IRS relies on automated information systems to process over 200 million taxpayer returns and collect over $1 trillion in taxes annually. IRS operates 10 facilities throughout the United States to process tax returns and other information supplied by taxpayers. These data are then electronically transmitted to a central computing facility, where master files of taxpayer information are maintained and updated. A second computing facility processes and stores taxpayer data used by IRS in conducting certain compliance functions. There are also hundreds of other IRS facilities (e.g., regional and district offices) that support tax processing. Because of IRS’ heavy reliance on systems, effective security controls are critical to IRS’ ability to maintain the confidentiality of taxpayer data, safeguard assets, and ensure the reliability of financial management information. The Computer Security Act requires, among other things, the establishment of standards and guidelines for ensuring the security and privacy of sensitive information in federal computer systems. Similarly, IRS’ Tax Information Security Guidelines require that all computer and communication systems that process, store, or transmit taxpayer data adequately protect these data, and the Internal Revenue Code prohibits the unauthorized disclosure of federal returns and return information outside IRS. To adequately protect the data, IRS must ensure that (1) access to computer data, systems, and facilities is properly restricted and monitored, (2) changes to computer systems software are properly authorized and tested, (3) backup and recovery plans are prepared, tested, and maintained to ensure continuity of operations in the case of a disaster, and (4) data communications are adequately protected from unauthorized intrusion and interception. Also, Treasury requires IRS to have C2-level safeguards to protect the confidentiality of taxpayer data. The Department of Defense defines a hierarchy of security levels (i.e., A1, B3, B2, B1, C2, C1, and D) with A1 currently being the highest level of protection and D being the minimum level of protection. C2-level safeguards include all the requirements from the D and C1 levels and are required by IRS for all sensitive but unclassified data. These safeguards ensure need-to-know protection and controlled access to data, including a security policy that requires access control; identification and authentication that provide mechanisms to continually maintain accountability; operational and life-cycle assurances that include validations of system integrity and computer systems tests of security mechanisms; and documentation such as a security features user’s guide, test documentation, and design documentation. Over the past 3 years, we testified and reported numerous times on serious weaknesses with security and other internal controls used to safeguard IRS computer systems and facilities. For instance, in August 1993, we identified weaknesses in IRS’ systems which hampered the Service’s ability to effectively protect and control taxpayer data. In this regard, we found that (1) IRS did not adequately control access given to computer support personnel over taxpayer data and (2) established controls did not provide reasonable assurance that only approved versions of computer programs were implemented. Subsequently, in December 1993, IRS identified taxpayer data security as a material weakness in its Federal Managers’ Financial Integrity Act report. In 1994, we also reported, and IRS acknowledged, that while IRS had made some progress in correcting computer security weaknesses, IRS still faced serious and longstanding control weaknesses over automated taxpayer data. Moreover, we reported that these longstanding weaknesses were symptomatic of broader computer security management issues, namely, IRS’ failure to (1) clearly delineate responsibility and accountability for the effectiveness of computer security within the agency and (2) establish an ongoing process to assess the effectiveness of the design and implementation of computer controls. To address these issues, we recommended that IRS greatly strengthen its computer security management, and IRS agreed to do so. The unauthorized electronic access of taxpayer data by IRS employees— commonly referred to as browsing—has been a longstanding problem for the Service. In October 1992, IRS’ Internal Audit reported that the Service had limited capability to (1) prevent employees from unauthorized access to taxpayers’ accounts and (2) detect an unauthorized access once it occurred. We reported in September 1993 that IRS did not adequately (1) restrict access by computer support staff to computer programs and data files or (2) monitor the use of these resources by computer support staff and users. As a result, personnel who did not need access to taxpayer data could read and possibly use this information for fraudulent purposes. Also, unauthorized changes could be made to taxpayer data, either inadvertently or deliberately for personal gain, for example, to initiate unauthorized refunds or abatements of tax. In August 1995, we reported that the Service still lacked sufficient safeguards to prevent or detect unauthorized browsing of taxpayer information. Several organizations within the IRS are responsible for the security of IRS computer resources and the facilities that house them. For example, the Office of the Chief Information Officer is responsible for formulating policies and issuing guidelines for logical security, data security, risk analysis, security awareness, security management, contingency planning, and telecommunications. The Real Estate division within the Office of the Chief for Management and Administration is responsible for formulating policies and issuing guidelines for physical security. The field offices (e.g., service centers, computing centers, regional offices, district offices) are responsible for implementing these policies and guidelines at their locations. Compliance with the policies and procedures is assessed by both the headquarters and field offices. Weaknesses in IRS’ computer systems security continue to place taxpayer data and IRS’ automated information systems at risk to both internal and external threats, which could result in the loss of computer services, or in the unauthorized disclosure, modification, or destruction of taxpayer data. While IRS has made some progress in protecting taxpayer data, serious weaknesses persist. During our five on-site reviews, we found numerous weaknesses in the following eight functional areas: physical security, logical security, data communications management, risk analysis, quality assurance, internal audit and security, security awareness, and contingency planning.Primary weaknesses were in the areas of physical and logical security. Physical security and access control measures, such as locks, guards, fences, and surveillance equipment, are critical to safeguarding taxpayer data and computer operations from internal and external threats. We found many weaknesses in physical security at the facilities visited. The following are examples of these weaknesses: Collectively, the five facilities could not account for approximately 6,400 units of magnetic storage media, such as tapes and cartridges, which could contain taxpayer data. The number per facility ranged from a low of 41 to a high of 5,946. Fire suppression trash cans were not used in several facilities. Printouts containing taxpayer data were left unprotected and unattended in open areas of two facilities where they could be compromised. Logical security controls limit access to computing resources to only those (personnel and programs) with a need to know. Logical security control measures include the use of safeguards incorporated in computer hardware, system and application software, communication hardware and software, and related devices. We found numerous weaknesses in logical security at the facilities visited. Examples of these vulnerabilities include the following: Tapes containing taxpayer data were not overwritten prior to reuse. Access to system software was not limited to individuals with a need to know. For example, at two facilities, we found that data base administrators had access to system software, although their job functions and responsibilities did not require it. Application programmers were allowed to move development software into the production environment without adequate controls. In addition, these programmers were allowed to use taxpayer data for testing purposes, which places these data at unnecessary risk of unauthorized disclosure and modification. Data communications management is the function of monitoring and controlling communications networks to ensure that they operate as intended and transmit timely, accurate, and reliable data securely. Without adequate data communications security, the data being transmitted can be destroyed, altered, or diverted, and the equipment itself can be damaged. At the five facilities, we found numerous communications management weaknesses. The purpose of risk analysis is to identify security threats, determine their magnitude, and identify areas needing additional safeguards. We found risk analysis weaknesses at the five facilities. For example, none of the facilities visited conducted a complete risk analysis to identify and determine the severity of all the security threats to which they were vulnerable. Without these analyses, systems’ vulnerabilities may not be identified and appropriate controls not implemented to correct them. An effective quality assurance program requires reviewing software products and activities to ensure that they comply with the applicable processes, standards, and procedures and satisfy the control and security requirements of the organization. One aspect of a quality assurance program is validating that software changes are adequately tested and will not introduce vulnerabilities into the system. We found many weaknesses in quality assurance at the five facilities visited, including instances of failing to independently test all software prior to placing it into operation. In addition, when software products were tested, this testing was sometimes incomplete (e.g., did not include integrity or stress testing).Such quality assurance weaknesses can result in systems not functioning properly, putting federal taxpayer data at risk. Internal audit and internal security functions are needed to ensure that safeguards are adequate and to alert management to potential security problems. We found many weaknesses in the internal audit or internal security functions at the five facilities visited. For example, two of the facilities had not audited operations within the last 5 years. An effective security awareness program is the means through which management communicates to employees the importance of security policies, procedures, and responsibilities for protecting taxpayer data. Three of the five IRS facilities did not have an adequate security awareness program. For example, at one site there was no process in place for ensuring that management was made aware of security violations and security related issues. We found several security awareness weaknesses at four of the five facilities. A contingency plan specifies emergency response, backup operations, and post disaster recovery procedures to ensure the availability of critical resources and facilitate the continuity of operations in an emergency situation. It addresses how an organization plans to deal with the full range of contingencies from electrical power failures to catastrophic events, such as earthquakes, floods, and fires. It also identifies essential business functions and prioritizes resources in order of criticality.