IRS disclosure awareness videos

IRS disclosure awareness training videos are available for local, state and federal governmental agencies that receive federal tax information (FTI). The videos help agencies with their annual requirement to certify that their employees understand the security policies and procedures.

The IRS Office of Safeguards created three agency specific videos to help explain several key concepts in protecting the confidentiality of FTI. Topics discussed include the eight key tenets of safeguarding FTI, the importance of Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies PDF, Safeguards webpage, submission of information to Safeguards and the penalties for unauthorized browsing and disclosure of FTI.

General session for all agency types

Safeguards security awareness training

The Office of Safeguards is working to update this resource, please refer to the information below until the video/podcast can be restored.

Associate Director: Hello. I am Associate Director from the IRS Office of Safeguards.

Welcome to Safeguards Disclosure Awareness Training.

The purpose of this video is to provide training for federal, state, and local agency employees, agents, and contractors.

The Office of Safeguards verifies compliance with 6103(p)(4) safeguard requirements.

It does this through the identification and mitigation of any risk of loss, breach, or misuse of federal tax information by over 300 external government agencies.

Each year, billions of pieces of FTI are disclosed, as the law allows.

The laws that permit disclosure also require its protection.

We partner with each agency to protect federal tax information.

Our agency partners play a vital role in safeguarding FTI by building effective security controls into your processes, procedures, and systems.

You are responsible for ensuring the information is protected appropriately from the time you receive it until the time it´s destroyed.

The American public expects two things from both of us.

First, that we work together proactively to be as effective as possible, and second, that we safeguard their personal data.

A good security awareness program is, by far, the most effective and the least expensive part of the overall security program.

For many of you, this is simply a refresher on disclosure awareness, while for others, this may be the first time you have been exposed to the concepts.

Before we move into the substance of the discussion, I would like to thank you for everything you do to protect the confidentiality of federal tax information.

I truly appreciate it.

Manager: Hello. I am a Safeguards Manager (Manager), and I´ll be the moderator for this discussion.

I have extensive experience with the IRS and have worked in many capacities within the Safeguards office.

Joining me as the panel are the Chief of Safeguard Review Team (Review Chief), Information Technology Specialist (IT Specialist), and the Program Analyst (Analyst).

The Review Chief, Analyst, and IT Specialist have all served as disclosure enforcement specialists in the safeguards operation before moving into their current positions.

We have all conducted on-site reviews.

We´re grateful for the opportunity to visit with you today.

We´ll be discussing several key concepts that are used in protecting federal tax information, or FTI.

It´s up to us to protect this sensitive information while creating and cultivating confidence in our agencies.

So let´s get started.

We will begin our discussion today with a question we´re often asked.

IT Specialist, what do we mean by federal tax information, or FTI?

IT Specialist: Manager, that´s a very good question.

FTI consists of two things.

One, a tax return, and two, return information.

FTI can be either or both.

FTI is any return or return information received from the IRS or a secondary source such as Social Security Administration, Federal Office of Child Support Enforcement, Bureau of the Fiscal Services, or the Centers for Medicare and Medicaid Services.

FTI is also shared under agreements allowed by the statute or regulations.

Analyst: A tax return includes all amendments, supplements, supporting schedules, attachments, or lists filed on paper or electronically along with the return, such as Forms 1040, 941, 1120, and other informational forms, such as a Form 1099 or a W-2.

Manager: So, now we know what is considered FTI for the return.

What is return information?

Analyst: I´d like to answer that, Manager.

Return information, in general, is any information collected or generated by the IRS regarding any person´s liability or possible liability.

The Internal Revenue Code defines return information very broadly.

It includes, but is not limited to, the return itself, as well as any information that the IRS obtained or developed that relates to the potential tax liability.

It could be from anywhere.

Review Chief: FTI includes the information extracted from a return, including names of dependents, the location of a business, the taxpayer´s name, address, and identification number.

Even if identifiers such as name, address, and identification number are deleted from this information, it is still considered FTI.

IT Specialist: We need to emphasize that the definition of return information includes anything relating to a tax account.

Return information includes the status of whether return was filed, if it´s being processed, if it is under examination, if it´s subject to other investigation, or in collection status.

It also includes information contained on transcripts of the taxpayer´s account.

This information is all FTI.

Manager: What about the copies of tax returns that clients or their representatives have given to the agency to verify their data?

Are those returns considered FTI?

Review Chief: No, Manager. Returns from clients are not federal tax information.

Source is the key to knowing whether or not the data is FTI.

The information must be derived from the IRS or a secondary source, as previously mentioned, for it to be considered federal tax information.

This is what you need to remember.

If the source is your agency´s client or a client´s representative, it is not FTI.

If the source is the IRS or an IRS secondary source, the information is FTI.

Manager: IT Specialist, what happens when the information from the return is transferred to a different format, document, or computer application?

IT Specialist: Agency personnel often forget that any information derived from the FTI is considered federal tax information and must be safeguarded.

Derived FTI includes things like photocopies, scanned data, or information transcribed into a form, letter, application, or spreadsheet.

It could be something as basic as a sticky note where information from FTI was jotted down for quick reference.

The information on the sticky note then becomes FTI, which requires safeguarding.

Review Chief: When there is any doubt, ask yourself, where did the data originate?

If the answer is IRS or one of the secondary sources, it is FTI and must be safeguarded.

Manager: Analyst, what requires FTI to be kept confidential?

Analyst: Title 26 of the United States Code or Internal Revenue Code, section 6103, gives the IRS the authority to disclose FTI to federal, state, and local agencies.

It also dictates that the disclosed FTI must be held confidential.

IRS shares billions of tax records each year to increase compliance, enforcement, and service to taxpayers.

These records help agencies generate hundreds of millions of dollars in revenue and provide verification for those requesting assistance.

With all this information sharing comes great responsibility to protect it.

Manager: Analyst, disclosure is a running theme in law.

Please explain what the term "disclosure" means.

Analyst: The Internal Revenue Code defines disclosure as making known of return or return information to any person in any manner.

We must be mindful that when congress gave IRS the authority to disclose FTI, it also provided IRS statutory provisions to protect the private information of U.S. citizens.

The provisions provide the foundation for safeguarding FTI, which is where agency personnel and the Office of Safeguards entered the picture.

Review Chief: The law only allows FTI to be disclosed to those who are authorized and who have a need to know.

Manager: Thank you, Review Chief.

IT Specialist, can you please tell us about Publication 1075 and why it´s important to the agencies who receive federal tax information?

IT Specialist: Publication 1075, Tax Information Security Guidelines for Federal, State, and Local Agencies, details the security requirements for all agencies that receive, process, store, or transmit FTI.

The Publication 1075, for all intents and purposes, is the guiding document for the Office of Safeguards and our agency partners.

It provides the information needed to meet the strict requirements for requesting, receiving, safeguarding, and destroying FTI.

Analyst: The requirements within the publication originate from several different sources.

Internal Revenue Code, or IRC, Section 6103, IRS policy and procedures, and the National Institute of Standards and Technology Special Publication 800-53.

These requirements are designed for moderate-risk systems and are the backbone of information technology confidentiality requirements.

Review Chief: Each agency that receives federal tax information must become familiar with Publication 1075 and its requirements.

It outlines all the policies and procedures for safeguarding FTI within your agency.

Publication 1075 is periodically updated and published electronically.

The latest version is always available in the Safeguard section of the IRS´ website at IRS.gov.

Manager: Wow. That´s really helpful information.

IT Specialist, could you please tell us more about the Safeguard section of the IRS website?

IT Specialist: Certainly.

You can find comprehensive information by going to IRS.gov and searching for the "Safeguards Program" page.

Type the words "Safeguards Program" into the search box.

We update the website often, so I encourage you to visit the page frequently for most current information.

Our website has a lot of useful features and information you´ll need.

It includes alerts, technical information, and computer security requirements, which are documented in safeguards computer security evaluation matrices.

Review Chief: You´ll find recommendations on how to comply with Publication 1075 requirements, templates for internal inspections, and guidance on how to complete the forms.

Instructions for reporting unauthorized accesses, disclosures, or data breaches are on our site.

And a link to this video is on the webpage in case you need to revisit it or share it with new staff members.

Manager: That´s great information.

It sounds like that Safeguards website´s a one-stop shop for all of the safeguarding information.

Now we´re going to examine the key tenets of safeguarding.

The eight areas of focus are as follows -- recordkeeping, secure storage, restricting access, employee awareness and internal inspections, reporting, disposal, need and use, and computer security.

Let´s begin with recordkeeping.

Analyst, can you please tell us a little bit about recordkeeping?

Analyst: Recordkeeping requires that each agency maintain a system of standardized records or logs for all FTI.

Records and logs come into play at the time that the FTI is received, and they must remain active until the FTI is destroyed.

The logs may be in paper format, or they may be electronic.

The recommended data elements for the logs and their retention schedule are listed in Publication 1075.

An agency must be able to show the movement of FTI on their logs as it flows through the process.

If you provide FTI to the next person in the process, you must log where it went.

And the next recipient, or the new recipient, must log that they received it.

Review Chief: Whether the FTI is on a computer system or on a piece of paper, it must be tracked on a log from receipt to disposal.

Manager: Thanks, Review Chief.

Secure storage is the second of the key tenets.

What are the requirements for secure storage of FTI?

Review Chief: Secure storage is based on the concept of minimum protection standards, or the two-barrier rule.

Basically, there must always be two barriers between someone who is not authorized to see the FTI and the information itself.

IT Specialist: Let´s talk a minute about storage of FTI.

Tangible items such as a piece of paper, folder, or CD are usually locked in a filing cabinet or secured in a locked office.

So, the locked filing cabinet and the locked office constitute your two barriers.

But during business hours, the FTI may need to be outside of the locked cabinet.

So, in this instance, an employee who is present at all times while the FTI is in use can serve as the second barrier.

This person should have their badge above their waist, indicating they are agency personnel.

Review Chief: The two-barrier rule applies to all agency locations.

It could be the headquarters office or an alternate work site if personnel are allowed to work at home or elsewhere outside the office setting, certainly, the computer facilities where mainframes, servers, routers, and switches are located, as well as off-site storage, where backup tapes are kept, and field offices.

Federal tax information housed in any location within an agency must have two barriers protecting it at all times.

IT Specialist: One of the things we commonly see when we do on-site reviews is a situation where an agency is looking at the two barriers from the outside in, beginning at the guards.

The two-barrier rule starts with the FTI and proceeds from the inside out.

In other words, start at the FTI and look for what prevents it from being accessed by someone who is not authorized.

It´s likely that you´ll never identify the guards as one of your two barriers.

Remember, people enter your agency every day, going past the guards.

However, they are not allowed in the area where the FTI resides.

Look for the two barriers from the inside out.

Manager: Thanks, IT Specialist.

Again, that´s helpful information.

The two-barrier rule is a very common question that we get when it comes to FTI and safeguarding FTI.

Why is limiting access, however, such a key part of an effective security program?

Analyst: Restricting access is based on the premise that only agency employees, agents, and contractors who have a need to know are allowed access to FTI.

Basically, need to know is based on position.

If you need federal tax information to complete your job, then you have a need to know.

Restricting access to the greatest extent possibly makes FTI less vulnerable.

IT Specialist: You can restrict access by locking paper in a file cabinet, by requiring key or card access to rooms where FTI is stored, and through a secure log-in and password process on the computer systems.

When mailing FTI, double package it to prevent exposure if the outer packaging is damaged.

Always be mindful of the need-to-know aspect, and grant access within your agency to only those who have that need.

Review Chief: In some agencies, contractors are not allowed access to FTI by statute.

In these agencies, contractors may have access to any of your agency data, but it is the agency´s responsibility to ensure the contractors never have access to FTI.

For example, if a contractor comes in to repair a computer, the contractor will need to be escorted at all times, and security controls must be in place protecting the FTI.

Manager: An essential practice in restricting access is a notification requirement to alert others that data is, indeed, FTI and is restricted.

How are agencies expected to provide notification?

Analyst: I´ll be glad to explain that, Manager.

Labeling is an important component of restricting access to FTI, whether it´s stored electronically or on paper.

Labeling provides a warning that the data is restricted.

FTI must be clearly labeled as federal tax information and handled in such a manner that it is not misplaced or that it becomes available to unauthorized personnel.

Review Chief: Publication 1075 provides information on how to order labels for paper documents and backup tapes in the appropriate language needed for warning banners displayed on the screens of computers providing access to FTI.

It makes sense that labeling all FTI would deter unauthorized access.

Manager: We have been talking about the key tenets of safeguarding FTI for the last few minutes.

Obviously, it´s important for those of us who have access to data to understand each of these tenets.

How does an agency impart that knowledge?

IT Specialist: Agencies are required to provide awareness training for their employees to help them gain an understanding of the agency´s security policies and procedures for safeguarding FTI.

The training must be provided before access to FTI is granted and annually thereafter.

The requirements for the training are in Publication 1075.

Analyst: Each employee who completes the training must sign a form acknowledging their understanding of the requirements to protect FTI and the sanctions for unauthorized browsing or unauthorized disclosure.

Your agency must retain these acknowledgement certificates according to the retention schedule in Publication 1075.

Manager: After the training, how does an agency verify those individuals are following the security policies and procedures for protecting FTI?

Review Chief: Agencies must conduct internal inspections which should be similar to our safeguards on-site reviews.

These inspections provide your agency with a way to identify its compliance with Publication 1075 requirements.

Inspections must be conducted at all locations where FTI resides.

IT Specialist: The time frames for conducting these inspections are listed in Publication 1075.

Templates are available on Safeguards´ webpage of IRS.gov.

These templates must be notated and included in the agency´s annual Safeguards Security Report.

Manager: Wow, another acknowledgement of the Safeguards’ website.

How does an agency report its safeguarding efforts to us?

Analyst: Each agency must submit an annual Safeguards Security Report (SSR).

The SSR describes the procedures established and used for safeguarding.

The SSR is certified by the head of your agency, indicating the agency´s compliance with safeguarding requirements.

Review Chief: Then, every six months, each agency submits a corrective action plan, which provides a status update on any findings from the on-site review.

This documents the corrective actions completed and those planned.

The IRS Office of Safeguards tracks the status of all findings until they are closed.

IT Specialist: Advanced notification and approvals must be submitted 45 days before your agency secures contracting services or begins specific IT infrastructure changes.

As the IT environment changes, so do the requirements for notifications, so be sure and check our website and the current version of Publication 1075 to determine whether the activity your agency is considering requires a notification.

Analyst: We answer technical inquiries that your agency sends via e-mail regarding the processes and procedures for safeguarding FTI.

Review Chief: If you discover a possible improper inspection or disclosure of FTI, and this could include a breach or security incident of any kind, the individual making the observation or receiving information must contact the Office of Safeguards immediately.

The contact should be made as soon as possible but no later than 24 hours after the discovery.

Analyst: Your agency must notify the Office of Safeguards by e-mail.

Even if all information is not available about the incident, immediate notification is still the most important factor.

Review the latest version of Publication 1075 for details on how to report data incidents.

IT Specialist: All reports, notifications, technical inquiries, and data incidents must be sent encrypted to SafeguardReports@IRS.gov or through secure data transfer if your agency has the capability.

Current templates and submission procedures are available on our website.

Manager: We talked earlier about recordkeeping from receipt to destruction.

Are there requirements for destroying FTI?

Review Chief: Absolutely.

As important as it is to track the FTI received, it is equally important to know when and what FTI has been destroyed.

The agency must document the destruction in their annual SSR and provide a sample of the log used to record it.

Analyst: FTI may be disposed of by destroying or returning it to the IRS, as outlined in Publication 1075.

As FTI is increasingly maintained in electronic systems, destruction requirements are continually changing.

Check our website regularly for any alerts and changes to these requirements.

Review Chief: Regardless of how the agency is destroying the FTI, the method must make it unreadable or unusable.

Manager: Another consistent theme seems to be logging, whether electronic or physical.

Analyst, can agencies use the FTI for any agency purposes once they receive it?

Analyst: No, Manager. They cannot.

The Internal Revenue Code is very direct on how agencies can use it.

They are prohibited from using FTI for any purpose other than that authorized by statute.

Before the agency receives FTI, the IRS must approve its intended use.

Part of the Safeguards on-site review is to verify that the data is being used as approved.

Manager: Deficiencies in computer security account for 98% of the weaknesses identified during Safeguards´ on-site reviews.

Computer security methods are constantly changing.

IT Specialist, can you tell us a bit about computer security and how it applies to safeguarding FTI?

IT Specialist: The focus of the computer security portion of the on-site review is based on requirements outlined in the National Institute of Standards and Technology (NIST) Special Publication 800-53.

We review your agency´s IT security controls using evaluation matrices and automated testing tools.

We also examine written documentation and policies and procedures in your IT environment.

To be proactive with safeguarding, your agency can verify their IT systems receiving, processing, storing, or transmitting FTI are compliant with Publication 1075 requirements by using the Safeguards computer security evaluation matrices found on our website.

Review Chief: Logging and auditing are required to effectively capture all access, modification, deletion, and movement of FTI by each unique user.

This will identify any external breaches or suspicious activity.

IT Specialist: Automated testing is performed on various systems during an on-site review.

We use an industry-standard compliance and vulnerability assessment tool to evaluate the security of systems that store, process, transmit, or receive FTI.

This tool conducts configuration compliance checks using Center for Internet Security (CIS) benchmarks supplemented with IRS-specific requirements.

The audit files are available on our website.

Manager: Review Chief, are there any consequences for the misuse of FTI?

Review Chief: Yes. There are two criminal penalties associated with either or both unauthorized access or unauthorized disclosures of FTI.

This applies to individuals even after they´re no longer employed with your agency.

There is a lifelong prohibition from disclosing federal tax information.

The most severe penalty is for unauthorized disclosure, which means that you were providing FTI to someone that is not entitled to have it.

The penalty is five years of imprisonment, a $5,000 fine, or both, plus the cost of prosecution.

Analyst: The penalty for unauthorized access is one year imprisonment, $1,000 fine, or both, plus the cost of prosecution.

Unauthorized access is reviewing the data when you are not entitled to look at it.

You can actually be guilty of both offenses and prosecuted for both unauthorized disclosure and unauthorized access.

Let´s not forget that taxpayers who are harmed by unauthorized access or unauthorized disclosure may seek civil damages.

The taxpayer may receive a minimum of $1,000 for each unauthorized access or disclosure or actual damages, whichever is greater, plus punitive damages and the cost of the prosecution.

Review Chief: It is important to remember that you, not your agency, are liable for these penalties.

Manager: Wow, Review Chief. Those are pretty significant penalties.

I definitely wouldn´t want to run afoul of that.

I would like to thank the panel for their discussion on this important subject of protecting federal tax information.

Their answers have given us insight into safeguarding.

We encourage you to visit our website and review the current revision of Publication 1075.

Remember, when you are successful, we are successful.

I would like to turn this back to the Associate Director to close out.

Associate Director: We all have a shared responsibility to ensure that federal tax information is disclosed only to those with a need to know and only used as authorized by statute or regulation.

We at the IRS are confident in your diligence, that you adhere to good security protocols, that you are as vigilant as we are about protecting FTI and using it appropriately.

As our IRS Disclosure Awareness Training video concludes, I encourage you at all times to ensure that the data you hold is secure and protected.

Please remember to follow the security requirements within your agency.

Thank you for your time, but most of all, thank you for your efforts to protect the confidentiality of federal tax information.

General session and session for state and federal child enforcement agencies

The Office of Safeguards is working to update this resource, please refer to the information below until the video/podcast can be restored.

Associate Director: Hello. I am Associate Director from the IRS Office of Safeguards.

Welcome to Safeguards Disclosure Awareness Training.

The purpose of this video is to provide training for federal, state, and local agency employees, agents, and contractors.

The Office of Safeguards verifies compliance with 6103(p)(4) safeguard requirements.

It does this through the identification and mitigation of any risk of loss, breach, or misuse of federal tax information by over 300 external government agencies.

Each year, billions of pieces of federal tax information (FTI) are disclosed, as the law allows.

The laws that permit disclosure also require its protection.

We partner with each agency to protect federal tax information.

Our agency partners play a vital role in safeguarding FTI by building effective security controls into your processes, procedures, and systems.

You are responsible for ensuring the information is protected appropriately from the time you receive it until the time it is destroyed.

The American public expects two things from both of us.

First, we work together proactively to be as effective as possible, and second, we safeguard their personal data.

A good security awareness program is, by far, the most effective and the least expensive part of the overall security program.

For many of you, this is simply a refresher on disclosure awareness, while for others, this may be the first time you have been exposed to the concepts.

Before we move into the substance of the discussion, I would like to thank you for everything you do to protect the confidentiality of federal tax information.

I truly appreciate it.

Manager: Hello. I am Safeguards Manager, and I´ll be the moderator for this discussion.

I have extensive experience with the IRS and have worked in many capacities within the Safeguards office.

Joining me as the panel are the Chief of Safeguard Review Team (Review Chief), Information Technology Specialist (IT Specialist), and the Program Analyst (Analyst).

The Review Chief, Analyst and IT Specialist have all served as disclosure enforcement specialists in the safeguards operation before moving into their current positions.

We´re grateful for the opportunity to visit with you today.

We´ll be discussing several key concepts that are used in protecting federal tax information, or FTI.

It is up to us to protect this sensitive information while creating and cultivating confidence in our agencies.

So let´s get started.

We will begin our discussion today with a question we are often asked.

IT Specialist, what do we mean by federal tax information, or FTI?

IT Specialist: Manager, that is a very good question.

FTI consists of two things.

One, a tax return, and two, return information.

FTI can be either or both.

FTI is also shared under agreements allowed by the statute or regulations.

Manager: So, now we know what is considered FTI for the return.

What is return information?

Analyst: I would like to answer that, Manager.

Return information, in general, is any information collected or generated by the IRS regarding any person´s liability or possible liability.

The Internal Revenue Code defines return information very broadly.

It includes, but is not limited to, the return itself, as well as any information that the IRS obtained or developed that relates to the potential tax liability.

It could be from anywhere.

Review Chief: FTI includes the information extracted from a tax return, including names of dependents, the location of a business, the taxpayer´s name, address, and identification number.

Even if identifiers, such as name, address, and identification number are deleted from this information, it is still considered FTI.

IT Specialist: We need to emphasize that the definition of return information includes anything relating to a tax account.

Return information includes the status of whether return was filed, if it is being processed, if it is under examination, if it is subject to other investigation, or in collection status.