# Safeguards for Protecting Federal Tax Returns > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/agency%3Airs%3A1dabf8954e304f84 ## Record - **Collection:** Agency decision - **Document type:** Agency decision ## Text Publication 1075 Tax Information Security Guidelines For Federal, State and Local Agencies Safeguards for Protecting Federal Tax Returns and Return Information IRS Mission Statement Provide America’s taxpayers top-quality service by helping them understand and meet their tax responsibilities and enforce the law with integrity and fairness to all. Office of Safeguards Mission Statement The Mission of Safeguards is to promote taxpayer confidence in the integrity of the tax system by ensuring the confidentiality of IRS information provided to federal, state, and local agencies. Safeguards verifies compliance with Internal Revenue Code (IRC) § 6103(p)(4) safeguard requirements through the identification and mitigation of any risk of loss, breach or misuse of Federal Tax Information (FTI) held by external government agencies. Office of Safeguards Vision Statement To serve as a trusted advisor to our Partners, ensuring they have full understanding and insight into FTI requirements and their risk profile, obtain consistent and timely guidance from a “single voice” and receive service and support that is aligned to their risk profile. We will drive the customer experience and FTI compliance via a collaborative and empowered culture and a cross-trained workforce that is built around a risk-based operating model that integrates infrastructure and processes to enable efficient and effective operations. 2 Contents IRS Mission Statement_________________________________________________ 2 Office of Safeguards Mission Statement __________________________________ 2 Office of Safeguards Vision Statement ___________________________________ 2 Highlights for November 2021 Revision__________________________________ 12 Security and Privacy Control Table _____________________________________ 17 INTRODUCTION _____________________________________________________ 23 General__________________________________________________________________ 23 Overview of Publication 1075_________________________________________________ 24 SAFEGUARD RESOURCES____________________________________________ 24 Safeguards Website ________________________________________________________ 24 Safeguards Mailbox ________________________________________________________ 25 KEY DEFINITIONS ___________________________________________________ 25 Federal Tax Information _____________________________________________________ 25 Return and Return Information________________________________________________ 26 Personally Identifiable Information (PII) _________________________________________26 Information Received from Taxpayers or Third Parties _____________________________27 Access __________________________________________________________________ 27 Cloud Computing __________________________________________________________ 27 Inadvertent Access_________________________________________________________ 27 Inadvertent Disclosure ______________________________________________________ 27 Incidental Access __________________________________________________________ 27 Unauthorized Access _______________________________________________________ 27 Unauthorized Disclosure ____________________________________________________ 28 Need-to-Know ____________________________________________________________ 28 Adverse Action ____________________________________________________________ 28 Disciplinary Action _________________________________________________________ 28 Personnel Sanction ________________________________________________________ 28 1.0 FEDERAL TAX INFORMATION, REVIEWS and OTHER REQUIREMENTS ____ 29 1.1 General _________________________________________________________ 29 1.2 Authorized Use of FTI _____________________________________________ 29 1.3 Secure Data Transfer ______________________________________________ 30 1.4 State Tax Agency Limitations _______________________________________ 30 3 1.5 Coordinating Safeguards within an Agency ___________________________ 31 1.6 Safeguard Reviews _______________________________________________ 31 1.6.1 Before the Review _____________________________________________________ 31 1.6.2 During the Review _____________________________________________________ 32 1.6.3 After the Review ______________________________________________________ 32 1.7 Termination of FTI ________________________________________________ 33 1.7.1 Agency Request ______________________________________________________ 33 1.7.1.1 Termination Documentation _______________________________________________ 33 1.7.1.2 Archiving FTI Procedure __________________________________________________ 34 1.7.2 FTI Suspension, Termination and Administrative Review_______________________34 1.8 Reporting Improper Inspections or Disclosures ________________________ 34 1.8.1 Terms ______________________________________________________________ 34 1.8.1.1 Data Incident ____________________________________________________________ 34 1.8.1.2 Data Breach _____________________________________________________________ 35 1.8.2 General _____________________________________________________________ 35 1.8.3 Office of Safeguards Notification Process___________________________________36 1.8.4 Incident Response Procedures ___________________________________________ 37 1.8.5 Incident Response Notification to Impacted Individuals ________________________37 1.9 Disclosure to Other Persons ________________________________________ 38 1.9.1 General _____________________________________________________________ 38 1.9.2 Authorized Disclosure Precautions ________________________________________38 1.9.3 External Personnel Security _____________________________________________ 38 1.9.4 Disclosing FTI to Contractors or Sub-Contractors_____________________________38 1.9.5 Re-Disclosure Agreements ______________________________________________ 40 1.10 Return Information in Statistical Reports ____________________________ 40 1.10.1 General ____________________________________________________________ 40 1.10.2 Making a Request under IRC § 6103(j)____________________________________41 1.10.3 State Tax Agency Statistical Analysis _____________________________________41 2.0 PHYSICAL SECURITY REQUIREMENTS ______________________________ 42 2.A Recordkeeping Requirement – IRC § 6103(p)(4)(A) _____________________ 42 2.A.1 General _____________________________________________________________ 42 2.A.2 Logs of FTI (Electronic and Non-Electronic Receipts) _________________________42 Figure 1 – Sample FTI Logs__________________________________________________ 43 2.A.3 Converted Media______________________________________________________ 43 2.A.4 Recordkeeping of Disclosures to State Auditors______________________________43 2.B Secure Storage – IRC § 6103(p)(4)(B) ________________________________ 43 4 2.B.1 General _____________________________________________________________ 43 2.B.2 Minimum Protection Standards___________________________________________ 44 Table 1 – Minimum Protection Standards _______________________________________44 2.B.3 Restricted Area Access_________________________________________________ 45 2.B.3.1 Visitor Access Logs ______________________________________________________ 45 Figure 2 – Visitor Access Log ____________________________________________________ 46 2.B.3.2 Authorized Access List ___________________________________________________ 46 2.B.3.3 Controlling Access to Areas Containing FTI __________________________________ 47 2.B.3.4 Control and Safeguarding Keys and Combinations ____________________________ 47 2.B.3.5 Locking Systems for Secured Areas ________________________________________ 48 2.B.4 FTI in Transit_________________________________________________________ 48 2.B.4.1 Security During Office Moves ______________________________________________ 48 2.B.5 Physical Security of Computers, Electronic and Removable Media _______________48 2.B.6 Media Off-Site Storage Requirements _____________________________________49 2.B.7 Alternate Work Site ____________________________________________________ 49 2.B.7.1 Equipment ______________________________________________________________ 49 2.B.7.2 Storing Data ____________________________________________________________ 50 2.B.7.3 Other Safeguards ________________________________________________________ 50 2.C Restricting Access – IRC § 6103(p)(4)(C) _____________________________ 50 2.C.1 General _____________________________________________________________ 50 2.C.2 Policies and Procedures ________________________________________________ 51 2.C.3 Background Investigation Minimum Requirements ___________________________53 2.C.3.1 Background Investigation Requirement Implementation _______________________ 54 2.C.4 Personnel Actions_____________________________________________________ 54 2.C.4.1 Personnel Transfer_______________________________________________________ 54 2.C.4.2 Personnel Sanctions _____________________________________________________ 55 2.C.4.3 Personnel Termination____________________________________________________ 55 2.C.5 Commingling of FTI ___________________________________________________ 55 2.C.5.1 Commingling of Electronic Media __________________________________________ 56 2.C.6 Access to FTI via State Tax Files or Through Other Agencies___________________56 2.C.7 Offshore Operations ___________________________________________________ 57 2.C.8 Controls Over Processing_______________________________________________ 57 2.C.8.1 Agency-owned and Operated Facility _______________________________________ 57 2.C.8.2 Agency, Contractor or Sub-Contractor Shared Facilities _______________________ 57 2.C.9 Service Level Agreements (SLA) _________________________________________58 2.C.10 Review Availability of Contractor and Sub-Contractor Facilities_________________59 2.C.11 Restricting Access – Other Disclosures ___________________________________59 2.C.11.1 Child Support Agencies—IRC §§ 6103(l)(6), (l)(8) and (l)(10)____________________ 59 2.C.11.2 Human Services Agencies—IRC § 6103(l)(7)_________________________________ 60 2.C.11.3 Deficit Reduction Agencies—IRC § 6103(l)(10) _______________________________ 60 2.C.11.4 Centers for Medicare and Medicaid Services—IRC § 6103(l)(12)(C) ______________ 60 2.C.11.5 Disclosures under IRC § 6103(l)(20) ________________________________________ 60 2.C.11.6 Disclosures under IRC § 6103(l)(21) ________________________________________ 60 2.C.11.7 Disclosures under IRC § 6103(i) ___________________________________________ 61 5 2.C.11.8 Disclosures under IRC § 6103(m)(2)________________________________________ 61 2.D Other Safeguards - IRC § 6103(p)(4)(D) _______________________________ 61 2.D.1 General _____________________________________________________________ 61 2.D.2 Training Requirements _________________________________________________ 61 Table 2 – Training Requirements _________________________________________________ 62 2.D.2.1 Disclosure Awareness Training ____________________________________________ 62 2.D.2.2 Disclosure Awareness Training Products ____________________________________ 64 2.D.3 Internal Inspections and On-Site Reviews __________________________________64 2.D.4 Recordkeeping____________________________________________________________ 65 2.D.5 Secure Storage ___________________________________________________________ 65 2.D.6 Limited Access ___________________________________________________________ 65 2.D.7 Disposal _________________________________________________________________ 66 2.D.8 Computer Systems Security ________________________________________________ 66 2.D.9 Plan of Action and Milestones (POA&M) ______________________________________ 66 2.E Reporting Requirements – IRC § 6103(p)(4)(E) _________________________ 66 2.E.1 General _____________________________________________________________ 66 2.E.2 Report Submission Instructions __________________________________________ 66 2.E.3 Encryption Requirements _______________________________________________ 67 2.E.4 Safeguards Security Reports (SSR) _______________________________________67 2.E.4.1 Initial SSR Submission Instructions – New Agency Responsibilities _____________ 68 Table 3 – SSR Evidentiary Documentation ______________________________________69 2.E.4.2 Agencies Requesting New FTI Data Streams _________________________________ 71 2.E.4.3 Annual SSR Update Submission Instructions_________________________________ 72 2.E.4.4 SSR Submission Dates ___________________________________________________ 72 Table 4 - SSR Submission Dates __________________________________________________ 73 2.E.5 Corrective Action Plan _________________________________________________ 73 2.E.5.1 CAP Submission Instructions ______________________________________________ 74 2.E.5.2 CAP Submission Dates ___________________________________________________ 75 Table 5 – CAP Submission Dates _________________________________________________ 75 2.E.6 Notification Reporting Requirements ______________________________________76 Table 6 – Notification Reporting __________________________________________________ 76 2.E.6.1 Cloud Computing ________________________________________________________ 76 2.E.6.2 Contractor or Sub-Contractor Access _______________________________________ 77 2.E.6.3 Tax Modeling ____________________________________________________________ 77 2.E.6.4 Live Data Testing ________________________________________________________ 77 2.F Disposing of FTI – IRC § 6103(p)(4)(F) ________________________________ 77 2.F.1 General _____________________________________________________________ 77 2.F.2 Returning IRS Information to the Source ___________________________________78 2.F.3 Destruction and Disposal _______________________________________________ 78 Table 7 - FTI Destruction Methods ________________________________________________ 78 2.F.3.1 Media Sanitization________________________________________________________ 79 2.F.4 Other Precautions _____________________________________________________ 79 3.1 General_______________________________________________________________ 81 3.2 Assessment Process ____________________________________________________ 81 6 Table 8 – Assessment Methodologies _____________________________________________ 82 3.3 Technology-Specific Requirements _________________________________________82 3.3.1 Cloud Computing __________________________________________________________ 82 3.3.2 Email Communications _____________________________________________________ 83 3.3.3 Facsimile and Facsimile Devices _____________________________________________ 84 3.3.4 Mobile Devices ____________________________________________________________ 85 3.3.5 Multifunction Devices (MFDs) and High-Volume Printers (HVPs) __________________ 85 3.3.6 Network Boundary and Infrastructure _________________________________________ 85 3.3.7 Virtual Desktop Infrastructure _______________________________________________ 86 3.3.8 Public-Facing Systems _____________________________________________________ 86 4.0 NIST 800-53 SECURITY AND PRIVACY CONTROLS _____________________ 88 4.1 ACCESS CONTROL ____________________________________________________ 88 AC-1 Access Control Policy and Procedures _______________________________________ 88 AC-2 Account Management ______________________________________________________ 88 AC-3 Access Enforcement _______________________________________________________ 90 AC-4 Information Flow Enforcement_______________________________________________ 91 AC-5 Separation of Duties _______________________________________________________ 91 AC-6 Least Privilege ____________________________________________________________ 91 AC-7: Unsuccessful Logon Attempts ______________________________________________ 92 AC-8: System Use Notification ___________________________________________________ 93 AC-11: Device Lock_____________________________________________________________ 93 AC-12: Session Termination _____________________________________________________ 94 AC-14: Permitted Actions Without Identification or Authentication _____________________ 94 AC-17: Remote Access__________________________________________________________ 94 AC-18: Wireless Access _________________________________________________________ 95 AC-19: Access Control for Mobile Devices _________________________________________ 96 AC-20: Use of External Systems __________________________________________________ 96 AC-21: Information Sharing ______________________________________________________ 97 AC-22: Publicly Accessible Content _______________________________________________ 97 AC-23: Data Mining Protection ___________________________________________________ 98 4.2 AWARENESS AND TRAINING ____________________________________________ 99 AT-1: Awareness and Training Policy and Procedures _______________________________ 99 AT-2: Awareness Training _______________________________________________________ 99 AT-3: Role-Based Training ______________________________________________________ 100 AT-4: Training Records ________________________________________________________ 101 AT-6: Training Feedback _______________________________________________________ 101 4.3 AUDIT AND ACCOUNTABILITY __________________________________________ 102 AU-1: Audit and Accountability Policy and Procedures ______________________________ 102 AU-2: Audit Events ____________________________________________________________ 102 AU-3: Content of Audit Records _________________________________________________ 103 AU-4: Audit Storage Capacity ___________________________________________________ 103 AU-5: Response to Audit Processing Failures _____________________________________ 103 AU-6: Audit Review, Analysis and Reporting_______________________________________ 104 AU-7: Audit Reduction and Report Generation _____________________________________ 104 AU-8: Time Stamps ____________________________________________________________ 105 AU-9: Protection of Audit _______________________________________________________ 105 AU-11: Audit Record Retention __________________________________________________ 105 AU-12: Audit Generation _______________________________________________________ 105 AU-16: Cross-Organizational Auditing Logging ____________________________________ 106 4.4 ASSESSMENT, AUTHORIZATION AND MONITORING________________________107 CA-1: Assessment, Authorization and Monitoring Policy and Procedures ______________ 107 CA-2: Control Assessments_____________________________________________________ 107 7 CA-3: Information Exchange ____________________________________________________ 108 CA-5: Plan of Action and Milestones _____________________________________________ 108 CA-6: Authorization ___________________________________________________________ 109 CA-7: Continuous Monitoring ___________________________________________________ 109 CA-8: Penetration Testing ______________________________________________________ 110 CA-9: Internal System Connections ______________________________________________ 110 4.5 CONFIGURATION MANAGEMENT _______________________________________112 CM-1: Configuration Management Policy and Procedures ___________________________ 112 CM-2: Baseline Configuration ___________________________________________________ 112 CM-3: Configuration Change Control _____________________________________________ 113 CM-4: Security and Privacy Impact Analyses ______________________________________ 114 CM-5: Access Restrictions for Change____________________________________________ 114 CM-6: Configuration Settings ___________________________________________________ 115 CM-7: Least Functionality ______________________________________________________ 115 CM-8: System Component Inventory _____________________________________________ 116 CM-9: Configuration Management Plan ___________________________________________ 117 CM-10: Software Usage Restrictions _____________________________________________ 117 CM-11: User-Installed Software __________________________________________________ 118 CM-12: Information Location ____________________________________________________ 118 CM-13: Data Action Mapping ____________________________________________________ 118 CM-14: Signed Components ____________________________________________________ 118 4.6 CONTINGENCY PLANNING _____________________________________________ 119 CP-1: Contingency Planning Policy and Procedures ________________________________ 119 CP-2: Contingency Plan ________________________________________________________ 119 CP-3: Contingency Training_____________________________________________________ 120 CP-4: Contingency Plan Testing _________________________________________________ 121 CP-9: System Backup __________________________________________________________ 121 CP-10: System Recovery and Reconstitution ______________________________________ 122 4.7 IDENTIFICATION AND AUTHENTICATION _________________________________123 IA-1: Identification and Authentication Policy and Procedures ________________________ 123 IA-2: Identification and Authentication (Organizational Users) ________________________ 123 IA-3: Device Identification and Authentication _____________________________________ 124 IA-4: Identifier Management _____________________________________________________ 125 IA-5: Authenticator Management_________________________________________________ 125 IA-6: Authenticator Feedback ___________________________________________________ 127 IA-7: Cryptographic Module Authentication________________________________________ 128 IA-8: Identification and Authentication (Non-Organizational Users) ____________________ 128 IA-9: Service Identification and Authentication _____________________________________ 128 IA-11: Re-Authentication _______________________________________________________ 129 IA-12: Identity Proofing_________________________________________________________ 129 4.8 INCIDENT RESPONSE _________________________________________________ 131 IR-1: Incident Response Policy and Procedures ____________________________________ 131 IR-2: Incident Response Training ________________________________________________ 131 IR-3: Incident Response Testing _________________________________________________ 132 IR-4: Incident Handling _________________________________________________________ 132 IR-5: Incident Monitoring _______________________________________________________ 133 IR-6: Incident Reporting ________________________________________________________ 133 IR-7: Incident Response Assistance ______________________________________________ 134 IR-8: Incident Response Plan____________________________________________________ 134 IR-9: Information Spillage Response _____________________________________________ 135 4.9 MAINTENANCE _______________________________________________________ 136 MA-1: System Maintenance Policy and Procedures _________________________________ 136 MA-2: Controlled Maintenance __________________________________________________ 136 8 MA-3: Maintenance Tools_______________________________________________________ 137 MA-4: Nonlocal Maintenance ____________________________________________________ 137 MA-5: Maintenance Personnel ___________________________________________________ 138 MA-6: Timely Maintenance ______________________________________________________ 139 4.10 MEDIA PROTECTION _________________________________________________ 140 MP-1: Media Protection Policy and Procedures ____________________________________ 140 MP-2: Media Access ___________________________________________________________ 140 MP-3: Media Marking __________________________________________________________ 140 MP-4: Media Storage___________________________________________________________ 140 MP-5: Media Transport _________________________________________________________ 141 MP-6: Media Sanitization _______________________________________________________ 141 MP-7: Media Use ______________________________________________________________ 142 4.11 PHYSICAL AND ENVIRONMENTAL PROTECTION _________________________143 PE-1: Physical and Environmental Policy and Procedures ___________________________ 143 PE-2: Physical Access Authorizations ____________________________________________ 143 PE-3: Physical Access Control __________________________________________________ 143 PE-4: Access Control for Transmission ___________________________________________ 144 PE-5: Access Control for Output Devices _________________________________________ 144 PE-6: Monitoring Physical Access _______________________________________________ 145 PE-8: Visitor Access Records ___________________________________________________ 145 PE-16: Delivery and Removal____________________________________________________ 145 PE-17: Alternate Work Site______________________________________________________ 145 4.12 PLANNING __________________________________________________________ 147 PL-1: Planning Policy and Procedures ____________________________________________ 147 PL-2: System Security and Privacy Plans _________________________________________ 147 PL-4: Rules of Behavior ________________________________________________________ 149 PL-8: Security and Privacy Architectures _________________________________________ 149 4.13 PROGRAM MANAGEMENT ____________________________________________ 151 PM-1: Information Security Program Plan _________________________________________ 151 PM-2: Information Security Program Leadership Role _______________________________ 151 PM-3: Information Security and Privacy Resources _________________________________ 152 PM-4: Plan of Action and Milestones Process ______________________________________ 152 PM-5: System Inventory ________________________________________________________ 152 PM-7: Enterprise Architecture ___________________________________________________ 153 PM-9: Risk Management Strategy ________________________________________________ 153 PM-10: Authorization Process ___________________________________________________ 154 PM-12: Insider Threat Program __________________________________________________ 154 PM-14: Testing, Training and Monitoring __________________________________________ 154 PM-18: Privacy Program Plan ___________________________________________________ 155 PM-19: Privacy Program Leadership Role _________________________________________ 155 PM-21: Accounting of Disclosures _______________________________________________ 156 PM-29: Risk Management Program Leadership Roles _______________________________ 156 4.14 PERSONNEL SECURITY ______________________________________________ 157 PS-1: Personnel Security Policy and Procedures ___________________________________ 157 PS-2: Position Risk Designation _________________________________________________ 157 PS-3: Personnel Screening _____________________________________________________ 157 PS-4: Personnel Termination ____________________________________________________ 158 PS-5: Personnel Transfer _______________________________________________________ 158 PS-6: Access Agreements ______________________________________________________ 158 PS-7: External Personnel Security _______________________________________________ 159 PS-8: Personnel Sanctions _____________________________________________________ 159 PS-9: Position Descriptions _____________________________________________________ 159 9 4.15 PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY _______________________________________________________________________ 160 PT-1: Personally Identifiable Information Processing and Transparency Policy and Procedures___________________________________________________________________ 160 PT-2: Authority to Process Personally Identifiable Information _______________________ 160 4.16 RISK ASSESSMENT __________________________________________________ 161 RA-1: Risk Assessment Policy and Procedures ____________________________________ 161 RA-3: Risk Assessment ________________________________________________________ 161 RA-5: Vulnerability Monitoring and Scanning ______________________________________ 162 RA-7: Risk Response __________________________________________________________ 163 RA-8: Privacy Impact Assessments ______________________________________________ 163 4.17 SYSTEM AND SERVICES ACQUISITION _________________________________163 SA-1: System and Services Acquisition Policy and Procedures _______________________ 163 SA-2: Allocation of Resources___________________________________________________ 164 SA-3: System Development Life Cycle ____________________________________________ 164 SA-4: Acquisition Process ______________________________________________________ 165 SA-5: System Documentation ___________________________________________________ 166 SA-8: Security Engineering Principles ____________________________________________ 167 SA-9: External System Services _________________________________________________ 167 SA-10: Developer Configuration Management______________________________________ 168 SA-11: Developer Testing and Evaluation _________________________________________ 169 SA-15: Development Process, Standards and Tools ________________________________ 169 SA-22: Unsupported System Components ________________________________________ 170 4.18 SYSTEM AND COMMUNICATIONS PROTECTION__________________________171 SC-1: System and Communications Protection Policy and Procedures ________________ 171 SC-2: Application Partitioning ___________________________________________________ 171 SC-4: Information in Shared System Resources ____________________________________ 171 SC-7: Boundary Protection _____________________________________________________ 171 SC-8: Transmission Confidentiality and Integrity ___________________________________ 174 SC-10: Network Disconnect _____________________________________________________ 174 SC-12: Cryptographic Key Establishment and Management __________________________ 175 SC-13: Cryptographic Protection ________________________________________________ 175 SC-15: Collaborative Computing Devices and Applications __________________________ 175 SC-17: Public Key Infrastructure Certificates ______________________________________ 175 SC-18: Mobile Code ___________________________________________________________ 176 SC-20: Secure Name/Address Resolution Service (Authoritative Source) _______________ 176 SC-21: Secure Name/Address Resolution Service (Recursive or Caching Resolver) ______ 176 SC-22: Architecture and Provisioning for Name/Address Resolution Service ___________ 177 SC-23: Session Authenticity ____________________________________________________ 177 SC-28: Protection of Information at Rest __________________________________________ 177 SC-35: External Malicious Code Identification______________________________________ 178 SC-39: Process Isolation _______________________________________________________ 178 SC-45: System Time Synchronization ____________________________________________ 178 4.19 SYSTEM AND INFORMATION INTEGRITY ________________________________179 SI-1: System and Information Integrity Policy and Procedures ________________________ 179 SI-2: Flaw Remediation_________________________________________________________ 179 SI-3: Malicious Code Protection _________________________________________________ 180 SI-4: System Monitoring ________________________________________________________ 181 SI-5: Security Alerts, Advisories and Directives ____________________________________ 183 SI-7: Software, Firmware and Information Integrity _________________________________ 183 SI-8: Spam Protection __________________________________________________________ 184 SI-10: Information Input Validation _______________________________________________ 184 SI-11: Error Handling __________________________________________________________ 184 10 SI-12: Information Management and Retention _____________________________________ 184 SI-16: Memory Protection_______________________________________________________ 185 4.20 SUPPLY CHAIN RISK MANAGEMENT____________________________________186 SR-1: Supply Chain Risk Management Policy and Procedures ________________________ 186 SR-2: Supply Chain Risk Management Plan _______________________________________ 186 SR-3: Supply Chain Controls and Processes ______________________________________ 186 SR-6: Supplier Assessments and Reviews ________________________________________ 187 SR-10: Inspection of Systems and Components ____________________________________ 187 SR-11: Component Authenticity _________________________________________________ 187 Exhibit 1 IRC §§ 6103(a) and (b) _______________________________________ 188 Exhibit 2 IRC § 6103(p)(4) ____________________________________________ 192 Exhibit 3 Code of Federal Regulations (CFR) § 301.6103(p)(7)-1 [T.D. 9445, 74 FR 6830, Feb. 11, 2009] _________________________________________________ 194 Exhibit 4 IRC §§ 7213 and 7213A – Sanctions for Unauthorized Disclosure and Access____________________________________________________________ 196 Exhibit 5 IRC § 7431 - Civil Damages for Unauthorized Inspection or Disclosure of Returns and Return Information _______________________________________ 198 Exhibit 6 Contractor 45-Day Notification Procedures ______________________ 200 Exhibit 7 Safeguarding Contract Language______________________________ 202 Exhibit 8 Warning Banner Examples ___________________________________ 205 Exhibit 9 Record Retention Schedules__________________________________ 206 Table 9 - Record Retention Schedules ____________________________________________ 206 GLOSSARY AND KEY TERMS ________________________________________ 207 INDEX ____________________________________________________________ 214 11 Highlights for November 2021 Revision This publication revises and supersedes Publication 1075 (November 2016) and is effective 6 months after the publication date. Feedback for Publication 1075 is highly encouraged. Please send any comments to SafeguardReports@irs.gov, using “Publication 1075 comment/feedback” in the subject line. Editorial changes have been made throughout to update references and terms. Web and citation references were added/updated throughout to make the text easier to research in electronic format. Following are the highlighted changes: 1) Publication 1075 has been reformatted, and all sections have been renumbered. Section 1.0 is Federal Tax Information, Reviews and Other Requirements; Section 2.0 is Physical Security Requirements and is numbered to include the applicable IRC § 6103 subsections, the key Safeguarding elements; Section 3.0 is CyberSecurity Requirements; and Section 4.0 is the NIST 800-53 Revision 5 Security and Privacy Controls. 2) Section 4.0, NIST (National Institutes of Standards and Technology) 800-53 Security and Privacy Controls has been updated to align with NIST 800-53 Revision 5 Security and Privacy controls. Some controls have been added, but all have been reviewed and/or updated. 3) Privacy controls previously in NIST 800-53 Rev 4 Appendix J, are now fully integrated into the NIST controls. 4) NIST SP 800-63, Digital Identity Guidelines, requirements have been adapted into this revision. 5) Treasury Directive 85-01 defined requirements have been included in several Section 4.0 NIST 800-53 Security and Privacy Controls and are shown as IRS-Defined. 6) Security and Privacy Control Table has been added for reference. This table identifies the controls, which are privacy related, which overlap with physical controls and identifies those controls new to this revision of the Publication 1075. 7) Many instances of “should” throughout the document have been changed to “must”. 8) Key Definitions “Information Spillage”, Access, “Unauthorized Inadvertent Access and Incidental Access” have been added. “Unauthorized Disclosure and Need-to-Know have been updated for clarification. The term “Access” was also added. 9) Section 1.2, Authorized Use of FTI has been updated. 10) Section 1.6, Safeguards Reviews now includes the terms “on-site, remote, or a combination of both (hybrid)” as types of assessments and descriptions for on-site reviews and remote reviews. 11) Former Section 2.7, Conducting the Review, has been split into the current Sections 1.6.1, Before the Review, 1.6.2, During the Review and 1.6.3 After the Review, and updated to reflect current on-site review procedures. 12) Former Section 2.7.2, Computer Security Review has been removed and incorporated into Section 3.2 Assessment Process. 13) Former Tables 1 and 2 – Safeguard Review Cycle and IT Testing Techniques have been removed and incorporated into Section 3.2, Assessment Process. 14) Former Section 2.9, Termination of FTI, has been changed to Section 1.7, Termination of FTIAgency Request. 12 15) Sections 1.8, Reporting Improper Inspections or Disclosures, 1.9 Disclosures to Other Persons and 1.10 Return Information in Statistical Reports, formerly Sections 10, 11 and 12 have been relocated to the front of Publication 1075. 16) Sections 1.8.1, Terms, 1.8.1.1 Incident and 1.8.1.2 Data Breach are new items. 17) Section 1.8.2, General – Reporting Improper Inspections or Disclosures, was updated to include information regarding spillage and was also updated to reflect the NIST IR Control requirements. 18) Section 1.8.4, Incident Response Procedures now includes requirement for tabletop incident response testing from NIST IR-3 and the requirement to track and document incidents from NIST IR-5. 19) The requirement in former Section 3.1, General Recordkeeping Requirement (now Section 2.A.1), for an inventory of IT systems has been removed. Please see NIST Controls CM-8, System Component Inventory and PM-5, System Inventory, for guidance. 20) Section 2.A.2, Logs of FTI (Electronic and Non-Electronic Receipts), has been updated and references NIST Control AU-2, Audit Events. Additionally, Figure 1 – Sample FTI Logs was updated to include the Electronic Receipts Sample log. 21) Section 2.B.2, Minimum Protection Standards, was updated to include requirements for MFDs or High-Volume Printers. 22) Created new heading for Section 2.B.3.1, Visitor Access Logs and included previous Section 4.2 information. 23) Section 2.B.3.1, Visitor Access Logs, has been updated for clarity and adds retention requirement. 24) Section 2.B.3.2, Authorized Access List has been updated for clarity. The Authorized Access List must be reviewed monthly or upon occurrence or potential indication of an event such as a possible security breach or personnel change. 25) Section 2.B.3.3, Controlling Access to Areas Containing FTI, has been updated for clarity. The agency must maintain a policy addressing issuance of appropriate authorization credentials, including badges, identification cards or smart cards. This policy must include proper use and accountability requirements. 26) Section 2.B.4.1, Security During Office Moves, has been added. 27) Section 2.B.7, Alternate Work Site was formerly Section 4.7, Telework Locations. 28) Section 2.B.7, Alternate Work Site, no longer includes requirement for agency inspections of telework locations 29) Section 2.C.1 General - Restricting Access has been updated to include requirements for auditing controls. 30) Section 2.C.2, Policies and Procedures has been added and includes required policies and procedures related to physical controls. New policies and procedures include Access Control, Audit and Accountability, Media Protection, Privacy Authorization, Physical and Environmental Security, and Personnel Security. Insider Threat Program and Privacy Program plans have also been included. 13 31) Section 2.C.3, Background Investigation Minimum Requirements has been changed to reflect updated requirement for reinvestigations to be conducted every five (5) years (previously 10 years). 32) Section 2.C.3, Background Investigation Minimum Requirements, was rearranged for clarity. 33) Section 2.C.3.1, Background Investigation Requirement Implementation – Removed first paragraph that referenced a one-year implementation period beginning with the last revision of the Publication 1075. 34) Added new Section 2.C.4, Personnel Actions, which includes new Section 2.C.4.1, Personnel Transfer (PS-5), Section 2.C.4.2 Personnel Sanctions (PS-8) and Section 2.C.4.3, Personnel Terminations (PS-4). 35) Added new Section 2.C.7, Offshore Operations, which contains some information that was previously included in former Section 5.3 Access to FTI via State Tax Files or Through Other Agencies. 36) Section 2.C.9, Service Level Agreements (SLA) was formerly Section 5.4.2.2, Consolidated Data Centers and has been updated to reflect more inclusive language, state support functions and includes requirement for Exhibit 7 language. 37) Section 2.D.2.1, Disclosure Awareness Training, has been updated to include the prohibition of FTI in training and a requirement to add role-based training and practical exercises. Training must also include security and privacy updates at least quarterly in addition to annual awareness. The Safeguards’ Disclosure Awareness Training video can be used to supplement training but is not intended to fulfill all training requirements. 38) Section 2.D.2.1, Disclosure Awareness Training, has been updated to better align with NIST 80053 Controls. 39) Section 2.D.2, Table 2, Training Requirements, has been updated to include Insider Threat Awareness Training. 40) Section 2.D.2.2, Disclosure Awareness Training Products, has been updated with current titles of available products. 41) Section 2.D.3, Internal Inspections, has been updated to include self-certification requirements. 42) Section 2.D.9, Plan of Action and Milestones (POA&M) has been updated for clarity. 43) Section 2.E.2 Report Submission Instructions, has been updated to include the Head of Agency may delegate authority to sign Safeguard report submissions. 44) Sections 2.E.4.4, SSR Submission Dates and 2.E.5.2 CAP Submission Dates, have been updated to reflect the correct postal code for CNMI and associated due dates. 45) Previous Section 7.3.1 CAP Submission Instructions and Submission Dates, has been split up into new Sections 2.E.5.1 CAP Submission Instructions and 2.E.5.2, CAP Submission Dates, for clarity. 46) Table 6 in Section 2.E.6, Notification Reporting Requirements has been updated. 47) Section 2.E.6.1 Cloud Computing, and Section 2.E.6.4 Live Data Testing have been updated for 14 clarity. 48) Removed former Section 7.4.2 Consolidated Data Center. 49) Removed former Section 7.4.4, Data Warehouse Processing. 50) Removed former Section 7.4.5, Non-Agency-owned Information Systems. 51) Removed former Section 7.4.8 Virtualization of Information Technology Systems. 52) Section 2.F.4, Other Precautions, has been updated to reflect annual requirement to validate and maintain most recent copy of NAID certification. 53) Former Section 9.4.5, Interactive Voice Response, has been incorporated into Section 3.3.8, Public-Facing Systems (NIST SP 800-63-3). 54) Former Section, 9.4.7, Media Sanitization is now moved to Section 2.F.3.1, under Destruction and Disposal. 55) Former Sections 9.4.11, Storage Area Networks and 9.4.12, System Component Inventory, 9.4.14, Virtualization Requirements, 9.4.15, VoIP Systems and 9.4.18, Wireless Networks, have been removed, as the base requirements are included in NIST controls. 56) Section 3.3.8, Public-Facing Systems, has been added and includes guidance from NIST SP 800-63-3, Digital Identity Guidelines. 57) Former Section 10.5, FTI Suspension, Termination and Administrative Review language was changed and moved to Section 1.7.2. 58) Control IA-2, Identification and Authentication (Organizational Users), Multifactor authentication is now required for all privileged and non-privileged accounts. 59) Exhibit 6, Contractor 45-Day Notification Procedures, has updated the signature requirement to include the Head of Agency, or their delegate. 60) Exhibit 7 has been updated to include Exhibit 7a, Safeguarding Contract Language for General Services and Exhibit 7b, Safeguarding Contract Language for Technology Services. 61) Exhibits 7a and 7b have been updated to include Data Incident Response language. 62) Exhibit 10, Data Warehouse Security Requirements has been removed. Please see the Safeguards Website for technical guidance. 63) Exhibit 11, Media Sanitization Techniques has been removed. Please see NIST 800-88, Guidelines for Media Sanitization for approved sanitization techniques. Also see MP-6. 64) Glossary and Key Terms has been updated to include the terms Access, Contractor, External Systems, Inadvertent and Incidental Access, Information Spillage, Insider Threat, Mobile Code, Mobile Device, Need-to-Know, Object, Remote Access, Subject, Unauthorized Access and Unauthorized Disclosure. 65) Glossary and Key Terms - The definition for Personally Identifiable Information (PII) has been updated to clarify that for the purposes of Publication 1075 and Safeguarding requirements, PII is FTI. 15 66) Agencies must wipe mobile devices after 10 (ten) unsuccessful login attempts. See AC-7, CE-2. 67) Agencies must employ data mining prevention and detection techniques. See AC-23. 68) Added penetration testing requirements. See CA-8. 69) Perform security and privacy compliance checks prior to allowing connections. See CA-9, CE-1. 70) Multi-factor authentication is required to be at Authenticator Assurance Level 2 as defined in NIST SP 800-63. See IA-2, CE-6. 71) Password complexity requirements have been updated. See IA-5. 72) Agencies must provide training specific training for incidents related to breaches. See IR-2, CE-3. 73) Coordination with contractors, data centers, counties, and other agencies is required for incidents involving Federal Tax Information. See IR-4, CE-8. 74) A custodian must be identified when transporting controls outside of controlled areas. See MP-5, CE-3. 75) Major change to PE-6. The requirement moved from annually to monthly for inspection of physical access logs. 76) Perimeter security checks are required daily for exfiltration of information. See PE-3, CE-2. 77) New Control Enhancement for Defense in Depth. See PL-8, CE-1. 78) Agency contractors (including sub-contractors) must remove data within 7 (seven) calendar days of contract termination. See SA-4, CE-12. 79) Control Enhancement to restrict the accessing, processing, storage, and transmission of FTI to the United States and its territories. See SA-9, CE-5. 80) Change from specifying FIPS 140-3 to latest FIPS validated mechanisms. See SC-13. 81) Added visibility of encrypted communications to system monitoring requirements. See SI-4, CE10. 16 AC-2 AC-3 AC-4 AC-5 AC-6 AC-7 AC-8 AC-11 AC-12 AC-14 AC-17 AC-18 AC-19 AC-20 AC-21 AC-22 AC-23 AT-1 AT-2 AT-3 AT-4 AT-6 AU-1 AU-2 AU-3 AU-4 AU-5 AU-6 AU-7 AU-8 AU-9 Information Technology Access Control Policy and Procedures Account Management Access Enforcement Information Flow Enforcement Separation of Duties Least Privilege Physical AC-1 Control Name Privacy-Related Control Number Control Enhancements Security and Privacy Control Table Physical Security Reference Section X X X X X X X X Unsuccessful Logon Attempts System Use Notification Device Lock Session Termination Permitted Actions Without Identification or Authentication Remote Access Wireless Access Access Control for Mobile Devices Use of External Systems Information Sharing Publicly Accessible Content Data Mining Protection* Awareness and Training Policy and Procedures Awareness Training Role-Based Training Training Records Training Feedback* Audit and Accountability Policy and Procedures Audit Events Content of Audit Records Audit Storage Capacity Response to Audit Processing Failures Audit Review, Analysis and Reporting Audit Reduction and Report Generation Time Stamps Protection of Audit X X X X X X X X X Need-toKnow Exhibit 8 X X X X X X X X X X X X 2.B.7 X X X X X X X X X 2.B.7.1 Exhibit 7 3.3.8 X X X 2.C.2 X X X X X X X X X X 2.D.2.1 2.D.2.1 2.D.2.1 X X 2.C.2 X X X X 2.C.1 X X X X 2.C.1 X X X 2.C.1 X X 17 X X CA-2 CA-3 CA-5 CA-6 CA-7 CA-8 CA-9 CM-1 CM-2 CM-3 CM-4 CM-5 CM-6 CM-7 CM-8 CM-9 CM-10 CM-11 CM-12 CM-13 CM-14 CP-1 CP-2 CP-3 CP-4 CP-9 CP-10 IA-1 IA-2 IA-3 X X Information Technology X Physical Audit Record Retention Audit Generation Cross-Organizational Auditing* Assessment, Authorization and Monitoring Policy and Procedures Assessments System Interconnections Plan of Action and Milestones Authorization Continuous Monitoring Penetration Testing Internal System Connections* Configuration Management Policy and Procedures Baseline Configuration Configuration Change Control Security and Privacy Impact Analyses Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Configuration Management Plan Software Usage Restrictions User-Installed Software Information Location* Data Action Mapping* Signed Components* Contingency Planning Policy and Procedures Contingency Plan Contingency Training Contingency Plan Testing System Backup System Recovery and Reconstitution Identification and Authentication Policy and Procedures Identification and Authentication (Organizational Users) Device Identification and Authentication Privacy-Related AU-11 AU-12 AU-16 CA-1 Control Name Control Enhancements Control Number X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X 18 2.D.3 X X X X 2.D.9 X X X X X 2.C.1 X X X X Physical Security Reference Section 2.C.1 3.2 2.B.6 IA-8 IA-9 IA-11 IA-12 IR-1 IR-2 IR-3 IR-4 IR-5 IR-6 IR-7 IR-8 IR-9 MA-1 MA-2 MA-3 MA-4 MA-5 MA-6 MP-1 MP-2 MP-3 MP-4 MP-5 MP-6 MP-7 PE-1 PE-2 PE-3 PE-4 PE-5 X Information Technology X X Physical Identifier Management Authenticator Management Authenticator Feedback Cryptographic Module Authentication Identification and Authentication (Non-Organizational Users) Service Identification and Authentication* Re-Authentication* Identity Proofing* Incident Response Policy and Procedures Incident Response Training Incident Response Testing Incident Handling Incident Monitoring Incident Reporting Incident Response Assistance Incident Response Plan Information Spillage Response System Maintenance Policy and Procedures Controlled Maintenance Maintenance Tools Nonlocal Maintenance Maintenance Personnel Timely Maintenance* Media Protection Policy and Procedures Media Access Media Marking Media Storage Media Transport Media Sanitization Media Use* Physical and Environmental Policy and Procedures Physical Access Authorizations Physical Access Control Access Control for Transmission Access Control for Output Privacy-Related IA-4 IA-5 IA-6 IA-7 Control Name Control Enhancements Control Number Physical Security Reference Section X X X X X X X X X X X X X X X X X X X X 2.C.2 X X X X X X X X X X X X X X X X X X X X 2.D.2.1 1.8.4 1.8.4 1.8.4 1.8.2 X 1.8.2 X X X X X X X X X 19 X X X X X X 2.B.3.2 2.B.3.3 X 2.C.2 X X X X X X 2.C.11 2.B.6 2.B.6 2.B.4 2.F.3.1 2.B.7.1 X X 2.C.2 X X X X 2.B.3.2 2.B.3 2.B.2 2.B.3.3 PE-6 PE-8 PE-16 PE-17 PL-1 PL-2 PL-4 PL-8 PM-1 PM-2 PM-3 PM-4 PM-5 PM-7 PM-9 PM-10 PM-12 PM-14 PM-18 PM-19 PM-21 PM-29 PS-1 PS-2 PS-3 PS-4 PS-5 PS-6 PS-7 PS-8 PS-9 PT-1 X X X X X X X X X X X X Information Technology Physical Devices Monitoring Physical Access Visitor Access Records Delivery and Removal Alternate Work Site Planning Policy and Procedures Security and Privacy Plans Rules of Behavior Security and Privacy Architectures Information Security Program Plan* Information Security Program Roles Information Security and Privacy Resources* Plan of Action and Milestones Process* System Inventory* Enterprise Architecture* Risk Management Strategy* Authorization Process Insider Threat Program* Testing, Training and Monitoring* Privacy Program Plan* Privacy Program Roles* Accounting of Disclosures* Risk Management Program Leadership Roles* Personnel Security Policy and Procedures Position Risk Designation Personnel Screening Privacy-Related Control Name Control Enhancements Control Number X X X Physical Security Reference Section 2.B.3.2 2.B.3.1 2.B.4 2.B.7 2.E.4 X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X 2.D.9 2.C.2 2.D.2 2.C.2 2.C.2 X Personnel Termination Personnel Transfer Access Agreements External Personnel Security Personnel Sanctions Position Descriptions* Personally Identifiable Information Processing and Transparency Policy and Procedures* X X 20 X 2.C.2 X X X X X X X X 2.C.2 2.C.2 2.C.4.3 2.C.4.1 2.C.2 1.9.3 2.C.4.2 RA-1 RA-3 RA-5 RA-7 RA-8 SA-1 SA-2 SA-3 SA-4 SA-5 SA-8 SA-9 SA-10 SA-11 SA-15 SA-22 SC-1 SC-2 SC-4 SC-7 SC-8 SC-10 SC-12 SC-13 SC-15 SC-17 SC-18 Information Technology Physical Authority to Process Personally Identifiable Information* Risk Assessment Policy and Procedures Risk Assessment Vulnerability Scanning Risk Response* Privacy Impact Assessments* System and Services Acquisition Policy and Procedures Allocation of Resources System Development Life Cycle Acquisition Process Information System Documentation Security Engineering Principles External System Services Developer Configuration Management Developer Security Testing and Evaluation Development Process, Standards and Tools* Unsupported System Components System and Communications Protection Policy and Procedures Application Partitioning Information in Shared System Resources Boundary Protection Transmission Confidentiality and Integrity Network Disconnect Cryptographic Key Establishment and Management Cryptographic Protection Collaborative Computing Devices and Applications Public Key Infrastructure Certificates Mobile Code Privacy-Related PT-2 Control Name Control Enhancements Control Number Physical Security Reference Section X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X 21 X 2.E.4.1 2.C.7 SC-21 SC-22 SC-23 SC-28 SC-35 SC-39 SC-45 SI-1 SI-2 SI-3 SI-4 SI-5 SI-7 SI-8 SI-10 SI-11 SI-12 SI-16 SR-1 SR-2 SR-3 SR-6 SR-10 SR-11 X Information Technology Physical Secure Name/Address Resolution Service (Authoritative Source)* Secure Name/Address Resolution Service (Recursive or Caching Resolver)* Architecture and Provisioning for Name/Address Resolution Service* Session Authenticity Protection of Information at Rest External Malicious Code Identification* Process Isolation* System Time Synchronization* System and Information Integrity Policy and Procedures Flaw Remediation Malicious Code Protection System Monitoring Security Alerts, Advisories and Directives Software, Firmware and Information Integrity* Spam Protection Information Input Validation Error Handling Information Management and Retention* Memory Protection Policy and Procedures Supply Chain Risk Management Plan Supply Chain Controls and Processes Supplier Assessments and Reviews Inspection of Systems or Components Component Authenticity Privacy-Related SC-20 Control Name Control Enhancements Control Number X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X *New to this revision of Publication 1075 22 X Physical Security Reference Section INTRODUCTION General To foster a tax system based on voluntary compliance, the public must maintain a high degree of confidence that the personal and financial information furnished to the Internal Revenue Service (IRS) is protected against unauthorized use, inspection, or disclosure. The IRS must administer the disclosure provisions of the Internal Revenue Code (IRC) according to the spirit and intent of these laws, ever mindful of the public trust. The IRC defines and protects the confidential relationship between the taxpayer and the IRS and makes it a crime to violate this confidence. IRC § 7213 prescribes criminal penalties, making it a felony offense for federal and state employees and others who illegally disclose federal tax returns and return information (FTI). Additionally, IRC § 7213A makes the unauthorized inspection of FTI a misdemeanor, punishable by fines, imprisonment, or both. And finally, IRC § 7431 prescribes civil damages available to the taxpayer upon notification that a criminal indictment or the existence of information that an unauthorized inspection or disclosure has occurred under IRC §§ 7213 or 7213(A). The concerns of citizens and Congress regarding individual rights to privacy require the IRS to continuously assess disclosure practices and the safeguards used to protect the confidential information entrusted. While the sanctions of the IRC are designed to protect the privacy of taxpayers, the IRS recognizes the importance of cooperating to the fullest extent permitted by law with other federal, state, and local authorities in their administration and enforcement of laws. Those agencies or agents that legally receive FTI directly from either the IRS or from secondary sources (e.g., Social Security Administration [SSA]), pursuant to IRC § 6103 or by an IRS-approved exchange agreement must have adequate programs in place to protect the data received. Furthermore, as agencies procure contractor or sub-contractor services, it becomes equally important that contractors or subcontractors protect that information from unauthorized use, access, and disclosure. IRS Safeguards reports and related communications in possession of federal, state, and local agencies are considered the property of the IRS and may not be disclosed to anyone outside the agency and are subject to disclosure restrictions under federal law and IRS rules and regulations. This includes, but is not limited to, Preliminary Findings Report (PFR); Safeguard Review Report (SRR); Safeguard Security Report (SSR) and Corrective Action Plan (CAP). Release of any IRS Safeguards document requires the express permission of the Internal Revenue Service. Requests received through Sunshine and/or Information Sharing/Open Records provisions must be referred to the federal Freedom of Information Act (FOIA) statute for processing. State and local agencies receiving such requests must refer the requestor to the instructions to file a FOIA request with the IRS. Federal agencies must follow established procedures that require consultation before citing FOIA exemptions on IRS agency records, or directly refer the FOIA request to IRS for processing. The intent of this requirement is to address any public request for sensitive information and prevent disclosure of data that would put FTI at risk. The agency may still distribute these reports internally and within other state agencies, or to auditors or oversight panels as required to either take corrective actions or report status without further IRS approval. Additional guidance may be found at, https://www.irs.gov/uac/IRS-Freedom-of-Information, and questions should be referred to the Safeguards mailbox at Safeguardreports@irs.gov. 23 Overview of Publication 1075 This publication provides guidance to ensure the policies, practices, controls, and safeguards employed by recipient agencies, agents, contractors, or sub-contractors adequately protect the confidentiality of FTI. Enterprise security policies address the purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities and compliance to implement all applicable security controls. This document contains the managerial, operational, and technical security controls that must be implemented as a condition of receipt of FTI. The guidelines outlined herein apply to all FTI, no matter the amount or the media in which it is recorded. FTI must be afforded the same levels of protection regardless of it residing on paper or electronic form. Systematic, procedural, or manual security policies must minimize circumvention. A mutual interest exists in our responsibility to ensure that FTI is disclosed only to persons authorized and used only as authorized by statute or regulation. The IRS is confident of your diligence in this area and believes that this publication will be a helpful resource. Conforming to these guidelines meets the safeguard requirements of IRC § 6103(p)(4) and makes our joint efforts beneficial. Requirements throughout this document apply to all organizational segments of an agency receiving FTI. It is the agency’s responsibility to ensure all functions within the agency, including consolidated data centers, contractors, and sub-contractors (where allowed by federal statute) with access to FTI, understand and implement the requirements in this publication. This publication provides the preliminary steps to consider before submitting a request to receive FTI, requirements for proper protection, expectations from the IRS and considerations that may be helpful in establishing a program to protect FTI. The exhibits in this publication are provided for additional guidance. IRS Safeguards is responsible for all interpretations of safeguarding requirements. Publication 1075 requirements may be supplemented or modified between editions of Publication 1075 via guidance issued by Safeguards and posted on the Safeguards website. SAFEGUARD RESOURCES Safeguards Website Safeguards maintains Publication 1075, templates, guidance and frequently asked questions online at http://www.irs.gov/uac/Safeguards-Program. Agencies are highly encouraged to regularly visit the website for updates. The website contains many resources to assist agencies with meeting Publication 1075 requirements. Examples of the website’s features include: • Safeguard alerts and technical assistance documents • Recommendations on how to comply with Publication 1075 requirements • Reporting requirement templates (e.g., SSR) and guidance • Instructions for reporting unauthorized accesses, disclosures, or data breaches • Internal inspections report templates and instructions 24 • IRS disclosure awareness videos and resources • Review Preparation Questionnaire (RPQ) • Cybersecurity requirements documented in Safeguard Computer Security Evaluation Matrix (SCSEM) templates organized by technology or topic • Nessus audit files Safeguards Mailbox The Safeguards Mailbox is an acceptable alternative for communicating information or questions to the Office of Safeguards relative to safeguarding requirements and Publication 1075. The Mailbox is located at SafeguardReports@irs.gov. The Office of Safeguards requires that all reports, when sent to the Office of Safeguards via email, be transmitted using IRS-approved encryption methods as described in Section 2.E.3 Encryption Requirements. Below are items that are appropriate for submission to the Mailbox: • Safeguards Reports and Extension Requests • 45-Day Notifications • Publication 1075 Technical Inquiries • Re-Disclosure Agreements • Data Incident Reporting • Ad hoc Points of Contact changes KEY DEFINITIONS This section establishes a baseline of key terms used throughout this publication. For additional definitions of terms and phrases, refer to Glossary and Key Terms. Federal Tax Information Safeguarding FTI is critically important to continuously protect taxpayer confidentiality as required by IRC § 6103. FTI consists of federal tax returns and return information (and information derived from it) that is in the agency’s possession or control that is covered by the confidentiality protections of the IRC and subject to the IRC § 6103(p)(4) safeguarding requirements including IRS oversight. FTI is categorized as Sensitive But Unclassified (SBU) information and may contain personally identifiable information (PII). FTI includes return or return information received directly from the IRS or obtained through an authorized secondary source such as Social Security Administration (SSA), Federal Office of Child Support Enforcement (OCSE), Bureau of the Fiscal Service (BFS) or Centers for Medicare and Medicaid Services (CMS) or another entity acting on behalf of the IRS pursuant to an IRC § 6103(p)(2)(B) Agreement. FTI includes any information created by the recipient that is derived from federal return or return information received from the IRS or obtained through a secondary source. FTI may not be masked to change the character of information to circumvent IRC § 6103 confidentiality requirements. 25 Return and Return Information IRC § 6103(b)(1) defines a return as any tax or information return, estimated tax declaration or refund claim (including amendments, supplements, supporting schedules, attachments or lists) required by or permitted under the IRC and filed with the IRS by, on behalf of, or with respect to any person or entity. Examples of returns include forms filed on paper or electronically, such as Forms 1040, 941, 1120 and other informational forms, such as 1099 or W -2. 1 Forms include supporting schedules, attachments or lists that are supplemental to or part of such a return. Return information, in general, is any information collected or generated by the IRS regarding any person’s liability or possible liability under the IRC. IRC § 6103(b)(2)(A) defines return information very broadly. It includes but is not limited to: • Information that IRS obtained from any source or developed through any means that relates to the potential liability of any person under the IRC for any tax, penalty, interest, fine, forfeiture or other imposition or offense • Information extracted from a return, including names of dependents or the location of business • The taxpayer’s name, address, and identification number • Information collected by the IRS about any person’s tax affairs, even if identifiers, such as name, address and identification number are deleted • Status of whether a return was filed, under examination or subject to other investigation or processing, including collection activities • Information contained on transcripts of accounts Personally Identifiable Information (PII) FTI may include Personally Identifiable Information (PII). FTI may include the following PII elements: • Name of a person with respect to whom a return is filed • Taxpayer mailing address • Taxpayer identification number • Email addresses • Telephone numbers • Social Security Numbers • Bank account numbers • Date and place of birth • Mother’s maiden name 1 Refer to IRS.gov for a complete catalog of IRS forms 26 • Biometric data (e.g., height, weight, eye color, fingerprints) • Any combination of the above For the purposes of Publication 1075 and Safeguarding requirements, PII is FTI when provided by the IRS or a secondary source (i.e., SSA, BFS). Information Received from Taxpayers or Third Parties Copies of tax returns or return information provided to the agency directly by the taxpayer or their representative (e.g. W-2’s, Form 1040, etc.) or obtained from public information files (e.g. federal tax lien on file with the county clerk, Offers in Compromise available for public inspection, court records, etc.) is not protected FTI that is subject to the safeguarding requirements of IRC § 6103(p)(4). If the agency independently verifies FTI provided by the IRS or a secondary source (i.e., SSA, BFS) with the taxpayer or a third-party source (linked to the taxpayer), the verified information is no longer FTI as long as the IRS source information is replaced or overwritten with the newly provided information. Access Access means when an individual: (1) enters a restricted or locked area, room, container, or system containing federal tax information; or (2) obtains, acquires, receives, examines, uses, or gains knowledge of federal tax information, by physical, electronic, or any other methods. Users (e.g., system administrators, database administrators) have access to FTI if they have the ability to modify or bypass security controls protecting FTI (to include decryption keys). Cloud Computing Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable, computing resources (e.g., networks, servers, storage, applications and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. Inadvertent Access Access to FTI without authority that is non-willful and unanticipated or accidental. Inadvertent Disclosure Accidental exposure of information to a person not authorized access. Incidental Access Access to FTI without a need-to-know that may occur in extraordinary circumstances (i.e., system failure, data incident response, disaster response). Unauthorized Access Unauthorized access occurs when a person gains logical or physical access to FTI without authority under IRC § 6103 and without a need-to-know (which would include but is not limited to agency employees with no need to know and/or janitors and security guards when there is no second barrier securing the federal tax information as well as developers/administrators of electronic systems/applications receiving, processing, storing or transmitting federal tax information). 27 Access to FTI is permitted only to individuals who require the FTI to perform their official duties and as authorized under the IRC. FTI must never be indiscriminately disseminated, even within the recipient agency, body, or commission. Agencies must evaluate the need for FTI before the data is requested or disseminated. Inadvertent access is access to FTI without authority and is non-willful. Willful access to FTI by a person without authorization or need-to-know may be prosecuted under IRC § 7213A. Unauthorized Disclosure Unauthorized disclosure occurs when a person with access to FTI discloses it to another person without authority under IRC § 6103. An unauthorized disclosure has occurred when FTI is knowingly or due to gross negligence provided to an individual who does not have the statutory right to have access to it under the IRC. Even without willfulness or gross negligence FTI is not to be disclosed to entities or individuals who are not authorized by IRC § 6103 to have it. Inadvertent disclosure is disclosure of FTI without authority and is non-willful. Willful disclosure of FTI to a person without authorization or need-to-know may be prosecuted under IRC § 7213. Need-to-Know Need-to-know is established when individuals require FTI to perform their official duties and are authorized under the IRC. Limiting access to individuals on a need-to-know basis reduces opportunities to “browse” or improperly view FTI. Restricting access to designated personnel minimizes improper access or disclosure. FTI disclosures must be limited to what is essential to accomplish official duties. Adverse Action An adverse action includes a suspension of 15 days or more, a reduction in pay, or termination of employment. Disciplinary Action A disciplinary action includes an admonishment, written reprimand, or suspension of 14 days or less. Personnel Sanction A disciplinary or adverse action for individuals failing to comply with established information security policies and procedures constitutes a personnel sanction. 28 1.0 FEDERAL TAX INFORMATION, REVIEWS and OTHER REQUIREMENTS 1.1 General IRC § 6103 is a confidentiality statute and generally prohibits the disclosure of FTI (see Exhibit 1, IRC § 6103(a) and (b), for general rules and definitions). Exceptions to the general rule authorize disclosure of FTI to certain federal, state, and local agencies. Generally, these disclosures are made by the IRS in response to written requests signed by the head of the requesting agency or an authorized delegate. FTI so disclosed may be used by the receiving agency solely for the purpose described in the exception authorizing the disclosure. The statutes providing authorization to disclose FTI contain specific conditions that may require different procedures in maintaining and using the information. These conditions are outlined under specific sections in this publication. As a condition of receiving FTI, the receiving agency must show, to the satisfaction of the IRS, the ability to protect the confidentiality of that information. Certain safeguards must be implemented to prevent unauthorized access and use. Besides written requests, the IRS may require formal agreements that specify, among other things, how the information will be protected. An agency must ensure its safeguards will be ready for immediate implementation upon receipt of FTI. Copies of the initial and subsequent requests for data and any formal agreement must be retained by the agency a minimum of five (5) years as a part of its recordkeeping system. Agencies must always maintain the latest SSR on file. The initial request for FTI must be followed by submitting a SSR to Safeguards at least 90 days before the scheduled or requested receipt of FTI (see Section 2.E, Reporting Requirements—6103(p)(4)(E)). The SSR must include processing and safeguard procedures for all FTI received and distinguish between agency programs and functional organizations using FTI. Multiple organizations, divisions or programs within a federal agency using FTI must be consolidated into a single report for that agency at the direction of Safeguards. Agencies entering into an agreement to disclose FTI to agents, contractors, or sub-contractors requires advance notice to IRS Safeguards (see Section 2.E.6 Notification Reporting Requirements and Section 1.9.4, Disclosing FTI to Contractors or Sub-Contractors.) Agencies must exercise care in outlining their safeguard program. Reports that lack clarity or sufficient information will be returned to the submitting agency for additional documentation. 1.2 Authorized Use of FTI Any agency that receives FTI for an authorized use may not use that information in any manner or for any purpose not consistent with that authorized use. If an agency needs FTI for a different authorized use under a different provision of IRC § 6103, a separate request must be sent to IRS Disclosure. An unauthorized secondary use of FTI is specifically prohibited and may result in discontinuation of disclosures to the agency and imposition of civil or criminal penalties on the responsible officials. The Office of Safeguards validates that an agency’s “need and use” of FTI conforms with the governing provisions allowing the disclosure of FTI. The agency’s SSR must describe the purpose(s) for which FTI is collected, used, maintained and shared. 29 1.3 Secure Data Transfer The IRS established a Secure Data Transfer (SDT) program to provide encrypted electronic transmission of FTI between the IRS and trading partners. For support with establishing an IRS SDT account, please submit an SDT Customer Support Request. Complete information on establishing an SDT account is available in the SDT Handbook. The SDT Handbook is available from a local IRS governmental liaison or a request to the Safeguards mailbox. Only the following types of documents will be accepted via SDT: • Control File (.txt) • Adobe (.pdf) • Word Document (.doc or .docx) • Excel Document (.xls or.xlsx) • Zipped File (.zip) Contact the SafeguardReports@irs.gov mailbox for specific details on how to submit information via SDT. 1.4 State Tax Agency Limitations FTI may be obtained per IRC § 6103(d) by state tax agencies only to the extent the information is needed for and is reasonably expected to be used for state tax administration. An agency’s records must include some account of the result of its use of FTI (e.g., disposition of closed cases and summary of revenues generated) or include reasons why the information was not used. If any agency continually receives FTI that it is unable to use for any reason, it must contact the IRS official liaison and discuss the need to stop the receipt of this FTI. State tax agencies using FTI to conduct statistical analysis, tax modeling or revenue projections must notify the IRS by submitting a signed Need and Use Justification Statement for Use of Federal Tax Information form and follow the established guidelines (available through the assigned Governmental Liaison). Annually, the agency must provide updated information in the SSR regarding its modeling activities that include FTI. In the SSR, the agency must describe: • Any use of FTI that is in addition to what was described in the original Need and Use Justification Form • Any new, previously unreported internal tax administration compilations that include FTI • Changes to the listing of authorized employees (Attachment B to the Need and Use Justification Form) If the agency intends to use a contractor or sub-contractor for conducting statistical analysis, tax modeling or revenue projections, it must submit a 45-day notification (see Section 1.9.4, Disclosing FTI to Contractors or Sub-Contractors) prior to contractor or sub-contractor access to the FTI. The agency’s SSR must detail the use of FTI for this purpose. In addition, the agency must submit a separate statement detailing the methodology used and data to be used by the contractor or sub-contractor. The Office of Safeguards and Statistics of Income functions will review the information provided to confirm that 30 adequate safeguarding protocols are in place and that the modeling methodology to be used to remove taxpayer identifying information is appropriate. 1.5 Coordinating Safeguards within an Agency Because of the diverse purposes that authorized disclosures may be made to an agency and the division of responsibilities among different components of an agency, FTI may be received and used by several quasi-independent units within the agency’s organizational structure. Where there is such a dispersal of FTI, the agency must centralize safeguarding responsibilities to the greatest extent practical and establish and maintain uniform safeguard standards consistent with IRS guidelines. The official(s) assigned these responsibilities must hold a position high enough in the agency’s organizational structure to ensure compliance with the agency safeguard standards and procedures. The selected official(s), or point(s) of contact (POC(s)) must also be responsible for ensuring that internal inspections are conducted, submission of required safeguard reports to the IRS, properly reporting any data breach incidents, disclosure awareness training and for any necessary liaison with the IRS. 1.6 Safeguard Reviews A safeguard review is an on-site, remote, or a combination of both (hybrid) evaluation of the use of FTI and the measures employed by the receiving agency and its agents (where authorized) to protect the data. • On-site reviews: Disclosure Enforcement Specialists (DES), Cybersecurity Reviewers (CSR), and Management Officials will conduct an on-site evaluation of the security and privacy controls implemented by the agency and all supporting parties. Assessment techniques include, but are not limited to visual inspections, observations, interviews, document exchange, and automated scanning. • Remote reviews: Disclosure Enforcement Specialists, Cybersecurity Reviewers, and Management Officials will conduct a remote evaluation of the security and privacy controls implemented by the agency and all supporting parties using secured collaborative technologies (e.g., screen-sharing capabilities, teleconferences, video enabled software, etc.). Assessment techniques include, but are not limited to visual inspections, observations, interviews, document exchange, and automated scanning. This review includes all FTI received whether from the IRS or a secondary source such as SSA, Bureau of the Fiscal Service or another agency (see Federal Tax Information). Safeguard reviews are conducted to determine the adequacy of safeguards as opposed to evaluating an agency’s programs. Several factors will be considered when determining the need for a review, the type of review, and the frequency of which a review will be conducted. 1.6.1 Before the Review The IRS initiates the review by communication with an agency point of contact (POC) as reported by the agency in the SSR. The preliminary discussion will be followed by a formal engagement letter to the agency head, which provides official notification of the planned safeguard review. This engagement letter outlines what the review will encompass. Additional requests for specific information will be provided to the agency POC. These requests may include a list of records to be reviewed (e.g., training manuals, flowcharts, policies, awareness program documentation and organizational charts relating to the processing of FTI). Prior to the review, the agency POC will receive information regarding the manner in which the review will be conducted (e.g., on-site and/or remote), the 31 scope and purpose of the review, a list of the specific areas to be reviewed and agency personnel to be interviewed. A Preliminary Security Evaluation (PSE) call will be held to determine the scope of the review (see NIST Control PM-5 CE-1, Inventory of PII). The electronic flow of FTI will be discussed to provide the review team with a thorough understanding of the location and use of FTI throughout the agency’s infrastructure. During the call primary POCs will be introduced, the scope of the review will be defined, assessment logistics will be discussed, and any questions will be answered. Participants should include agency IT staff knowledgeable about the location and flow of FTI throughout the agency as well as staff or contractors from other locations such as consolidated data centers. Additionally, mini-PSE calls for contractors, sub-contractors, off-site locations, etc. may be needed to obtain additional information in determining the review scope. Requests for additional information and clarification to include automated scanning procedures will be discussed after the PSE call(s) and a proposed scope will be provided. 1.6.2 During the Review The review process validates the accuracy of the SSR and conformance with the current version of Publication 1075 requirements and National Institute of Standards and Technology (NIST) Special Publication 800-53. At the opening conference, review procedures will be communicated, followed by a data flow discussion, and confirming the flow of FTI (see NIST Control PM-5 CE-1, Inventory of PII). Observing actual operations is a required step in the review process. Sites to be reviewed will be based on the flow of the FTI, which may include, but are not limited to, field offices, consolidated data centers, off-site storage facilities, disaster recovery sites, contractor and sub-contractor sites. Review methods may include but are not limited to: • Spot check agency records for FTI • Employee interviews • Facility tours • Document review • Automated/manual testing (See Safeguards website for tools used for automated testing) • Remote assessment tools Agencies must facilitate execution of the review methods utilized by Safeguards staff. Agency management approval must be obtained prior to review, if agency policies and procedures contradict any of these methods. The agency POC will be advised the of critical issues and findings as the review progresses. A briefing will be held with the POC to go over the Preliminary Findings Report (PFR) before the closing conference. The closing conference is held upon completion of the agency’s review, where the PFR is issued to provide the agency an overview of the findings identified during the review. 1.6.3 After the Review An SRR and CAP will be issued within 45 days of the closing conference to document the review findings. Requests for corrections to the SRR must be emailed to the SafeguardReports@irs.gov mailbox. The Office of Safeguards will respond with an acknowledgement and a determination. 32 Each finding will be identified with a criticality level that identifies potential risk to loss, breach or disclosure of FTI. Safeguards Finding Criticality Definitions Impact Level Limited Moderate Significant Critical Definition The potential impact is Limited if the vulnerability could be expected to have a low or minimal adverse effect on the ability to maintain the confidentiality and integrity of FTI. The potential impact is Moderate if the vulnerability could be expected to have a demonstratable adverse effect on the ability to maintain the confidentiality and integrity of FTI. The potential impact is Significant if the vulnerability could be expected to have severe and/or imminent adverse effect on the ability to maintain the confidentiality and integrity of FTI. The potential impact is Critical if the vulnerability has an immediate adverse effect on the confidentiality and integrity of FTI. All findings must be addressed in a timely fashion. The Office of Safeguards will identify deadlines for resolution based upon the risk associated with each finding. Outstanding issues must be resolved and addressed in the next reporting cycle of the CAP. If the Agency has any critical findings, the agency must submit a mitigation plan to Safeguards within 7 days from the closing conference date. Safeguards will report the critical findings along with your agency plan to the Treasury Inspector General for Tax Administration (TIGTA). The CAP must be updated and submitted semi-annually using the last CAP issued by the Office of Safeguards (see Section 2.E.5, Corrective Action Plan) until all review findings are accepted as closed. If an agency has a CAP due within 60 days of the review, that CAP is not required because the remaining open findings will be handled as part of the upcoming on-site or remote Safeguard Review Each CAP submission must include an explanation and/or evidence of actions already taken or planned to resolve all outstanding findings. The agency must submit an actual or planned implementation date for each outstanding finding. 1.7 Termination of FTI 1.7.1 Agency Request 1.7.1.1 Termination Documentation When an agency no longer requires FTI, notify Safeguards at SafeguardReports@irs.gov by providing the following: 1. Copies of notifications to all agencies from which FTI is received, that FTI will no longer be requested, and 2. Letter from the Head of Agency certifying that all residual FTI has been destroyed. (See Section 2.F Disposal of FTI – IRC § 6103(p)(4)(F)) 33 Once documentation is reviewed, the Office of Safeguards will send an acknowledgement of the agency’s termination, instructions on Safeguard reporting and on-site review obligations. Instructions for reinstatement will be included in the acknowledgement letter. 1.7.1.2 Archiving FTI Procedure This section is for agencies terminating receipt of FTI but required by statute to retain FTI for designated periods. If residual FTI is required to be retained by statute for a designated period (e.g., 5 or 10 years), then agencies must: • Ensure that a currently authorized agency, contractors, or sub-contractor retain FTI in accordance with Publication 1075 security standards • Provide copies of notifications as shown in Section 1.7.1.1, Termination Documentation • Submit an annual SSR each year while the agency has possession or oversight of the data • Continue to be subject to periodic Safeguard Reviews • Submit a letter from Head of Agency certifying that all residual FTI has been destroyed when the retention period has ended 1.7.2 FTI Suspension, Termination and Administrative Review The IRS may terminate or suspend disclosure of return and return information to any authorized recipient under 6103(p)(4), if the IRS determines that: 1. The authorized recipient (or agency) has allowed an unauthorized inspection or disclosure of FTI and has not taken adequate corrective action to prevent the recurrence of an unauthorized inspection or disclosure; or 2. The authorized recipient does not satisfactorily maintain the safeguards prescribed by Section 6103(p)(4) and Publication 1075 and has made no adequate plan to improve its system to maintain the safeguards satisfactorily. Prior to terminating FTI, the IRS will notify the authorized recipient in writing and may suspend further disclosures if it is deemed that federal tax administration would be seriously impaired. Agencies in receipt of the termination or suspension letter may appeal the determination as outlined in Exhibit 3, USC Title 26, CFR § 301.6103(p)(7)-1. 1.8 Reporting Improper Inspections or Disclosures 1.8.1 Terms 1.8.1.1 Data Incident A data incident is an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures or acceptable use policies. Incidental and inadvertent accesses are considered data incidents. An incident involving the loss or theft of an IRS asset containing FTI, or the loss or theft of a physical document that includes FTI, or the inadvertent disclosure of FTI, is known as a data breach. See the Data Breach definition below. Often, an occurrence may be first identified as an incident, but later identified as 34 a data breach once it is determined that the incident involves FTI. This is often the case with a lost or stolen laptop or electronic storage device. 1.8.1.2 Data Breach A data breach is a type of incident involving a loss, theft, or inadvertent disclosure of FTI. A data breach is defined as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where: • a person other than an authorized user accesses or potentially accesses FTI or, • an authorized user accesses or potentially accesses FTI for an unauthorized purpose. A data breach is not limited to an occurrence where a person other than an authorized user potentially accesses FTI by means of a network intrusion, a targeted attack that exploits website vulnerabilities, or an attack executed through an email message or attachment. A data breach may also include the loss or theft of physical documents that include FTI and portable electronic storage media that store FTI, the inadvertent disclosure of FTI on a public website or an oral disclosure of FTI to a person who is not authorized to receive that information. It may also include an authorized user accessing FTI for an unauthorized purpose. Some common examples of a data breach include: • A laptop or portable storage device storing FTI is lost or stolen. • An email containing FTI is inadvertently sent to the wrong person. • A box of documents with FTI is lost or stolen during shipping. • An unauthorized third party overhears agency employees discussing FTI. • A user with authorized access to FTI sells it for personal gain or disseminates it. • An IT system that maintains FTI is accessed by a malicious actor. • FTI is posted inadvertently on a public website. 1.8.2 General A written policy must be established and distributed that covers incident management. The policy must clearly state the actions that will be taken for the improper inspection or disclosure of FTI. Upon discovering a possible improper inspection or disclosure of FTI, including breaches and incidents, by a federal employee, a state employee or any other person, the individual making the observation or receiving information must contact the local Treasury Inspector General for Tax Administration (TIGTA) Field Division office, to the Special Agent-in-Charge, immediately, but no later than 24 hours after identification of a possible issue involving FTI. See NIST IR-6, Incident Reporting and IR-8, Incident Response Plan. Local TIGTA Field Division Office contact information can be found on the TIGTA website at https://www.treasury.gov/tigta/oi_office.shtml. If unable to contact the local TIGTA Field Division, contact the Hotline Number. Hotline Number: 800-366-4484 during normal working hours for immediate assistance. 35 Note: After regular business hours, call 800-589-3718. This number reaches an answering service which answers all calls from all locations in the United States 24 hours a day 7 days a week. The answering service will contact the on-call TIGTA agent. TIGTA Homepage: https://www.treasury.gov/tigta Mailing Address: Treasury Inspector General for Tax Administration Ben Franklin Station P.O. Box 589 Washington, DC 20044-0589 For intrusions, manipulations or compromises of computer networks, as well as external cyber-based actions that interfere with the IRS’s ability to conduct electronic tax administration, or any breach that involves unauthorized disclosure within an IT environment, contact TIGTA Electronic Crimes & Intelligence Division at cybercrimes@tigta.treas.gov . Information spillage refers to instances where FTI is inadvertently placed on systems that are not authorized to handle FTI or are not part of the agency's intended FTI workflow. Upon discovery, corrective action is required to remove the FTI from the unintended system and ensure there were no unauthorized accesses or disclosures. If no FTI is involved, then there is no need to report the spill to the Office of Safeguards or TIGTA. If the agency cannot show FTI was not involved within that 24-hour period, then the spill will need to be reported to the Office of Safeguards and TIGTA. 1.8.3 Office of Safeguards Notification Process Concurrent to notifying TIGTA, the agency must notify the Office of Safeguards by email to Safeguards mailbox, safeguardreports@irs.gov. To notify the Office of Safeguards, the agency must document the specifics of the incident or breach known at that time into a data incident report, including but not limited to: • Name of agency and agency POC for resolving data incident with contact information • Date and time the incident/breach occurred • Date and time the incident/breach was discovered • How the incident/breach was discovered • Description of the incident/breach and the data involved, including specific data elements, if known • Potential number of FTI records involved; if unknown, provide a range if possible • Address where the incident/breach occurred • IT involved (e.g., laptop, server, mainframe) • Does the incident involve an unauthorized access or disclosure by an agency employee? (Y/N) 36 • If a criminal indictment is not pursued, will a disciplinary or adverse action be proposed against the agency employee involved in this unauthorized access or disclosure? (Y/N) Reports must be sent electronically and encrypted via IRS-approved encryption techniques as outlined in Section 2.E.3, Encryption Requirements. Use the term “data incident report” in the subject line of the email. Do not include any FTI in the data incident report. Even if all information is not available, immediate notification is the most important factor, not the completeness of the data incident report. Additional information must be provided to the Office of Safeguards as soon as it is available. The agency will cooperate with TIGTA and Office of Safeguards investigators, providing data and access as needed to determine the facts and circumstances of the incident. 1.8.4 Incident Response Procedures In the event of an unauthorized disclosure or data breach, the agency must contact TIGTA and the IRS immediately. Both TIGTA and the IRS must be contacted within 24 hours of the discovery of the disclosure or breach. The agency must not wait to conduct an internal investigation to determine if FTI was involved. Any internal investigation conducted by the agency should not delay the timely reporting of the disclosure or breach. Incident response policies and procedures required in NIST Control IR-1, Incident Response Policy and Procedure, must be used when responding to an identified unauthorized disclosure or data breach incident. The Office of Safeguards will coordinate with the agency regarding appropriate follow-up actions required to be taken by the agency to ensure continued protection of FTI. Once the incident has been addressed, the agency will conduct a post-incident review to ensure the incident response policies and procedures provide adequate guidance. Any identified deficiencies in the incident response policies and procedures must be resolved as soon as reasonably possible. Additional training on any changes to the incident response policies and procedures must be provided to all employees, including contractors, subcontractors and consolidated data center employees, immediately. See NIST Control IR-4, Incident Handling for additional information. The agency must test the incident response capability annually using tabletop exercises to determine the incident response effectiveness and document the results. See NIST Control IR-3, Incident Response Testing. The agency must track and document system security and privacy incidents. See NIST Control IR-5, Incident Monitoring. 1.8.5 Incident Response Notification to Impacted Individuals The agency must provide written notification to a taxpayer whose FTI was subject to unauthorized access or disclosure when a disciplinary or adverse action is proposed against the agency employee responsible. The required written notification to the taxpayer must include the date of the unauthorized inspection or disclosure and the rights of the taxpayer under IRC § 7431. The agency must confirm to the Office of Safeguards when the required written notification to the taxpayer is completed. In addition, the agency must inform the Office of Safeguards of any pending media releases, including sharing a draft of the release, prior to distribution. 37 1.9 Disclosure to Other Persons 1.9.1 General Disclosure of FTI is prohibited unless authorized by statute. Agencies with access to FTI are not allowed to make further disclosures of that information to their agents, contractor, or sub-contractor unless authorized by statute. See NIST Control AC-21, Information Sharing. Agencies must use specific language in their contractual agreements that clearly state the requirements necessary to protect the confidentiality of FTI and avoid ambivalence or ambiguity (see the model language of Exhibit 7). For additional requirements on contracts, see Exhibit 6, Contractor 45-Day Notification Procedures. Absent specific language in the IRC or where the IRC is silent in authorizing an agency to make further disclosures, the IRS’s position is that further disclosures are unauthorized. 1.9.2 Authorized Disclosure Precautions When disclosure of FTI is authorized, the agency must take certain precautions prior to redisclosure to a contractor or sub-contractor, namely: • Has the IRS been given sufficient notice prior to releasing FTI to a contractor or sub-contractor? • Has the agency been given reasonable assurance through a visitation or received a report certifying that all security standards (physical and IT systems) have been addressed? • Does the contract authorizing the disclosure of FTI have the appropriate safeguard language? See the model language of Exhibit 7, Safeguarding Contract Language. Agencies must fully report to the IRS in their SSRs all disclosures of FTI to contractors and subcontractors. Any additional disclosures to contractors and sub-contractors must be reported using the Notification process and reported on the next annual SSR. An agency may not contract for the disclosure of FTI that is not authorized by IRC § 6103. Only contracts for services that require access to FTI to perform their duties under the contract are required to comply with these standards. 1.9.3 External Personnel Security An external provider refers to organizations other than the agency operating or acquiring the system. External providers include, for example, contractors or sub-contractors and other organizations providing system development, information technology services, outsourced applications, testing/assessment services and network and security management. Agencies must include personnel security requirements in contracts. External providers may have personnel working at agency facilities with credentials, badges or system privileges. Notifications of external personnel changes ensure appropriate termination of privileges and credentials. See NIST Control PS-7, External Personnel Security. 1.9.4 Disclosing FTI to Contractors or Sub-Contractors The agency must notify the Office of Safeguards prior to re-disclosing FTI to contractors or subcontractors. The agency must notify and obtain written approval from the Office of Safeguards prior to redisclosing FTI to sub-contractors (when the agency’s contractor uses or desires to re-disclose FTI to another contractor). See Section 2.E, Reporting Requirements - 6103(p)(4)(E) and Section 2.E.6, Notification Reporting Requirements, for additional information. 38 In addition to the notification, the agency must: • Establish privacy roles and responsibilities for contractors or sub-contractors and service providers to safeguard the confidentiality and integrity of FTI. • Include privacy requirements in contracts and other acquisition-related documents. • Share FTI externally only for the purposes statutorily authorized. • Where appropriate, enter into a contract, an SLA, memoranda of understanding, memoranda of agreement, letters of intent, computer matching agreement or similar agreement, with third parties that specifically describe the FTI covered and specifically enumerate the purposes for which the FTI may be used. • Monitor, audit and train its staff on the authorized uses and sharing of FTI with third parties and on the consequences of unauthorized use or sharing of FTI. • Require agency notification of contractor or sub-contractor personnel changes to ensure appropriate termination of privileges and credentials. See NIST Control PS-7, External Personnel Security. • Evaluate any proposed new instances of sharing FTI with third parties to assess whether they are authorized. • Require contractor or sub-contractor employ a formal sanction process for contractor employees and, when permitted by statute, sub-contractor employees failing to comply with established information security policies and procedures for FTI. Notification of designated agency personnel is required within 72 hours. If the agency requires the use of a contractor to conduct tax modeling, revenue estimation or other statistical activities, 45-day notification requirements apply (see Section 1.9.4, Disclosing FTI to Contractors). The Taxpayer First Act § 2004, which added IRC § 6103(p)(9), formalizes in statute the following agency requirements effective December 31, 2022: • Agencies must require that contractors, sub-contractors, or other agents have requirements in effect to provide safeguards required under IRC § 6103(p)(4) to protect FTI. • The Taxpayer First Act also codifies agency responsibilities to conduct on-site reviews of contractors, sub-contractors, and other agents and provide the findings of these reviews to Safeguards as part of the report required under IRC § 6103(p)(4)(E). • Agencies will provide the Office of Safeguards with an annual certification that each contractor, subcontractor, or other agent is in compliance with the above requirements. This certification will be included as part of the report required under IRC § 6103(p)(4)(E). • Agency requirements for this new legislation will be issued prior to implementation in the form of an Interim Guidance memorandum. 39 1.9.5 Re-Disclosure Agreements When required regulatory prerequisite steps are satisfied and where appropriate, under the authority of IRC § 6103(p)(2)(B), the IRS may execute an agreement with an agency that authorizes the re-disclosure of FTI to another entity. These agreements are negotiated and approved by IRS Disclosure with concurrence of the Office of Safeguards. Agreements must include language to enforce the requirements for: • Incident reporting related to FTI • Implementing personnel sanctions for failure to comply with established information security policy and procedures related to FTI • Confirmation to the agency any proposals of disciplinary and adverse action concerning unauthorized accesses and disclosures involving FTI • Notification of individuals whose FTI was subject to unauthorized access or disclosure including the date the unauthorized access or disclosure of FTI occurred. Federal agencies authorized by statute to enter into re-disclosure agreements are required to provide a list of all executed agreements annually in the SSR. When requested by the Office of Safeguards, agencies must provide a copy of all re-disclosure agreements within 30 days. An electronic copy must be sent to the Office of Safeguards via SDT. If SDT is not available, the agreements may be emailed to the SafeguardReports@irs.gov mailbox. 1.10 Return Information in Statistical Reports 1.10.1 General IRC § 6103 authorizes the disclosure of FTI to specific federal agencies for use in statistical reports, tax administration purposes and certain other purposes specified in IRC § 6103(j). Statistical reports may only be released in a form that cannot be associated with, or otherwise identify, directly or indirectly, a particular taxpayer. Agencies authorized to produce statistical reports must adhere to the following guidelines or an equivalent alternative that has been approved by the IRS: • Access to FTI must be restricted to authorized personnel. • No statistical tabulation may be released outside the agency with cells containing data from fewer than three returns. The exception to this rule is for corporation returns where no tabulation with cells containing data for fewer than five returns may be released. • Statistical tabulations prepared at the state level may not be released for cells containing data for fewer than 10 returns. Data for geographic areas below the state level such as county may not be released with cells containing data from fewer than 20 returns. In addition, for tabular data at the ZIP Code level, additional procedures must be employed. Individual ZIP Code areas with fewer than 100 returns cannot be shown. Additionally, any cell in the ZIP Code table based on fewer than 20 returns cannot be shown. Finally, individual returns that represent a large percentage of the total of a particular cell must be excluded from the data. • Tabulations that would pertain to specifically identified taxpayers or that would tend to identify a particular taxpayer, either directly or indirectly, may not be released. 40 1.10.2 Making a Request under IRC § 6103(j) Federal agencies seeking statistical information from the IRS must make their requests under IRC § 6103(j). The requests must be addressed to: Director, Statistics of Income Division Internal Revenue Service, OS:P:S 1111 Constitution Avenue, NW Washington, D.C. 20224 1.10.3 State Tax Agency Statistical Analysis State tax agencies must provide written notification and obtain IRS approval prior to performing tax modeling, revenue estimation or other statistical activities involving FTI. The agency must demonstrate that the activity is required for tax administration purposes. The agency must adhere to the following process to submit a request: 1. Contact the local IRS disclosure manager 2 and complete a Need and Use Justification for Federal Tax Information Form. 2. The completed and signed form must be returned to the IRS disclosure manager for review and approval. The Office of Safeguards will be notified by the IRS disclosure manager of the request and approval. 3. Changes to the terms of the statistical analysis activities documented in the form must be submitted to the IRS Office of Safeguards as part of the annual SSR (see Section 1.4, State Tax Agency Limitations and Section 2.E.4, Safeguard Security Report). 4. Updates to the form must be made as requested by the IRS disclosure manager. If the agency requires the use of a contractor to conduct tax modeling, revenue estimation or other statistical activities, 45-day notification requirements apply (see Section 1.9.4, Disclosing FTI to Contractors). 2 Refer to https://www.irs.gov/privacy-disclosure/irs-freedom-of-information for contact information. 41 2.0 PHYSICAL SECURITY REQUIREMENTS 2.A Recordkeeping Requirement – IRC § 6103(p)(4)(A) 2.A.1 General Federal, state and local agencies, bodies, commissions and agents authorized under IRC § 6103 to receive FTI are required by IRC § 6103(p)(4)(A) to establish a permanent system of standardized records of requests made by or to them for disclosure of FTI. For additional guidance, see Exhibit 2, USC Title 26, IRC § 6103(p)(4). This recordkeeping must include internal requests among agency employees as well as requests outside of the agency. These records are required to track the movement of FTI. The records are to be maintained for a minimum of five (5) years. The Safeguards website contains guidance, job aids, helpful tools and frequently asked questions to assist agencies in meeting safeguard requirements; see http://www.irs.gov/uac/Safeguards-Program. 2.A.2 Logs of FTI (Electronic and Non-Electronic Receipts) The agency must establish a tracking system to identify and track the location of electronic and nonelectronic FTI from receipt until it is destroyed. The FTI log may include the following tracking elements: • Taxpayer Identifier* • Tax year(s) • Type of information (e.g., revenue agent reports, Form 1040, work papers) • The reason for the request • Date requested • Date received • Exact location of the FTI • Who has had access to the data • If disposed of, the date and method of disposition *To the extent possible, do not include FTI in the log. If FTI is used, the log must be secured in accordance with all other safeguarding requirements. If the authority to make further disclosures is present (e.g., agents/contractors/sub-contractors), information disclosed outside the agency must be recorded on a separate list or log. The log must: • Reflect to whom the disclosure was made • What was disclosed • Why it was disclosed • When it was disclosed 42 Agencies transmitting FTI from one mainframe computer to another, as in the case of the SSA sending FTI to state human services agencies, need only identify the bulk records transmitted. This identification will contain the approximate number of taxpayer records, the date of the transmissions, the best possible description of the records and the name of the individual making/receiving the transmission. Figure 1 – Sample FTI Logs FTI Log Date Requested Date Received Taxpayer Identifier Tax Year(s) Type of Information Reason for Request Exact Location Who has access? Disposition Date Disposition Method Recipient/Title Location Disposition Date Disposition Method FTI Bulk Transfer Log Date Received Control Number/File Name Content (do not include FTI) Recipient/Title Location Number of Records Movement Date 2.A.3 Converted Media Conversion of FTI from paper to electronic media (scanning) or from electronic media to paper (print screens or printed reports) also requires tracking from creation to destruction of the converted FTI. All converted FTI must be tracked on logs containing the fields detailed in Section 2.A.2, Logs of FTI, (Electronic and Non-Electronic Receipts) depending upon the current form of the FTI, electronic or nonelectronic. 2.A.4 Recordkeeping of Disclosures to State Auditors When disclosures are made by a state tax agency to state auditors, recordkeeping requirements pertain only in instances where the auditors use FTI for further scrutiny and inclusion in their work papers. In instances where auditors read large volumes of records containing FTI, whether in paper or electronic format, the state tax agency need only identify bulk records examined. This identification will contain the approximate number of taxpayer records, the date of inspection, a description of the records and the name of the individual(s) making the inspection. Recordkeeping log samples are provided in Section 2.A.2, Logs of FTI, (Electronic and Non-Electronic Receipts). Disclosure of FTI to auditors external to child support enforcement, human services or labor benefit agencies is not authorized by statute. FTI in case files must be removed prior to access by the auditors. 2.B Secure Storage – IRC § 6103(p)(4)(B) 2.B.1 General Security may be provided for a document, an item, or an area in several ways. These include but are not limited to locked containers of various types, vaults, locked rooms, locked rooms that have reinforced perimeters, locked buildings, guards, electronic security systems, fences, identification systems and control measures. 43 How the required security is provided depends on the facility, the function of the activity, how the activity is organized and what equipment is available. Proper planning and organization will enhance the security while balancing the costs. The IRS has categorized federal tax information as moderate risk. The minimum protection standards (MPS) must be used as an aid in determining the method of safeguarding FTI. These controls are intended to protect FTI in paper and electronic form. 2.B.2 Minimum Protection Standards MPS establishes a uniform method of physically protecting data and systems as well as non-electronic forms of FTI. This method contains minimum standards that will be applied on a case-by-case basis. Because local factors may require additional security measures, management must analyze local circumstances to determine location, container, and other physical security needs at individual facilities. MPS have been designed to provide management with a basic framework of minimum-security requirements. The objective of these standards is to prevent unauthorized access to FTI. MPS thus requires two barriers. Example barriers under the concept of MPS are outlined in the following table. Each topic represents one barrier and must be used as a starting point to identify two barriers of MPS to protect FTI. Table 1 – Minimum Protection Standards Secured Perimeter The perimeter is enclosed by slab-to-slab walls constructed of durable materials and supplemented by periodic inspection. Any lesser-type partition must be supplemented by electronic intrusion detection and fire detection systems. All doors entering the space must be locked in accordance with Locking Systems for Secured Areas. In the case of a fence/gate, the fence must have intrusion detection devices or be continually guarded, and the gate must be either guarded or locked with intrusion alarms. Security Room A security room is a room that has been constructed to resist forced entry. The entire room must be enclosed by slab-to-slab walls constructed of approved materials (e.g., masonry brick, concrete) and supplemented by periodic inspection and entrance must be limited to specifically authorized personnel. Door hinge pins must be non-removable or installed on the inside of the room. Badged Employee During business hours, if authorized personnel serve as the second barrier between FTI and unauthorized individuals, the authorized personnel must wear picture identification badges or credentials. The badge must be clearly displayed and worn above the waist. Security Container A security container is a storage device (e.g., turtle case, safe/vault, locked IT cabinet) with a resistance to forced penetration, and a security lock with controlled access to keys or combinations. The MPS or “two-barrier” rule applies to FTI, beginning at the FTI itself and extending outward to individuals without a need-to-know. MPS provides the capability to deter, delay or detect surreptitious entry. Protected information must be containerized in areas where unauthorized employees may have access after-hours. 44 As an example, an agency often desires or requires that security personnel, custodial service workers, or landlords for non-government-owned facilities have access to locked buildings and rooms. This may be permitted if there is a second barrier to prevent access to FTI. A security guard, custodial services worker or landlord may have access to a locked building or a locked room if FTI is in a locked security container. If FTI is in a locked room but not in a locked security container, the guard, janitor, or landlord may have a key to the building but not the room. Additional controls have been integrated into this document that map to NIST Special Publication (SP) 800-53 Revision 5. These are identified in Section 4.0, NIST 800-53 Security and Privacy Controls. Per NIST guidelines, policies and procedures must be developed, documented and disseminated, as necessary, to facilitate implementing physical and environmental protection controls. Multifunction Devices (MFDs) or High-Volume Printers must be locked with a mechanism to prevent physical access to the hard disk or meet MPS. For additional guidance, see NIST Control PE-3, Physical Access Control. 2.B.3 Restricted Area Access Care must be taken to deny unauthorized access to areas containing FTI during duty and non-duty hours. This can be accomplished by creating restricted areas, security rooms or locked rooms. Additionally, FTI in any form (computer printout, photocopies, tapes, notes) must be protected during non-duty hours. This can be done through a combination of methods, including secured or locked perimeter, secured area or containerization. A restricted area is an area where entry is limited to authorized personnel (individuals assigned to the area). All restricted areas must either meet secured area criteria or provisions must be made to store FTI in appropriate containers during non-duty hours. Using restricted areas is an effective method for eliminating unnecessary traffic through critical areas, thereby reducing the opportunity for unauthorized access, disclosure, or theft of FTI. All the following procedures must be implemented to qualify as a restricted area. Restricted areas will be prominently posted and separated from non-restricted areas by physical barriers that control access. The number of entrances must be kept to a minimum and must have controlled access (e.g., electronic access control, key access, door monitor) to prevent unauthorized entry. The main entrance must be controlled by locating the desk of a responsible employee at the entrance to ensure that only authorized personnel with an official need may enter. 2.B.3.1 Visitor Access Logs A visitor access log must be maintained at a designated entrance to a restricted area and all visitors (persons not assigned to the area) entering the area shall be directed to the designated entrance. Prior to accessing areas that contain FTI, a visitor must sign a visitor access log. The security personnel must validate the person’s identity by examining government-issued identification (e.g., state driver’s license or passport). The security personnel must compare the name and signature entered in the access log with the name and signature of the government-issued identification. When leaving the area, the security personnel or escort must enter the visitor’s time of departure. The visitor access log must require the visitor to provide the following information: • Name and organization of the visitor • Signature of the visitor 45 • Form of identification • Date of access • Time of entry and departure • Purpose of visit • Name and organization of person visited Each restricted area access log must be closed [Text truncated at 120,000 characters. The full text is on the page linked above.] --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/agency%3Airs%3A1dabf8954e304f84. Public record. Not legal advice.