The Office of Safeguards is responsible for ensuring agency and contractor personnel authorized to access Federal tax return information - collectively termed FTI – maintain adequate safeguards for the protection of such information. Written procedures and instructional guidelines are included to help the reviewer determine whether the agency and contractor personnel provide adequate protection for FTI consistent with the Department of Treasury and IRS guidelines, manuals and regulations.

The program is a cooperative effort with the recipient agencies and contractors to ensure the confidentiality of FTI. Outreach and communication are key elements in promoting protection of FTI. In order to fulfill legal requirements and IRS responsibilities, the program must also maintain viable enforceable standards and full time enforcement.

IRC 6103 and IRC 6104(c) permit IRS to enter into agreements to disclose FTI to various Federal, state, and local agencies.

IRC 6103(p)(4) requires the agencies receiving tax returns and return information under specific disclosure provisions provide adequate safeguards to protect the confidentiality of the tax returns and return information to the satisfaction of the Secretary (of Treasury) as a condition of receiving FTI.

IRC 6103(p)(4)(E) requires that any federal agency, body, commission, or state agency receiving FTI subject to IRS oversight under IRC 6103(p)(4) submit reports to the Office of Safeguards that describe the procedures established for ensuring the confidentiality of FTI. For monitoring and reporting purposes, the agencies are categorized by the authority to receive FTI as one of the following:

IRC 6103(p)(5) requires the Commissioner to furnish annual reports to the House Committee on Ways and Means, the Senate Committee on Finance and the Joint Committee on Taxation. The reports describe procedures and safeguards established by the various agencies and their respective contractors who receive FTI, as well as indicating deficiencies on the part of the agencies and their contractors.

IRC 6103(p)(7) establishes a process for the suspension or termination of FTI and an administrative review if an authorized recipient has failed to safeguard returns or return information.

IRC 6103(p)(8) contains confidentiality protections for copies of Federal tax returns, or portions thereof, attached to State tax returns, or the Federal return information reflected on a State tax return supplied by a taxpayer pursuant to a state requirement.

IRC 6103(p)(9) requires that agencies disclosing tax returns and return information under specific disclosure provisions to contractors provide adequate safeguards to protect the confidentiality of the tax returns and return information to the satisfaction of the Secretary (of Treasury). For monitoring and reporting purposes, the agency must ensure the following:

IRC 7213 provides criminal penalties for unauthorized disclosures of FTI.

IRC 7213A provides criminal penalties for unauthorized inspections of FTI.

IRC 7431 provides civil remedies for unauthorized disclosures and inspections of FTI.

Title 26 Code of Federal Regulations (CFR) 301.6103(n)-1(e) authorize the IRS to determine the safeguards compliance of agency contractors.

Title 26 CFR 301.6103(p)(4)-1 refers to IRS published guidance regarding security guidelines and other safeguards for protecting FTI.

Title 26 CFR 301.6103(p)(7)-1 addresses procedures for administrative review of a determination that an authorized recipient has failed to safeguard FTI.

See also IRM Exhibit 10.8.1-2, Information Technology (IT) Security Policy and Guidance for applicable security laws and regulations, and other guidance.

The Office of Safeguards is responsible for ensuring that external agencies authorized to receive FTI maintain proper safeguards to adequately protect the data. Agencies receiving return information and the authorized contractors must protect the confidentiality of return information and are periodically reviewed by Office of Safeguards personnel to ensure they meet the safeguarding requirements of IRC 6103(p)(4). These requirements include:

The Associate Director (AD), Office of Safeguards, reports to the Director, GLDS, and oversees the Safeguard program. The following Office of Safeguards managers and staff report directly to the AD:

The following Office of Safeguards managers and staff report to the AM:

The following Office of Safeguards staff report to the Supervisory DES, SRT/FRT:

The following Office of Safeguards staff report to the Supervisory Management & Program Analyst, SPT:

The following Office of Safeguards staff report to the Supervisory Management & Program Analyst, S&RT:

IRS IT contractors are used for case work involving computer security requirements. IRS IT contract responsibilities are listed in the IT Security Support Services Contract.

Agencies receiving FTI are responsible for following the safeguarding requirements in Publication 1075, Tax Information Security Guidelines for Federal, State, and Local Agencies.

Implementation of the Safeguards Program relies on a coordinated effort between SPT, S&RT, and the SRT/FRT.

Safeguards Policy Team: Ensures compliance with laws and regulations, gives guidance for decision-making, and streamlines internal processes.

Strategy & Risk Team: Identifies risks associated with non-compliance, assesses risk, mitigates risk, and finds risk mitigation solutions.

Safeguard Review Teams: Review Teams 1 and 2 ensure compliance with safeguarding requirements of state and local agencies receiving FTI by conducting safeguard reviews and preparing safeguard review reports.

Federal Review Team: Ensure compliance with safeguarding requirements of federal agencies receiving FTI by conducting safeguard reviews and preparing safeguard review reports.

The Office of Safeguards reports program updates in regular Operational Reviews with the Director of PGLD.

The Office of Safeguards operates and controls access to its eCase, Safeguards SharePoint Online, and OneDrive for use in storing, developing and sharing documents within the function and with IRS reviewers on an as needed basis.

The tables below list commonly used terms, definitions and acronyms used throughout this IRM section:

Additional sources of guidance can also be found at the related resources:

Safeguards SharePoint Online Component:

Safeguards effectively communicates with internal and external stakeholders, by:

Agencies executing data exchange agreements involving access to FTI will be subject to safeguarding requirements and must provide evidence that adequate safeguard protections and controls are in place before the IRS will authorize the release of FTI. The agency must submit an initial SSR for approval at least 90 days prior to the agency’s planned FTI receipt date.

In order to obtain initial IRS approval to receive FTI, an agency must have an approved SSR. To facilitate IRS approval, the agency is expected to:

The agency is required to submit evidentiary documentation for the controls identified in Publication 1075, Section 2.E.4.1, Table 3 in conjunction with the first submission of the agency’s SSR.

If the agency does not submit all required evidentiary documentation as described above, the IRS reserves the right to conduct a safeguard review to assess the effectiveness of the controls established in order to approve the SSR prior to initial release of FTI. Subsequently, Safeguards will conduct a risk-based assessment to determine when to schedule an agency’s first safeguard review after initial receipt of FTI.

The agency must address all elements in the SSR template, additionally the initial SSR must contain the evidence, Artifacts for Review, which focus on:

The Office of Safeguards will perform a comprehensive review of the agency’s entire SSR and each control description for compliance with standards to understand the agency’s overall security posture before approving the SSR and request additional artifacts as needed.

General:

Safeguard activities shall include, at a minimum, the following items:

Agency Disclosure Awareness Program – The agency must describe the efforts to inform all employees having access to FTI of the confidentiality requirements of the IRC, the agency’s security requirements, and the sanctions imposed for unauthorized inspection or disclosure of return information.

Reports of Internal Inspections – The agency must provide copies of a representative sampling of the Inspection Reports and a narrative of the corrective actions taken (or planned) to correct any deficiencies must be included with the annual SSR.

Disposal of FTI – The agency must report the disposal or return of FTI to the IRS or source. The information must be adequate to identify the material destroyed and the date and manner of destruction, including copies of destruction logs.

Other information –The agency must provide other information to support the protection of FTI, in accordance with IRC 6103(p)(4) requirements.

Planned Actions Affecting Safeguard Procedures – Any planned agency or contractor action which would create a major change to current agency procedures or safeguards must be reported. Such major changes would include, but are not limited to, new computer equipment, facilities or systems to perform programming, processing or administrative services requiring access to FTI.

Agency Use of Contractors – Agencies must account for the use of all contractors, permitted by law or regulation, to do programming processing or administrative services requiring access to FTI. Agencies must identify all contractors requiring access to FTI on the TFA 2004 Contractor Worksheet attached with the SSR and must certify the identified contractors have safeguards in effect to ensure FTI is kept confidential.

On Boarding – As part of the on boarding process, new agencies are required to have an approved SSR, Security Assessment Report (SAR) and Authority To Operate (ATO) before receiving FTI.

Safeguard Security Report Signed Certification Page

Preparation of an Annual SSR begins with a review of the previous SSR submission to:

When an agency requests an extension to file their annual SSR, refer them Publication 1075, Section 2.E.4.4, SSR Update Submission Dates

Agencies are required to submit an annual SSR encompassing any changes that impact the protection of FTI:

The SSR must reflect updates or changes in the agency or safeguarding procedures within the reporting period to include:

The SSR must document IRC 6103(p)(9) requirements that contractors, subcontractors, or other agents have requirements in effect to provide safeguards required under IRC 6103(p)(4) by including the following:

The following are criteria for SSR attachments:

Safeguard Security Report Signed Certification Page

Location of the Data – Include an organization chart or narrative description of the receiving agency organization, which includes all functions where FTI is processed or maintained. If the FTI is used or processed by more than one function, then pertinent information about each function must be included.

Flow of the Data – The report must contain a flow chart or narrative description of:

System of Records – A description of the permanent record(s) used to document requests for, receipt of, dissemination of (if applicable), and final disposition (return to the IRS or destruction) of the FTI (including all electronic media). Agencies and their contractors are expected to be able to provide an "audit trail" for all FTI requested and received. Audit trails must account for copies made or distribution of the original document/media receipts.

Secure Storage of the Data − A description of the security measures employed to provide secure storage for the FTI when it is not being used. Secure storage encompasses such diverse considerations as locked files or containers, secured facilities, key or combination control, off-site data storage facilities, and restricted areas.

Restricting Access to the Data – A description of the procedures or safeguards to ensure access of FTI is limited to those individuals authorized access and have a need to know. Describe any physical barriers protecting FTI from unauthorized access when in use by the authorized individual including all security features where FTI is accessed, used or processed as well as any systemic and or procedural barriers.

Disposal – A description of disposal, including method of disposal for FTI provided by IRS and/or produced by the agency or contractor (e.g., print-outs, back-up tapes and the like). (See paragraph (8), System of Records above)

Information Technology Security – A description of all automated information systems and networks that receive, process, store, or transmit FTI. All systems are required to have safeguard measures in place which address all key components of IT security to restrict access to sensitive data, see Publication 1075, Sections 3.0 and 4.0. The description must include:

Disclosure Awareness Program – Description of the formal awareness program each agency and contractor who receives FTI has, where employees with access to FTI certify annually the training received and receipt of the confidentiality provisions of the IRC including the civil and criminal sanctions for unauthorized inspections or disclosures of FTI.

Mailbox Staff must take the following actions when a SSR is received in the mailbox:

Inventory Analyst must take the following actions:

SSR reviewers need to have a thorough understanding of applicable statutes, Treasury regulations, agency agreements and contracts, and the agency’s and their contractor's systems for processing FTI.

SSR reviewers will review the SSR for the following:

ITS must prepare the approval package for Quality Review (QR) within 20 calendar days of receipt.

Update Comments and “Email Notification Comment” under the electronic case management system workspace using the appropriate naming convention.

Submit case to QR.

Management must conduct approval on SSR cases and review SSR cases from QR within 5 calendar days of assignment.

All Office of Safeguards employees assigned or processing SSRs are responsible for documenting in case notes any occurrence resulting in missed timeframes.

Agencies who submit SSRs with incomplete information must be notified through email contact from the Safeguards Mailbox Staff.

When possible, delinquent SSRs must be resolved through telephone call or email from the Strategic Task Alliance Team (STAT) with the agency POC. STAT procedures are explained in detail under IRM 11.3.36.16.1, Guidelines for Safeguards STAT Enforcement of Safeguard Reporting Requirements.

Formal procedures to withhold FTI can be initiated if an agency fails to:

INTRODUCTION – The DES must use the most current template based on the type of agency reviewed. Verify that the Introduction matches the code authority for which the agency is receiving information. For federal agencies, briefly outline the statutory provisions, in general, which permit the disclosure of returns or return information, and the intended purpose or benefit(s) of the disclosures. Any limitations or restrictions imposed by the IRC or regulation can be included in the introduction portion of the report.

BACKGROUND – This section, which is agency and contractor specific, must contain the name of the agency reviewed, and if applicable, the specific organization(s) or function(s) reviewed within that agency. If several, separate, programs are being reviewed, the background section must give a brief description of each program.

SCOPE – This section contains descriptive reviewer information regarding the conduct of the review. This section of the report must give the reader a sense of how the review was conducted and what programs and procedures were included or excluded from the review. In addition, the scope and objectives section must also indicate:

FINDINGS AND RECOMMENDATIONS – All safeguard review reports will address identified deficiencies for each requirement enumerated in IRC 6103(p)(4), and other requirements determined to be necessary to ensure the confidentiality of FTI and return information. To ensure that all the requirements of the IRC, Publication 1075, and the IRM have been addressed, Sections A - H subsections will contain a statement of the requirement, followed by a description and discussion of the findings and recommendations.

DES must enter Section A - G findings identified from the review into eCase. Supplementary guidance for the automatic upload can be located in the eCase User Guides on the Office of Safeguards SharePoint Job Resources and Reference Documents.

The DES must import all Section H Parent Findings and Component Findings from the document loaded to the electronic case management system by the IRS IT Contractor/ITS within 20 calendar days of the closing conference, using the electronic case management system "SFG Finding Import" tool. Parent Findings and Component Findings will be created for every Section H finding even if only one component exists. Supplementary guidance for the automatic upload can be located in the eCase User Guides on the Office of Safeguards SharePoint Job Resources and Reference Documents.

DES must complete the SRR using the most current SRR template.

DES must prepare the SRR Letter using the most current template available.

ITS must upload the documents associated with the Section H to the case using the correct naming convention for all documents.

DES must upload safeguard review documents using the correct naming convention for all documents.

DES must close out all findings from the previous review. This includes all Section H component findings. Make a case note in the previous SRR case as well as the current SRR case stating the reason for closing the findings (due to a new review).

DES must update Comments and “Email Notification Comment” under the electronic case management system workspace.

DES must submit case to Quality Review within 30 calendar days of the Closing Conference.

Management must conduct approval on SRR cases and review SRR cases from QR within 5 calendar days of assignment.

SRRs are considered timely if the case, is released within 45 calendar days of the closing conference. All Office of Safeguards employees assigned or processing SRRs are responsible for documenting in case notes any occurrence resulting in missed timeframes.

Mailbox staff must do the following when a CAP is received in the mailbox:

Inventory Analyst must verify the agency is not scheduled for an upcoming safeguard review within 60 calendar days of the CAP received date and email the DES and IT Contractor/ITS to inform them of the upcoming Safeguard Review.

Inventory Analyst must assign the following:

Inventory Analyst must review Section H to validate open findings and if all findings have been closed, then email IT Contractor or ITS to advise Section H review is not required.

CAP reviewers need to have a thorough understanding of applicable statutes, Treasury regulations, agency agreements and contracts, and the agency’s and their contractor's systems for processing FTI.

Assigned individuals must conduct an initial review of the CAP submission and acknowledge receipt of CAP by updating notes in the electronic case management system within 10 calendar days for the following:

Assigned individuals must verify the agency is not scheduled for an upcoming Safeguard review within 60 days of CAP received date.

If ITS is assigned, then ITS must update Section H of the CAP using the following steps based on an evaluation of the information provided by the agency:

DES must update Section A-G of the CAP using the following steps based on an evaluation of the information provided by the agency:

DES must prepare and upload the following documents for a management approval package:

CAPs must be forwarded for Management Approval within 30 calendar days of receipt.

Update Comments and "Email Notification Comment" under the electronic case management system workspace using the appropriate naming convention.

DES must update case status to "Quality Review" .

QR will not review the case but must update the case status to "Management Approval" .

Management must conduct approval on CAP cases within 5 calendar days of assignment.

CAPs are considered timely if the case, is released within 45 calendar days of receipt. All Office of Safeguards employees assigned or processing CAPs are responsible for documenting in case notes any occurrence resulting in missed timeframes.

Mailbox staff must do the following when a TI is received in the mailbox:

Generally, an inventory analyst will assign the following types of TIs to a DES within 3 business days from mailbox receipt:

Generally ITS or the IRS IT Contractor will be assigned the following types of Technical Inquires within 3 business days from mailbox receipt:

Generally, physical security TIs from agencies under an open review must be assigned to the DES conducting the review.

TI reviewers need to have a thorough understanding of applicable statutes, Treasury regulations, agency agreements and contracts, and the agency’s and their contractor's systems for processing FTI. Research and contact other Office of Safeguards personnel (e.g., Senior DES, SRT/FRT Chief, TA) as needed.

TI reviewers must conduct an initial review of the TI to determine if the TI is an issue that is not covered in Publication 1075, is not a Safeguards issue, or requires additional case actions. Use the following table to determine the appropriate action:

Upload any emails sent requesting additional information from agency, IT Contractor/ITS assignment or requests for coordination.

If a timely response is not received for additional information, the TI will be closed with an email advising the agency of closure and explaining:

TI reviewers must prepare an appropriate response for resolution by telephone or in writing:

Written responses to TIs must follow the following format:

Ensure the agency will fully meet Publication 1075 standards on the issue.

All TIs do not require an email/written response. Utilize the most appropriate method for the type of issues/inquires raised.

DES or ITS must prepare and upload the following documents for a management approval package:

Update Comments and "Email Notification Comment" under the electronic case management system workspace using the appropriate naming convention.

Assigned employees must forward case to QR or Management Approval within 20 calendar days of receipt.

Submit cases with the following issue codes to Quality Review:

Management must conduct approval on TI cases and review TI cases from quality review within 5 calendar days of assignment.

TIs are considered timely if the case, is released within 30 calendar days of receipt. All Office of Safeguards employees assigned or processing TIs are responsible for documenting in case notes any occurrence resulting in missed timeframes.

All correspondence must be sent electronically by Secure Data Transfer or encrypted using SecureZip, to the Safeguards Mailbox and include a cover letter signed by the head of the agency or authorized delegate.

Use of templates specified in Publication 1075 will enhance the agency’s ability to provide all of the information to process the notification and will minimize processing errors.

Mailbox staff must do the following when a 45 Day Notification is received in the mailbox:

Mailbox Staff must assign 45 Day Notification Letters for contractor and/or subcontractor access to FTI to a DES as "Case Responsible" and "Analyst" within 3 business days from mailbox receipt.

Mailbox Staff must assign 45 Day Notification Letters for Live Data Testing and Cloud Computing that require IT review within 3 business days from mailbox receipt as follows:

Inventory Staff periodically review inventory and can reassign cases, as needed, to ensure inventory is evenly assigned.

Within 10 calendar days of case assignment employees assigned 45 Day Notifications must:

Notifications must be submitted by the agency. If the Office of Safeguards is in receipt of a 45 Day Notification from a contractor or consolidated IT, then request the agency submit the 45 Day Notification. Close the 45 Day Notification case in the electronic case management system using the non-processible template located under the Office of Safeguards SharePoint Job Resources and Reference Documents. A new 45 Day Notification case will be opened in the electronic case management system upon receipt of the appropriate 45 Day Notification from the agency.

Notifications can be withdrawn by the agency. If the Office of Safeguards is in receipt of a withdrawal request, then send an email to the agency acknowledging the withdrawal request and upload to "Attachments" on eCase.

Review the information provided to ensure it adheres to the standards in Publication 1075 and all Exhibit 6 information was provided. The following table provides information on what analysis is required for each type of 45 Day Notification:

If the agency fails to appropriately respond by the due date issued, then prepare the non-processible letter located on the Office of Safeguards SharePoint Job Resources and Reference Documents.

Document all information received from the agency in the electronic case management system case Notes and upload documents and emails to the electronic case management system as appropriate.

DES must prepare and upload the following documents for a management approval package using the appropriate naming convention format.

Closing letter templates can be accessed on the Office of Safeguards SharePoint Job Resources and Reference Documents.

45 Day Notifications must be forwarded for QR or Management Approval within 20 calendar days of receipt.

Update Comments and "Email Notification Comment" under the electronic case management system workspace using the appropriate naming convention format.

DES must submit cases to QR which meets criteria under IRM 11.3.36.11.4, QR of 45 Day Notifications or have QR forward all other 45 Day Notifications, without review, for Manager Approval.

Management must conduct approval on 45 Day Notification cases and review 45 Day Notification cases from QR within 5 calendar days of assignment.

45 Day Notifications are considered timely if the case, is released within 30 calendar days of receipt. All Office of Safeguards employees assigned or processing 45 Day Notifications are required to document in case notes any occurrence resulting in missed timeframes.

The following documents must be uploaded in the electronic case management system when the Quality Reviewer receives the case file. Each of these documents must be reviewed by QR.

Written responses must be appropriate for forwarding to the agency personnel in response to additional information needed. If any documentation is missing, the quality reviewer must contact the DES/IRS IT Contractor/ITS to load the documentation.

Verify that the SSR has provided guidance that is complete. There must be a response for every field within the SSR.

The quality reviewer must review the SSR for grammar, punctuation, spelling and formatting throughout the report. Minor corrections (grammar, punctuation, formatting, etc.) can be made by the quality reviewer without returning/notifying the DES/IRS IT Contractor/ITS. The following items must be reviewed in the SSR.

QR of SSR Transmittal Letter – The quality reviewer must review the transmittal letter that is sent to the agency. The quality reviewer must make minor corrections to the letter. If there are major changes to the letter the quality reviewer must wait until the report is reviewed to load and return the case to the DES/IRS IT Contractor/ITS for re-work.

Review the transmittal letter for the following:

QR must take the following actions after reviewing the case:

Update Comments and “Email Notification Comment” under the electronic case management system workspace using the appropriate naming convention format.

QR must conduct a review of the case within 7 calendar days of SSR case assignment. All Office of Safeguards employees assigned or processing SSRs are required to document in case notes any occurrence resulting in missed timeframes.

The S&RT MA must complete the following when a case is assigned to QR:.

Quality reviewers must utilize the QR SRR Checklist located on the Office of Safeguards SharePoint Job Resources and Reference Documents to review the case prior to submitting the case for management approval.

QR must take the following actions after reviewing the case:

Update Comments and “Email Notification Comment” under the electronic case management system workspace using the appropriate naming convention format.

Case must be forwarded for Management Approval within 40 calendar days of receipt. All Office of Safeguards employees assigned or processing SRRs are required to document in case notes any occurrence resulting in missed timeframes.

QR will be performed on TIs based on the following Issue Code Groups/Issue Codes:

QR must utilize the QR TI Checklist located on the Office of Safeguards SharePoint Job Resources and Reference Documents to review the case prior to submitting the case for management approval.

For written responses QR must verify the TI Response is formatted correctly. Reference IRM 11.3.36.9.3, TI Processing Procedures.

QR must take the following actions after reviewing the case:

Update Comments and “Email Notification Comment” under the electronic case management system workspace using the appropriate naming convention format.

TIs must be forwarded by QR for management approval within 25 days of receipt. All Office of Safeguards employees assigned or processing TIs are required to document in case notes any occurrence resulting in missed timeframes.

QR will be performed on 45 Day Notifications requiring approval. QR will not review the following 45 Day Notifications:

ITS will perform QR on any 45 Day Notifications involving the IRS IT Contractor to verify the deliverable:

QR must utilize the QR 45 Day Notification Checklist located on the Office of Safeguards SharePoint Job Resources and Reference Documents to review the case prior to submitting the case for management approval.

In addition to utilizing the QR 45 Day Checklist, QR must review the following in the letter for issuance to the agency:

Verify the Contractor Check Sheet has been completed correctly and reflects that the notification was submitted properly.

QR must take the following actions after reviewing the case:

Update Comments and “Email Notification Comment” under the electronic case management system workspace using the appropriate naming convention format.

45 Day Notifications must be forwarded by QR for management approval within 25 calendar days of receipt. All Office of Safeguards employees assigned or processing 45 Day Notifications are required to document in case notes any occurrence resulting in missed timeframes.

Federal Agency Pre-review planning

Preparation for all safeguard reviews must be conducted 120 calendar days before the review. Use the following timeframes and actions below to conduct the review preparation. The must be completed as part of the review preparation:

Review and analyze the following documents and any other sources that can provide information for the review.

Prior to the review, a preparation call must be conducted and will include the responsible Chief, SRT/FRT, DES, IRS IT Contractors/ITS and appropriate GL representative.

Travel Coordination

The week of the cybersecurity review the CSR must conduct the following in accordance with the schedule:

Onsite Safeguard Reviews

Onsite Safeguard Review Management Processes for Chief SRT/FRT.

Interviews – The interview method is the process of holding discussions with individuals or groups of individuals within an organization to facilitate assessor understanding, achieve clarification, or obtain evidence. During the review, agency employees, contractors and subcontractors will be interviewed. Interviews are valuable in that they provide information based on personal experience. This information can help determine the extent of disclosure, safeguards and security awareness as well as awareness of penalty provisions of IRC 7213, IRC 7213A, and IRC 7431. Additionally, interviews can provide answers to questions regarding operations and procedures. Interviews do not have to be restricted to employees and can be conducted with third parties (e.g., custodians, security guards, other tenants) to gather information on the measures used to restrict access to areas housing tax data.

Examination – The examine method is the process of reviewing, inspecting, observing, studying, or analyzing one or more assessment objects (i.e., specifications, mechanisms, or activities) to facilitate assessor understanding, achieve clarification, or obtain evidence. Observing actual agency onsite operations is a required step in the review process. The DES must tour the areas or departments which handle or store FTI, including the data processing center, regardless of whether it is agency-operated, a shared facility or a contractor facility that receives processes, transmits or stores FTI. The DES must note actual written policy and procedures, actual operational execution of these policies and procedures, as well as work flow. The inspection must also provide information about the following:

Testing – The test method is the process of exercising one or more assessment objects (i.e., activities or mechanisms) under specified conditions to compare the actual state of the object to the desired state or expected behavior of the object.

Background Check – DES must inspect and evaluate agency policy and procedure related to background investigations of employees and contractors with access to and use of FTI as well as a sample of completed employee and contractor background investigations. DES will document on a SRR and CAP the finding and require corrective action by agency of any failure to comply with IRS published standards for agency background investigation requirements. DES will note on a SDSEM any compliance failures associated with specific test cases established with regard to IRS published standards for agency background investigation requirements. SDSEM Test cases to evaluated for compliance include:

Case file reviews – These consist of spot checks of agency files and the examination of records that contain FTI.

Communication between team members, as the review is progressing, is vital and beneficial, as it can identify problems and provides information that alters or expedites the review plan. The DES must communicate shared findings with other DES reviewing other agencies. Ensure shared findings match on all agencies PFRs.

Set aside time during the closing conference to discuss the findings with POC. This allows the agency the opportunity to hear the findings and start on remediation.

The PFR and recommendations must be discussed at the closing conference. This allows the agency the opportunity to better understand what the reviewer/team has found and provide additional information, should the agency see the need to do so.

Critical findings must be reported to the Chief immediately, who will then communicate to the Area Manager.

IRS IT Contractor/ITS and DES must maintain regular communication during the review.

A deadline must be set with the agency POC for needed policy and procedures not previously provided no later than 2:00 p.m. the day before the closing.

A Need an Use Review of each agency receiving FTI must be conducted as part of the Safeguard Review.

A Need and Use Review is considered verification or confirmation of the Need and Use Justification made prior to the release of the requested tax information to the state agency

Compare FTI the agency is using versus FTI received. Determine if the agency should continue to receive all of the FTI. If not, advise the GL and the Disclosure Manager as appropriate. Document the PFR with the appropriate findings.

Ensure the agency is compliant with IRS statutes, Federal regulations, existing agency agreements (basic and implementing) service policies and MOU’s.

The scope of the review must be broad enough to provide the reviewer with sufficient information to document a conclusion as to the agency’s need for and use of FTI.

Other key areas to be reviewed would include (but are not limited to):

Verify the Need and Use Justification Statement for Use of Federal Tax Information for Tax Modeling, Revenue Estimation or other Statistical Purposes.

The PFR identifies the items requiring correction as a result of an IRS Office of Safeguards review. For each finding, the evaluated risk for potential loss, breach or misuse of FTI establishes the recommended timeframe for resolution. The risk category is noted next to each finding in this report to assist the agency in establishing priorities for corrective action. See also IRM 11.3.36.6, Safeguards Preliminary Findings Report for information on preparing the PFR.

The DES must complete the PFR during the onsite review. The title page, footer and Section E must be complete prior to the review. The document must be completed including the computer security review findings in Section H and submitted to the POC before the closing conference. The standardized findings with associated risk category are available on the SRR Standardized Findings Language Document located on the Office of Safeguards SharePoint Job Resources and Reference Documents.

SRT/FRT must implement required actions to initiate IRC 6103(p)(7) recommendation prior to issuance of the PFR. Reference IRM 11.3.36.16, Enforcement for additional information.

In general, the closing conference time will be discussed during the first evening meeting with the Chief, SRT/FRT and finalized as soon as possible thereafter.

Closings must be scheduled according to scope, resources, agency availability and the Office of Safeguards availability with the final time and date signed off by the Chief, SRT/FRT.

Email the agency POC the time of the closing conference.

Review the risk categories – emphasizing the Critical and Significant risks. The DES will review findings in sections A - G and the IRS IT Contractor/ITS will review section H. Remind agency personnel that changes in procedures made to comply with recommendations must be documented in the CAP.

Remind agency when the next SSR and CAP is due. Always ask the agencies if they have any questions before the close of conference

Advise the agency for any Critical Risk findings, the agency must submit an agency response plan to address the Critical Risk findings within 5 business days of the closing conference. The DES must do the following regarding the agency’s response plan:

Review Contact Questionnaire used to secure the name, address, telephone number, and email address for an agency's director/commissioner, an Information Technology (IT) contact, and the primary POC.

Review Prep Questionnaire used to secure information on the areas within an agency that receive, store, transmit and process FTI from receipt to destruction.

Agenda with physical locations and contact numbers

SDSEM used to note any compliance failures, with regard to IRS published standards, identified through the use of review techniques.

Critical Mitigation Plan used to identify how Critical findings from the review will be addressed, if applicable.

The Technical Inquiry & 45 Day Notification weekly inventory report is based on an electronic case management system query that focuses on the case types of TIs and 45 Day Notifications. All statuses EXCEPT "Release" are included in the query. TIs and 45 Day Notifications have a due date of 30 calendar days from receipt of inquiry .

The SRR weekly reporting is based on an electronic case management system query that focuses on “DES assignment” and “due date”. All states EXCEPT "Release" and Intake are included in the query. SRRs have a 45 calendar day completion date with a start time based on the closing conference date of the review.

The S&RT Analyst must produce a weekly SRR inventory report. The SRR will be shared with the Chiefs, SRT/FRT on a weekly basis (or as required by Chiefs, SRT/FRT) to maintain workload accountability and inventory control. The query will be produced in Excel format unless otherwise determined by Chiefs SRT/FRT.

The SSR weekly reporting is based on "IRS contractor assignment" and "due date" . All processing status EXCEPT "Release" , "Intake" , and Awaiting Agency Response are included in the query. SSR’s have a 60 calendar day completion date with a start time based on the date the SSR was received in the Safeguards mailbox.

The S&RT Analyst must produce a weekly SSR inventory report. The SSR will be shared with the AD, TAs, and Chiefs, SRT/FRT on a weekly basis (or as required by Chiefs, SRT/FRT) to identify any areas of concern and to ensure timely processing of reports in compliance with contractual guidance, maintain workload accountability and inventory control. IRS ITS Contractor will be assigned as "Case Responsible" for all SSR cases. The query will be produced in Excel format unless otherwise determined by AD, TAs and/or Chiefs, SRT/FRT .

The CAP weekly reporting is based on an electronic case management system query that focuses on agencies where open findings exist on the Plan of Actions and Milestones (POA&M). This indicates that the findings need to be addressed in a CAP. The report focuses on DES assignment, IRS IT Contractor/ITS assignment and due date. All processing status except Release, Intake and Awaiting Agency Response are included in the query. CAPs have a 45 calendar day completion date with a start time based on the date the CAP was received in the Office of Safeguards Mailbox.

The S&RT Analyst must produce a weekly CAP inventory report. This report will be shared with AD, TAs, and Chief’s SRT/FRT on a weekly basis (or as required by Chiefs, SRT/FRT) to identify any areas of concern and to ensure timely processing of reports in compliance with contractual guidance, maintain workload accountability and inventory control. DES will be assigned on an alternating basis as Case Owner, with subordinate assignments to DES staff (for Sections A - G), and to the IRS IT Contractor/ITS (for Section H) for all CAP cases. IRS IT Contractor/ITS will be responsible for assisting with working Section H of the CAPs on an as needed basis as determined by the Chiefs, SRT/FRT. The IRS IT Contractor will be responsible for reporting the status of active CAP’s during weekly inventory call (see note below). The query will be produced in Excel format unless otherwise determined by AD, TAs, and/or Chiefs, SRT/FRT.

Follow required actions below when SSRs have not been filed for two consecutive reporting years as follows:

Follow required actions below when CAP have not been filed for two consecutive reporting periods as follows:

Initiate enforcement recommendation if agency continues to make unauthorized FTI accesses/disclosures.

Initiate enforcement recommendation if agency will not allow the Office of Safeguards to conduct required reviews, or will not allow the use of automated tools to evaluate security configurations of IT devices.

Initiate enforcement recommendation if agency does not mitigate findings categorized as Critical Risk (repeat Critical findings).

Initiate enforcement recommendation if agency has Severe Critical Risk or Multiple Critical Risk findings identified.

In all cases where serious deficiencies are found or where required reports are not submitted, the responsible reviewer will attempt to obtain voluntary compliance through discussion and negotiation.

When an impasse occurs, involving recipients subject to IRC 6103(p)(4) , the matter must be elevated to the appropriate GLDS management level.

Communicate with S&RT Chief and ETA to validate the clear requirement for enforcement and document discussion in eCase.

Required actions to initiate IRC 6103(p)(7)recommendation include:

If the appropriate management is unable to break the impasse, the recipient agency must be notified in writing of the IRS’s preliminary determination and intention to recommend discontinuance of disclosures through the issuance of the (p)(7) Warning Letter.

Such notices must allow 30 calendar days for response. Notices must indicate:

At this time, a written report must be prepared and submitted by the AD, Office of Safeguards to the Director, GLDS. The FTI Suspension and/or Termination Memo must follow the following format:

If it is determined that Federal tax administration would be impaired because of a safeguards deficiency, a duly delegated IRS official (see Delegation Order 11-2) can immediately suspend disclosures to the agency pursuant to IRC 6103(p)(4)and 26 CFR 301.6103(p)(7)-1. This would be the case where unauthorized accesses/disclosures would be made absent the suspension. See IRM 11.3.36.16.

If the 30 day time frame expires without the agency taking satisfactory action, a letter must be drafted to the head of the agency from the Delegation Order 11-2 official notifying the agency that disclosures are being discontinued until such time as the deficiency is corrected. Copies of the letter must be sent to the AD, Office of Safeguards and to the Director, Office of GLDS. Documentation detailing the uncorrected deficiencies and the agency's reasons, if any, for noncompliance will be organized and maintained.

The Director, GLDS actions will be similar to those stated in item 5 above. If the Director is unable to break the impasse, the HOA will be notified in writing of the IRS’s preliminary determination and the Director's intention to recommend discontinuance of disclosure. The notice will allow 30 calendar days for response.

If the 30 day time frame expires without the agency taking satisfactory action, two copies of the proposed letter to discontinue disclosures will be drafted to the HOA, from the Director, Office of GLDS ,notifying the agency that disclosures are being discontinued until such time as the deficiency is corrected. Following the Director's signature, one signed copy will be retained in Headquarters Office, and the other will be forwarded to the AD, Office of Safeguards and to the Director, Governmental Liaison, Disclosure and Safeguards.

The discontinuance of disclosures can take several forms. The appropriate form is dependent upon all of the facts in the case.

All disclosures to an agency can be suspended or permanently cutoff in situations where the deficiency pervades the entire agency or where the agency refuses to submit the required reports.

Suspensions or cutoffs of selected information can be used in cases where the deficiency can be isolated in a certain segment of the agency.