This IRM builds on existing policy by adding processes for assessing, documenting, and addressing authentication risks for telephone/voice, in-person, remote in-person, and correspondence channels. This policy applies NIST Risk Management Framework concepts to IRS authentication processes as a baseline for completing these risk assessments.

By law, federal agencies are expected to document, publish and maintain records of policies, authorities, procedures and organizational operations. The IRM is the source for the IRS. See IRM 1.11.1.1.2, Authority, for the authorities and legal obligations of Internal Management Documents (IMDs).

Confidentiality regulations such as IRC 6103 and other Federal guidelines require the IRS to authenticate the identity of individuals with whom it exchanges sensitive but unclassified (SBU) information (including personally identifiable information (PII) and tax information), regardless of the channel. Management officials bear the responsibility to conduct risk assessments of factors, procedures, and processes used to authenticate taxpayers, representatives or other third-parties interacting with the IRS.

Privacy, Government Liaison and Disclosure’s (PGLD) Privacy Policy and Knowledge Management (PPKM) implements relevant privacy statutes, regulations, guidelines, OMB Memoranda, and other requirements. Numerous statutes such as the Privacy Act, Federal Information Security Modernization Act (FISMA) and Paperwork Reduction Act are reinforced by OMB and NIST guidance and implemented by the IRS accordingly.

The Director, Identity Assurance (IA) is responsible for the Non-Digital Authentication Risk Assessment (NDARA) process.

Organization Executives and Management Officials who lead programs described in this policy are responsible for these guidelines for continuous monitoring of new and ongoing authentication policies related to these channels.

Executives of each IRS organization are responsible for ensuring an NDARA is completed every three years for each of their respective programs related to these channels. Any risks identified should be documented, mitigated and monitored.

Each IRS organization is responsible for establishing internal processes for managing their risk assessment procedures and monitoring based upon this guidance.

A copy of approved assessments will be emailed to *OS P GLD IA Risk Assessments, for policy team review and coordination on any identified risks.

The Identity Assurance function manages and reviews the Authentication Risk Assessments in Non-Digital Channels Program.

Business Units are responsible for completing an NDARA every three years and addressing any deficiencies identified. The follow-up timeframe for addressing identified acceptable deficiencies or risks is every three years until resolved. The follow-up timeframe for addressing identified deficiencies or risks is every 6 months until determined acceptable or resolved.

When risk assessments are completed and signed, they become an official record and must be maintained in accordance with Document 12829, General Records Schedule (GRS) 5.7 Item 020. Each office is responsible for reports and audits identifying internal administrative program weaknesses and risks, mitigation action plans, corrective actions, tracking records, correspondence, and other records held by the office responsible for coordinating internal control functions including risks. Destroy records five years after no further corrective action is needed.

The tables lists commonly used terms and definitions:

The table list commonly used acronyms and definitions:

The Non-Digital Authentication Risk Assessment Form 15295 may be accessed at https://core.publish.no.irs.gov/forms/internal/pdf/f15295--2022-10-00.pdf

Privacy Act of 1974 (as amended)

IRC 6103, Confidentiality and Disclosure of Returns and Return Information

NIST Special Publication 800-37, Risk Management Framework

GAO 15-593SP, A Framework for Managing Fraud Risks in Federal Programs

Prepare to consider risk of the authentication process in telephone/voice, in-person, remote in-person, and correspondence, depending on the risk. Key tasks applicable to assessing risk in IRS customer contact channels, include steps to:

Categorize the risks in IRS authentication channels, and consider the components of the customer contact. Review the information gathered in the Prepare step in this IRM and include additional details to assess the level of risk associated with each factor.

Select an initial set of controls for the authentication process and tailor the controls as needed to reduce risk to an acceptable level based on an assessment of risk. Things to consider when selecting a set of controls:

Implement controls at a level matching the risk to the channel. These controls must be adapted to the customer contact channel used to authenticate the individual. This includes information in physical, technological, and personal exchanges of information. Implementation may include application of commercially available solutions, new technology, adjustments to procedures, or new policies. Document any deviations from selected levels of risk. Note: See IRM 10.8.1, Policy and Guidance for guidance on risk acceptance and risk-based decisions.

Assess the controls once implemented to ensure they are operating as intended. Ongoing assessments, such as quality reviews and operational reviews reduce overall risk by identifying problems before they may be exploited. These assessments may be performed at a variety of levels. Any newly identified risks must be analyzed using this process, beginning at the step most applicable to the nature of the risk and addressed within a reasonable timeframe, appropriate with the risk.

Monitor all non-digital authentication channels (i.e., telephone/voice, in-person, remote in-person, and correspondence) at a level of frequency matching the level of sensitivity and frequency of changes to the related channel.

Authorize the process at the level of ownership for the authentication channel. Refer to the Prepare step’s governance roles in this IRM.