control, key access, door monitor) to prevent unauthorized entry. The

main entrance must be controlled by locating the desk of a responsible employee at the entrance to

ensure that only authorized personnel with an official need may enter.

2.B.3.1 Visitor Access Logs

A visitor access log must be maintained at a designated entrance to a restricted area and all visitors

(persons not assigned to the area) entering the area shall be directed to the designated entrance.

Prior to accessing areas that contain FTI, a visitor must sign a visitor access log. The security personnel

must validate the person’s identity by examining government-issued identification (e.g., state driver’s

license or passport). The security personnel must compare the name and signature entered in the access

log with the name and signature of the government-issued identification. When leaving the area, the

security personnel or escort must enter the visitor’s time of departure.

The visitor access log must require the visitor to provide the following information:

•

Name and organization of the visitor

•

Signature of the visitor

•

Form of identification

•

Date of access

•

Time of entry and departure

•

Purpose of visit

•

Name and organization of person visited

Each restricted area access log must be closed out at the end of each month and reviewed by

management. Visitor access logs must be retained for five (5) years, see Exhibit 9, Table 9.

Figure 2 – Visitor Access Log

Visitor Access Log

Date

Name & Org of

Visitor

Form of

Visitor ID

Purpose

of Visit

Name & Org of

Person Visited

Time of

Entry

Time of

Departure

Signature of Visitor

2.B.3.2 Authorized Access List

To facilitate the entry of employees/vendor/contractor/non-agency personnel who have a frequent and

continuing need to enter a restricted area, but who are not assigned to the area, an Authorized Access

List (AAL) can be maintained so long as MPS are enforced. See Section 2.B.2, Minimum Protection

Standards.

The AAL must contain the following:

•

Name of employee/vendor/contractor/non-agency personnel

•

Agency or department name

•

Name and phone number of the agency POC authorizing access

•

Address of agency/vendor/contractor

•

Purpose and level of access

AAL must be reviewed monthly or upon occurrence or potential indication of an event such as a possible

security breach or personnel change.

If there is any doubt of the identity of the individual, the security monitor must verify the identity of the

individual against the AAL prior to allowing entry into the restricted area.

For additional guidance, see NIST Control PE-2, Physical Access Authorizations. Also, see NIST Control

PE-16, Delivery and Removal, for guidance on controlling information system components entering and

exiting the restricted area.

2.B.3.3 Controlling Access to Areas Containing FTI

Management or a designee must maintain an authorized list of all personnel who have access to

information system areas, where these systems contain FTI. This does not apply to those areas within the

facility officially designated as publicly accessible.

The agency must maintain a policy addressing issuance of appropriate authorization credentials,

including badges, identification cards or smart cards. This policy must include proper use and

accountability requirements.

In addition, a list must be maintained that identifies those individuals who have authorized access to any

systems where FTI is housed. Access authorizations and records maintained in electronic form are

acceptable.

Each agency must control physical access to the information system devices that display FTI information

or where FTI is processed to prevent unauthorized individuals from observing the display output. For

additional information, see NIST Control PE-5, Access Control for Output Devices.

The agency or designee must monitor physical access to the information system where FTI is stored to

detect and respond to physical security incidents. For additional information, see NIST Control PE-6,

Monitoring Physical Access.

For all areas that process FTI, the agency must position information system components within the facility

to minimize the opportunity for unauthorized access.

When cleaning and facility maintenance personnel work in restricted areas containing unsecured FTI,

those activities must be performed in the presence of an authorized employee.

The agency must establish a process for maintenance personnel authorization and maintain a list of

authorized maintenance organizations or personnel. The agency must verify that non-escorted personnel

performing maintenance on the system possess the required access authorizations and if not, then the

agency must designate organizational personnel with required access authorizations and technical

competence to supervise the maintenance activities. See NIST MA-5, Maintenance Personnel.

Allowing an individual to “piggyback” or “tailgate” into restricted locations must be prohibited and

documented in agency policy. The agency must ensure that all individuals entering an area containing

FTI do not bypass access controls or allow unauthorized entry of other individuals. Unauthorized access

must be challenged by authorized individuals (e.g., those with access to FTI). Security personnel must be

notified of piggyback/tailgate attempts.

2.B.3.4 Control and Safeguarding Keys and Combinations

All containers, rooms, buildings, and facilities containing FTI must be locked when not in actual use.

Access to a locked area, room or container can be controlled only when the key or combination is

controlled. Compromising a combination or losing a key negates the security provided by that lock.

Combinations to locks must be changed annually or when an employee who knows the combination

retires, terminates employment or transfers to another position.

Combinations must be given only to those who have a need to have access to the area, room or

container and must never be written on a sticky-note, calendar pad or any other item (even though it is

carried on one’s person or hidden from view). An envelope containing the combination must be secured

using the same security measures for the envelope as the locked material.

Access control measures (keys, proximity cards, combinations) must be issued only to individuals having

a need to access an area, room, or container. Inventory records must be maintained and must account

for the total number of keys, proximity cards, combinations, etc. that are available and issued. The

inventory must account for master keys and key duplicates. An annual reconciliation must be done on all

key records.

The number of keys or persons with knowledge of the combination to a secured area must be kept to a

minimum. Keys and combinations will be given only to those individuals who have a frequent need to

access the area.

2.B.3.5 Locking Systems for Secured Areas

Access control systems (e.g., badge readers, smart cards, and biometrics) that provide the capability to

audit access control attempts must maintain access control logs with successful and failed access

attempts to secure areas containing FTI or systems that process FTI. Agency personnel must review

access control logs on a monthly basis. The access control log must contain the following elements:

•

Owner of the access control device requesting access

•

Success/failure of the request

•

Date and time of the request

2.B.4 FTI in Transit

Handling FTI must be such that the FTI does not become misplaced or available to unauthorized

personnel.

Any time FTI is transported from one location to another, care must be taken to provide appropriate

safeguards. When FTI is hand-carried by an individual in connection with a trip or in the course of daily

activities, it must be kept with that individual and protected from unauthorized disclosures.

All shipments of paper or electronic FTI (including compact disk [CD], digital video disk [DVD], thumb

drives, hard drives, tapes and microform) must be documented on a transmittal form and monitored to

ensure that each shipment is properly and timely received and acknowledged. All FTI transported through

the mail or courier/messenger service must be double-sealed; that is, one envelope within another

envelope. The inner envelope must be marked confidential with some indication that only the designated

official or delegate is authorized to open it. The outermost envelope must not be labeled as FTI or provide

any indication that the contents contain FTI, since that may actually increase risk to the contents.

2.B.4.1 Security During Office Moves

When it is necessary for an office to move to another location, plans must be made to protect and

account for all FTI properly. FTI must be in locked cabinets or sealed packing cartons while in transit.

Using sealed boxes serves the same purpose as double-sealing and prevents anyone from viewing the

contents. FTI must remain in the custody of an agency employee and accountability must be maintained

to ensure that cabinets or cartons do not become misplaced or lost during the move.

2.B.5 Physical Security of Computers, Electronic and Removable Media

Computers and electronic media (including telephones using Voice Over Internet Protocol [VOIP]) that

receive, process, store, access, protect and/or transmit FTI must be in a secure area with restricted

access. In situations when requirements of a secure area with restricted access cannot be maintained,

such as home work sites, remote terminals or other office work sites, the equipment must receive the

highest level of protection practical, including full disk encryption. All computers and mobile devices that

contain FTI and reside at an alternate work site must employ encryption mechanisms to ensure that FTI

may not be accessed if the computer is lost or stolen.

Basic security requirements must be met, such as keeping FTI locked up when not in use. When

removable media contains FTI, it must be labeled as FTI.

All computers, electronic media and removable media containing FTI must be kept in a secured area

under the immediate protection and control of an authorized employee or locked up. When not in use, the

media must be promptly returned to a proper storage area/container.

Inventory records of computers, electronic and removable media must be maintained and reviewed semiannually for control and accountability. Section 2.A, Recordkeeping Requirement, contains additional

information. For additional guidance on log retention requirements, see Exhibit 9, Record Retention

Schedules.

For physical security protections of transmission medium (e.g., cabling), see NIST Control PE-4, Access

Control for Transmission.

2.B.6 Media Off-Site Storage Requirements

Media containing FTI that is sent to an off-site storage facility must be properly secured, labeled, and

always protected from access by unauthorized individuals. The media may not be stored on open

shelving, unless the shelving is in a restricted area (see Section 2.B.3, Restricted Area Access)

accessible only to individuals with authorized access to FTI. The agency must ensure that contractoroperated off-site storage facilities maintaining FTI on open shelving comply with all safeguarding

requirements (e.g., visitor access logs, internal inspections, contractor access restrictions, and employee

training) and the contract must include Exhibit 7 safeguarding language. These facilities are subject to

IRS safeguard reviews.

Agencies that do not have the statutory authority to contract for services that involve the disclosure of FTI

(e.g. state Human Services and certain workforce agencies not receiving data under 6103(d)), may not

allow the release of media containing FTI to a contractor-operated off-site storage facility unless the

following conditions are met:

•

The media is encrypted and labeled as containing “federal tax information”

•

The media is locked in a turtle case or security container

•

The agency retains the key to the turtle case

2.B.7 Alternate Work Site

If the confidentiality of FTI can be adequately protected, telework sites such as employee’s homes or

other non-traditional work sites can be used. FTI remains subject to the same safeguard requirements

and the highest level of attainable security. All the requirements of Section 2.B.5, Physical Security of

Computers, Electronic and Removable Media, apply to alternate work sites.

2.B.7.1 Equipment

The agency must retain ownership and control for all hardware, software and end-point equipment

connecting to public communication networks, where these are present at alternate work sites. The use of

virtual desktop infrastructure with non-agency-owned devices (including personally owned devices) is an

acceptable alternative, where all requirements in Section 3.3.7 Virtual Desktop Infrastructure are met.

Employees must have a specific room or area in a room that has the appropriate space and facilities for

the type of work done. Employees also must have a way to communicate with their managers or other

members of the agency if security problems arise.

The agency must ensure employees have access to locking file cabinets or desk drawers so that

documents, disks, and tax returns may be properly secured when not in use. If agency furniture is not

furnished to the employee, the agency must ensure that an adequate means of storage exists at the

alternate work site. The agency must provide “locking hardware” to secure automated data processing

equipment to large objects, such as desks or tables. Smaller, agency-owned equipment must be locked in

a filing cabinet or desk drawer when not in use.

2.B.7.2 Storing Data

FTI may be stored on hard disks only if agency-approved security access control devices

(hardware/software) have been installed, are receiving regularly scheduled maintenance including

upgrades and are being used. Access controls must include password security, an audit trail, encryption,

virus detection and data overwriting capabilities.

2.B.7.3 Other Safeguards

Only agency-approved security access control devices and agency-approved software will be used. Use

of illegal and/or non-approved software is prohibited. Electronic media that is to be reused must follow

media sanitization requirements.

The agency must maintain a policy for the security of alternative work sites. The agency must coordinate

with the managing host system(s) and any networks and maintain documentation on the test. Before

implementation, the agency must certify that the security controls are adequate for security needs.

Additionally, the agency must develop and disseminate rules and procedures to ensure that employees

do not leave computers unprotected at any time. These rules must address brief absences while

employees are away from the computer.

The agency must provide specialized training in security, disclosure awareness and ethics for all

participating employees and managers. This training must cover situations that could occur as the result

of an interruption of work by family, friends, or other sources.

2.C Restricting Access – IRC § 6103(p)(4)(C)

2.C.1 General

Agencies are required by IRC § 6103(p)(4)(C) to restrict access to FTI to only persons whose duties or

responsibilities require access (see Exhibit 2, USC Title 26, IRC § 6103(p)(4) and Exhibit 4, Sanctions for

Unauthorized Disclosure). To assist with this requirement, FTI must be clearly labeled and handled in

such a manner that it does not become misplaced or available to unauthorized personnel. Additionally,

warning banners advising of safeguarding requirements must be used for computer screens (see Section

4.14 Program Management (PM) and Exhibit 8, Warning Banner Examples).

Auditing controls, with the capability to generate records, to detect browsing within all systems that

receive, process, store, access, protect and/or transmit FTI (i.e., TDS, case management systems, etc.)

must be implemented. See NIST Sections AU-6 Audit Review, Analysis and Reporting, AU-7, Audit

Reduction and Report Generation and AU-12, Audit Generation, for additional requirements.

To understand the key terms of access, unauthorized disclosure, unauthorized access and need-to-know,

see section on Key Definitions.

2.C.2 Policies and Procedures

Agencies must maintain the following policies and procedures relating to the safeguarding of FTI. For

policies and procedures to be current, they need to have been updated or revalidated within the last three

(3) years.

•

Alternate Work Site – See Section 2.B.7 Alternate Work Sites

If permitted, a policy/procedure must address the security of FTI at alternate work sites. A policy

is required even if alternate work sites are prohibited.

•

Email – See Section 3.3.2 Email Communications

A policy/procedure must address the proper protection of FTI when transmitted by email, or if

emailing of FTI is not allowed, a policy must state that it is prohibited.

•

Facsimile - See Section 3.3.3 Facsimile and Facsimile Devices

A policy/procedure must address the proper protection of FTI when transmitted by facsimile, or if

facsimile transmission of FTI is not allowed, a policy must state that it is prohibited.

•

Employee Badge – See Section 2.B.2 and Table 1 Minimum Protection Standards

The policy/procedures must address when employees serve as secondary barriers for

safeguarding FTI, picture identification badges or credentials must be visible and worn above the

waist.

•

FTI Disposal/Destruction – See Sections 2.A.2 FTI Logs, (Electronic and Non-Electronic

Receipts), 2.F.3 Destruction and Disposal, 2.F.4 Other Precautions and 2.F.3.1 Media

Sanitization

The policy/procedures must address the proper safeguarding of FTI including the tracking and the

schedule/method of disposal or destruction.

•

Incident Response – See NIST Control IR-1 and Sections 1.8.4 Incident Response Procedures

The policy/procedures must include the proper response to identified unauthorized disclosure or

data breach incidents.

•

Internal Inspections – See Sections 2.D.3 Internal Inspections and 2.D.9 Plan of Action and

Milestones

The policy/procedures must include a documented schedule to ensure that all internal inspections

are conducted timely. Additionally, a POA&M must be developed and monitored, including

tracking the corrective actions identified during the internal inspections and identified actions

planned to resolve the findings.

•

Restricting Use of Personally Owned Computers – See Section 2.B.7.1 Equipment

The policy/procedures must include only agency-owned computers, media and software used to

process, access and store FTI.

•

Disclosure Awareness, Security and Privacy, Role-Based and Contingency Training – See

Sections 2.D.2 Training Requirements, 2.D.2.1 Disclosure Awareness Training, NIST Controls

AT-2 Awareness Training, AT-3 Role-Based Training and CP-3 Contingency Training

These policies/procedures must contain a signed certification by the employee or contractor

stating they understand the security policy and procedures for safeguarding FTI, prior to access

to FTI.

•

Transcript Delivery System (TDS) Audit Log Review (if applicable) – See Section 4.1, Access

Control

The policy/procedures must address the development, documentation, and dissemination of

audit/accountability security controls.

•

Background Investigation – See Section 2.C.3 Background Investigation Minimum

Requirements

The policy/procedure requires that employees, contractors, and sub-contractors (if authorized)

with access to FTI must have a background investigation completed and favorably adjudicated.



Access Control – See Section 2.B.3.3 Controlling Access to Areas Containing FTI and NIST

Control AC-1, Access Control Policy and Procedures.

The policy/procedures must address the issuance of appropriate authorization credentials,

including badges, identification cards or smart cards and include proper use and accountability

requirements. The policy/procedures must also include the prohibition of allowing individuals to

“piggyback” or “tailgate” into any location containing FTI.

•

Audit and Accountability - see NIST Control AU-1, Audit and Accountability Policies and

Procedures

The policy/procedures must address purpose, scope, roles, responsibilities, compliance,

management commitment and coordination among organizational entities. Agencies must

develop, document, and implement remediation actions for violations of the audit and

accountability policy.

•

Media Protection – see NIST Control MP-1, Media Protection Policies and Procedures

The policy/procedures must cover the protection of media to include access, marking, storage,

transport, use and sanitization. See NIST Controls MP-1 through MP 7.

•

Physical and Environmental – See NIST Control PE-1

The policy/procedures must include a clean desk policy for the protection of FTI; designate

restricted IT areas that house IT assets such as, but not limited to, mainframes, servers,

controlled interface equipment, associated peripherals, and communications equipment; and

address specific building access systems, as needed.

•

Personnel Security – See NIST PS-1, Personnel Security Policy and Procedures

The policy/procedures must address position risk designation, personnel screening, personnel

termination, personnel transfer, access agreements and personnel sanctions.

•

Insider Threat Program– See NIST Control PM-12, Insider Threat Program

The policy/procedures must address an insider threat program that includes a cross-discipline

insider threat incident handling team and designate a senior official as the responsible individual

to implement and provide oversight for the program.

•

Privacy Program Plan 3 – See NIST Control PM-18, Privacy Program Plan

A privacy program plan is a formal document that provides an overview of an agency’s privacy

program, including a description of the structure of the privacy program, the resources dedicated

to the privacy program, the role of the Senior Agency Official for Privacy and other privacy

officials and staff, the strategic goals and objectives of the privacy program and the program

management and common controls in place or planned for meeting applicable privacy

requirements and managing privacy risks.

3 NIST Privacy Control

2.C.3 Background Investigation Minimum Requirements

Determining the suitability of individuals who require access to U.S. government SBU information,

including FTI, is a key factor in ensuring adequate information security. Prior to granting access to FTI

and periodically thereafter, the Agency must complete a suitability background investigation that is

favorably adjudicated by the Agency and to include, at a minimum, the following requirements:

•

Agencies must develop a written policy requiring that employees, contractors, and subcontractors (if authorized), with access to FTI must complete a background investigation that is

favorably adjudicated. The policy will identify the process, steps, timeframes, and favorability

standards that the agency has adopted. The agency may adopt the favorability standards set by

the Federal Investigative Standards (FIS) or one that is currently used by another state agency,

or the Agency may develop its own standards specific to FTI access.

•

The written background investigation policy must establish a result criterion for each required

element that defines what would result in preventing or removing an employee’s, contractor’s and

sub-contractor’s access to FTI.

•

Agencies must initiate a background investigation for all employees, contractors, and subcontractors prior to permitting access to FTI.

•

State agencies must ensure a reinvestigation is conducted within five (5) years from the date of

the previous background investigation for each employee, contractor, and sub-contractor

requiring access to FTI.

•

Agencies must make written background investigation policies and procedures as well as a

sample of completed employee, contractor, and sub-contractor background investigations

available for inspection upon request.

•

Background investigations for any individual granted access to FTI must include, at a minimum:

1. FBI fingerprinting (FD-258) - review of Federal Bureau of Investigation (FBI) fingerprint

results conducted to identify possible suitability issues. Contact the appropriate state

identification bureau for the correct procedures to follow. A listing of state identification

bureaus can be found at: https://www.fbi.gov/about-us/cjis/identity-history-summarychecks/state-identification-bureau-listing.

This national agency check is the key to evaluating the history of a prospective candidate

for access to FTI. It allows the Agency to check the applicant’s criminal history in all 50

states, not only current or known past residences.

2. Check of local law enforcement agencies where the subject has lived, worked, and/or

attended school within the last five (5) years and if applicable, of the appropriate agency

for any identified arrests.

The local law enforcement check will assist agencies in identifying trends of misbehavior

that may not rise to the criteria for reporting to the FBI database but is a good source of

information regarding an applicant.

3. Citizenship/residency – Validate the subject’s eligibility to legally work in the United

States (e.g., a United States citizen or foreign citizen with the necessary authorization).

Employers must complete USCIS Form I-9 to document verification of the identity and

employment authorization of each new employee hired after November 16, 1986, to work

in the United States. Within three (3) days of completion, any new employee must also be

processed through E-Verify to assist with verification of their status and the documents

provided with the Form I-9. The E-Verify system is free of charge and can be located at

www.uscis.gov/e-verify. This verification process may only be completed on new

employees. Any employee with expiring employment eligibility must be documented and

monitored for continued compliance.

Federal agencies must conduct a suitability or security background investigation based on the position

sensitivity of the individual’s assigned position and risk designation associated with the investigative Tier

established by the FIS. Granting access to FTI requires, at a minimum, a Tier 2 level investigation.

A FIS Tier 2 standard background investigation meets the suitability investigative requirement for nonsensitive positions designated as moderate risk public trust (requested using Standard Form 85P).

Investigations conducted at Tiers 2-5 meet the minimum standard for an employee, contractor, and subcontractor with access to FTI. Federal agencies may be asked to provide evidence that the required

background investigation was conducted for each individual granted access to FTI. FIS standards require

reinvestigation, at a minimum, every five (5) years.

State and local agencies that are not required to implement the federal background investigation

standards must establish a personnel security program that ensures a background investigation is

completed at the appropriate level for any individual who will have access to FTI using the guidance

above as the minimum standard, with a reinvestigation conducted within five (5) years from the previous

investigation.

2.C.3.1 Background Investigation Requirement Implementation

Agencies must establish a written background investigation policy that conforms to the standards of

Section 2.C.3. Agencies must also identify all employees, contractors, and sub-contractors who currently

have access to FTI and have not completed the required personnel security screening and initiate a

background investigation that meets these standards. Agencies must initiate a background investigation

for all newly hired employees, contractors, and sub-contractors who will require access to FTI to perform

assigned duties. All adjudications must be done by the agency or another state agency delegated to

perform, such as an Office of Administration or HR agency.

Federal agencies that completed a Moderate-Risk Background Investigation (MBI) or higher for

individuals with access to FTI, prior to the October 2014 implementation date of the FIS Tier 2 standard

investigation, have met the minimum standard and no further investigation is needed so long as

reinvestigation is timely scheduled. Individuals granted access to FTI based on a National Agency Check

with Inquiries (NACI) is not sufficient and a Tier 2 investigation must be initiated for continued access to

FTI.

2.C.4 Personnel Actions

2.C.4.1 Personnel Transfer

When reassignments or transfers of individuals are permanent or of such extended durations certain

actions are warranted. Agencies must define actions appropriate for these types of reassignments or

transfers, whether permanent or extended. Actions that may be required for personnel transfers or

reassignments to other positions within organizations include, for example, returning old and issuing new

keys, identification cards and building passes; closing system accounts and establishing new accounts;

changing system access authorizations (i.e., privileges); and access to official records to which individuals

had access at previous work locations and in previous system accounts. See NIST Control PS-5,

Personnel Transfer.

2.C.4.2 Personnel Sanctions

Agencies must document in policy and procedure a formal sanctions process for individuals failing to

comply with established information security policies and procedures. Agencies must notify designated

agency personnel within 72 hours when a formal employee sanction process is initiated, identifying the

individual sanctioned and any required administrative actions. See NIST Control PS-8, Personnel

Sanctions.

When the formal sanction is a proposed disciplinary or adverse action involving an unauthorized access

or disclosure of FTI, the agency must provide written notification to the taxpayer whose FTI was subject

to unauthorized access or disclosure. The required written notification must include the date the

unauthorized access or disclosure of FTI occurred and the rights of the taxpayer under IRC § 7431 (see

Section 1.8.5, Incident Response Notification to Impacted Individuals).

2.C.4.3 Personnel Termination

In personnel termination situations, certain actions are required. Timely execution of termination actions is

essential for individuals terminated for cause. In certain situations, agencies must consider disabling the

system accounts of individuals that are being terminated prior to the individuals being notified.

Exit interviews ensure that terminated individuals understand the security constraints imposed by being

former employees and that proper accountability is achieved for system-related property. System-related

property includes, for example, hardware authentication tokens, system administration technical manuals,

keys, identification cards and building passes. See NIST Control PS-4, Personnel Termination.

2.C.5 Commingling of FTI

Commingling of FTI refers to having FTI and non-FTI data stored together, regardless of format. For

example, commingling occurs when FTI is included in a sentence of text in a paper notice or letter; a row

or column containing FTI in a database table; files stored on electronic media where some contain FTI

and some do not; or at a shared data center where some systems contain FTI that require access

restrictions, and some do not. Any kind of commingling creates the need for additional controls, since the

introduction of FTI requires the entire letter, data table, removable media, etc. be handled and protected

as FTI.

It is recommended that FTI be kept physically and logically separate from other information to the

maximum extent possible to avoid inadvertent disclosures and need for additional controls. Agencies

should attempt to avoid maintaining FTI as part of their case files including any recordation or

transcription in case notes or activity logs, whether paper or electronic.

In situations where physical separation is impractical, the file must be clearly labeled to indicate that FTI is

included and the file must be safeguarded.

If a new address is received from IRS records and entered into a computer database, the address must

be identified as FTI and safeguarded.

If the taxpayer or third party subsequently provides the address independently, the address will not be

considered FTI as long as the address is overwritten using individual or third-party knowledge or records

as the source of information to replace the IRS source address.

All FTI must be removed prior to releasing files to an individual or agency without authorized access to

FTI.

2.C.5.1 Commingling of Electronic Media

If FTI is recorded on electronic media (e.g., tapes) with other data, it must be protected as if it were

entirely FTI. Such commingling of data on electronic media should be avoided.

When data processing equipment is used to process or store FTI and the information is mixed with

agency data, access must be controlled by:

•

Restricting computer access only to authorized personnel

•

Systemic means, including labeling; for additional information, see NIST Control MP-3, Media

Marking

•

When technically possible, data files, data sets and shares must be overwritten after each use

Commingled data at multi-purpose facilities results in security and privacy risks that must be addressed.

If the agency shares physical or computer facilities with other agencies, departments or individuals not

authorized to have FTI, strict physical and systemic controls must be maintained to prevent unauthorized

disclosure of this information.

2.C.6 Access to FTI via State Tax Files or Through Other Agencies

Some state disclosure statutes and administrative procedures permit access to state tax files by other

agencies, organizations or employees not involved in tax matters. As a general rule, IRC § 6103(d) does

not permit access to FTI by such employees, agencies, or other organizations. The IRC clearly provides

that FTI will be furnished to state tax agencies only for tax administration purposes and made available

only to designated state tax personnel and legal representatives or to the state audit agency for an audit

of the tax agency. Questions about whether particular state employees are entitled to access FTI must be

forwarded to the Disclosure Manager at the IRS Office that serves your location 4.

Generally, the IRC does not permit state tax agencies to furnish FTI to other state agencies or to political

subdivisions, such as cities or counties. State tax agencies may not furnish FTI to any other state or local

agency, even where agreements have been made, informally or formally, for the reciprocal exchange of

state tax information unless formally approved by the IRS. Also, non-government organizations, such as

universities or public interest organizations performing research, cannot have access to FTI.

Although state tax agencies are specifically addressed previously in this section, the restrictions on data

access and non-disclosure to another agency or third party applies to all agencies authorized to receive

FTI. Generally, statutes that authorize disclosure of FTI do not authorize further disclosures by the

recipient agency. Unless IRC § 6103 provides for further disclosures by the agency, the agency cannot

make such disclosures or otherwise grant access to FTI to either employees of another component of the

agency not involved with administering the program for which the FTI was specifically received or to

another state agency for any purpose.

Agencies and subdivisions within an agency may be authorized to obtain the same FTI for different

purposes, such as a state tax agency administering tax programs (IRC § 6103(d)) and a component

4 Refer to https://www.irs.gov/privacy-disclosure/irs-freedom-of-information for contact information.

human services agency administering benefit eligibility verification programs (IRC § 6103(l)(7)) or child

support enforcement programs (IRC § 6103(l)(6)).

2.C.7 Offshore Operations

FTI cannot be accessed by agency employees, agents, representatives, contractors, or sub-contractors

located outside of the legal jurisdictional boundary of the United States (outside of the United States, its

territories, embassies, or military installations). FTI must not be received, processed, stored, accessed, or

transmitted to (IT) systems located offshore nor may FTI be sent offshore for disposal. Systems

containing FTI must be located, operated and maintained by personnel physically located within the

United States (this prohibits foreign remote maintenance, foreign call centers, help desks and the like)

and should follow Publication 1075 requirements including the Background Investigation Requirements in

Section 2.C.3.

Some agencies may have a need for their employees to travel internationally for business purposes. As

such, agencies must develop procedures to follow during foreign travel. When agency employees travel

abroad, they must not:

•

Bring IT equipment containing stored FTI (e.g., laptop computers, tablets, phones, removable

media); or

•

Access agency systems that receive, process, store, protect and/or transmit FTI.

During international travel, batteries of agency-managed or Bring Your Own Device (BYOD) mobile

devices and laptops must be removed from battery-powered mobile devices and stored separate from the

device when left unattended. SIM cards must be removed and stored separate from devices that employ

them when entering non-U.S. customs. Once agency employees return from abroad, it is important for

agencies to ensure the continued security of networks where FTI resides. Agencies must sanitize all

devices taken abroad prior to allowing them to connect to their trusted network. Additionally, agencies

must disable wireless connectivity options until devices have been sanitized and may wish to provide

additional security training for employees travelling abroad.

2.C.8 Controls Over Processing

The agency must establish adequate controls to prevent disclosing FTI to other state agencies, tax or

non-tax, or to political subdivisions, such as cities or counties, for any purpose, including tax

administration, absent explicit written IRS authority granted under IRC § 6103(p)(2)(B).

Processing of FTI in an electronic media format including removable media, microfilms, photo

impressions or the conversion to other formats (including tape reformatting or duplication, reproduction or

conversion to digital images or hard copy printout) will be performed as indicated in the environments

listed in 2.C.8.1 and 2.C.8.2.

2.C.8.1 Agency-owned and Operated Facility

Processing under this method will take place in a manner that will protect the confidentiality of the

information on the electronic media. All safeguards outlined in this publication also must be followed and

will be subject to IRS safeguard reviews.

2.C.8.2 Agency, Contractor or Sub-Contractor Shared Facilities

Recipients of FTI are permitted to use a shared facility but only in a manner that does not allow access to

FTI by employees, agents, representatives, or contractors of other agencies using the shared facility.

For purposes of applying sections 6103(l), (m) and (n), the term “agent” includes contractors and subcontractors.

Access restrictions pursuant to the IRC authority by which the FTI is received continue to apply; for

example, human services agencies administering benefit eligibility programs may not allow contractors or

sub-contractors, including consolidated data center contractors, access to any FTI.

The agency must include, as appropriate, the requirements specified in Exhibit 7, Safeguarding Contract

Language.

The agency, as well as its contractor, sub-contractor and shared sites that receive, process, store,

access, protect and/or transmit FTI, are subject to Safeguard reviews.

These requirements also apply to releasing electronic media to a private contractor, sub-contractor or

other agency office, even if the purpose is merely to erase the old media for reuse.

2.C.9 Service Level Agreements (SLA)

Agencies using support functions, including, but not limited to, consolidated data centers, shared print

facilities, and disaster recovery sites, must implement appropriate controls to ensure the protection of FTI.

This includes a service level agreement (SLA) between the agency authorized to receive FTI and support

functions. The SLA must cover the following:

•

The agency with authority to receive FTI is responsible for ensuring the protection of all FTI

received. The state support function shares responsibility for safeguarding FTI.

•

The Exhibit 7 language must be included in the SLA between the recipient agency and support

functions and in all contracts involving contractors or sub-contractors hired by the state support

function.

•

The SLA provides written notification to the state support function’s management that they are

bound by the provisions of Publication 1075, relative to protecting all FTI within their possession

or control.

•

The SLA shall detail the IRS’s right to inspect state support function

This text is long and has been trimmed here. Open the source document for the complete record.

This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.