Dial in access to systems housing CIMIS databases is prohibited unless the dial-ups are protected by an approved encryption, identification, and authentication mechanism. The CI Security Officer should be consulted regarding Data Encryption Standard (DES) devices.

The system should be located in an IRS internal area, which is supervised during working hours and "secured" during non-duty hours. Avoid placing the data on a shared file server or shared LAN that is located, administered or otherwise shared by another IRS function. Minimum criteria for CI employee access include an LBI and a valid need to know. Non-CI IRS employees should not be allowed access unless the Chief, CI authorizes a waiver.

Do not provide extracts from the downloaded CIMIS system in either an on-line or off-line mode (e.g. tape or disk transfer) to non-CI systems in the field offices, unless such exchange has been coordinated through the CIMIS administration staff. Depending on the data content of the extract, a Memorandum of Understanding (MOU) may be necessary between CI and the receiving IRS function.

Any suspected computer security violations should be reported as soon as possible to local CI management. In addition, such incidents should be reported within 24 hours to the CI Security Officer, Business Systems Development Section, using the "Computer Security Incident Memorandum" form. Anonymous calls will be accepted through the CIMIS Administration Staff. Computer security incidents include attempts by unauthorized personnel to access sensitive data, and deliberate destruction or loss of sensitive data. Criminal Investigation should conduct a preliminary investigation and document incidents. If there are any indications of illegal or improper activities, management should cease the investigation and refer the findings to a Treasury Inspector for General Tax Administration (TIGTA) official. Also, cases involving theft or malicious damage to equipment and software should be reported to TIGTA immediately. Please prepare in memorandum form and include the following information:

Individuals, who knowingly damage or modify sensitive information for malicious purposes, or disclose sensitive information to unauthorized persons, are subject to sanctions and penalties based on laws, regulations, privacy considerations and the degree of harm to CI activities. Penalties and sanctions also apply to the invasion of privacy as a result of browsing for personal motives.

Before employees can be granted access to the live database, Supervisory Special Agent (SSAs) must be certain that the following requirements are met:

On an annual basis, CI Headquarters (HQ) will send each SSA an all-user revalidation letter. During this process, SSAs are requested to verify their users' continued need for access at the specified privilege level and make any necessary updates.

The local CIMIS Coordinator is responsible for conducting actual day-to-day CIMIS security on the system and for coordinating with users as needed in order to effectively implement security. Each CIMIS user is responsible for adhering to the proper User Security Procedures.

A special agent must be established in the CIMIS database before any data relating to that special agent may be entered. The following information is required to establish a special agent, and any changes to these data fields will require an update to the special agent profile record:

The following actions require notifying CI HQ Hotline Staff by E-mail or telephone first and then confirmation by memorandum:

The purpose of this notification is to enable CI HQ to update the CIMIS database so it contains valid field office location information. Field office numbers are found in Exhibit 9.9.2-1.

Investigation numbers provide a uniform system for identifying and controlling investigations and to account for time expended on them. The system is designed to generate an investigation number upon input of the information contained in Section I Input Control, Section III Special Agent Assignment, and Section IV Identification, on Form 4930.

Investigation(s) must be on the CIMIS database prior to the submission of Form(s) 5043 reflecting investigation time being charged to the investigation.

Once an investigation number has been assigned by the system, it may not be altered or voided.

An investigation number is comprised of nine digits.

Examples of investigation numbers using Nashville field office, FY 2001 hypothetical investigations:

In situations where more than one field office has an interest in the same taxpayer, or in some cases the same field office needs to dual number the taxpayer, prior approval to dual number the investigation by CI HQ is required. The system will display a message to the CIMIS operator of a duplicate investigation. The system will not permit the dual investigation to be numbered until approved by the Director, Operations Policy & Support (CI:OPS). The Special Agent in Charge (SAC) must request approval from CI:OPS in writing. The CI HQ (CIMIS Hotline), in coordination with CI:OPS; Director, Field Operations; and the SAC, will assess the need for, and approve if appropriate, the dual investigation. Guidelines for coordinating inter-field office and inter-area investigations are located in IRM 9.5, The Investigative Process.

The same investigation number will not be used to cover subsequent investigations of the same taxpayer where the prior criminal investigation was criminally closed. Instead, a new investigation will be initiated.

If there is an ongoing investigation on a taxpayer, then any additional violation (tax or money laundering) should be investigated in conjunction with that ongoing investigation. If separate field offices number the same individual or entity on different violations, it will trigger the need to request approval for a dual investigation. Multiple investigation numbers will not be assigned in situations where more than one violation is involved or when violations are added after numbering, or in instances where the Department of Justice (DOJ) or United States Attorney makes a request for a follow-up investigation of other violations or of subsequent years.

If there is an ongoing criminal investigation, and criminal or civil seizure action is to be initiated on the same individual or entity, an SSI will be initiated. This SSI must be associated to the PI of the ongoing criminal investigation. Only one SSI is numbered for a specific target. Do not number an SSI for each location or for each asset relating to the specific target.