IRS relies on automated information systems to process over 200 million taxpayer returns and collect over $1.6 trillion in taxes annually. IRS uses its computer systems to, among other things, process tax returns, maintain taxpayer data, calculate interest and penalties, and generate refunds. IRS operates facilities throughout the United States that process tax returns and other information supplied by taxpayers. The data are then electronically transmitted to master files of taxpayer information that are maintained and updated. Because of IRS’ heavy reliance on its facilities, effective security controls are critical to IRS’ ability to maintain the confidentiality of sensitive taxpayer data, safeguard assets, and ensure the reliability of financial management information. Federal law, Department of the Treasury directives, and IRS’ own internal policies and procedures require the implementation of sound security practices and standards. The Computer Security Act and the Clinger-Cohen Act require, among other things, the establishment of standards and guidelines for ensuring the security and privacy of sensitive information in federal computer systems. Similarly, IRS’ tax information security guidelines require that all computer and communications systems that process, store, or transmit taxpayer data adequately protect these data, and the Internal Revenue Code prohibits the unauthorized disclosure of federal returns and return information outside IRS. To adequately comply with these guidelines, IRS must ensure that (1) access to computer data, systems, and facilities is properly restricted and monitored, (2) changes to computer systems software are properly authorized and tested, (3) backup and recovery plans are prepared, tested, and maintained to ensure continuity of operations in the case of a disaster, and (4) data communications are adequately protected from unauthorized intrusion and interception. The need for strong and effective computer security over taxpayer information is clear. IRS computer systems contain sensitive taxpayer information such as name, address, social security number, and details on each taxpayer’s financial holdings. As we previously reported, these and similar types of information have been used to commit financial crimes and identity fraud nationwide. Commonly reported financial crimes include using someone’s personal information to fraudulently establish credit, run up debt, or take over and deplete existing financial accounts. Taxpayers can suffer injury to their reputations when credit is fraudulently established and debts incurred in their names. Bad credit could in turn lead to difficulties in obtaining loans or jobs and require a lengthy and expensive process to clear one’s personal records. Over the past 5 years, we have reviewed the effectiveness of IRS security and general controls as part of our annual audit of IRS’ financial statements. During this period, we testified and reported numerous times on the ineffectiveness of these controls in safeguarding IRS computer systems and facilities. In April 1997, we reported on serious weaknesses at five IRS facilities that we visited. These weaknesses were in eight functional areas, which are (1) physical security, (2) logical security,(3) data communications management, (4) risk analysis, (5) quality assurance, (6) internal audit and security, (7) security awareness, and (8) contingency planning. We also noted that IRS’ ability to monitor and detect the unauthorized access and perusal of electronic taxpayer records by IRS employees, also known as browsing, was limited. We reported that until these weaknesses are corrected, IRS runs the risk of its tax processing operations being disrupted and taxpayer data being improperly used, modified, or destroyed. Because of the seriousness of the weaknesses, we recommended, among other things, that IRS (1) reevaluate its current approach to computer security and report its plans for improving computer security to the Congress and (2) prepare and submit a plan to the Congress for correcting all the weaknesses identified at the five facilities and for identifying and correcting security weaknesses at the other IRS facilities. In 1997, the Congress passed the Taxpayer Browsing Protection Actwhich amended the Internal Revenue Code of 1986 to make unlawful unauthorized access and inspection of taxpayer records a crime and to establish penalties for unlawful access and inspection of taxpayer records. The objectives of our review were to determine and summarize the status of the computer-related general control weaknesses identified at the five IRS facilities discussed in our April 1997 report and to assess the effectiveness of computer controls at a sixth facility. To determine the effectiveness of IRS’ corrective actions taken to resolve these weaknesses, we interviewed agency officials responsible for correcting them, reviewed these officials’ action plans and status reports, and conducted on-site evaluations to verify the effectiveness of corrective actions taken. Our on-site evaluations of IRS computer-related general controls were conducted in conjunction with our audit of IRS’ fiscal year 1997 custodial financial statements and with the assistance of the independent public accounting firm which also participated in the review supporting our April 1997 report. Our evaluations included the review of related IRS policies and procedures; on-site tests and observations of computer-related controls; and discussions with IRS headquarters and facility personnel, security representatives, and other pertinent officials at the locations visited. Our evaluation did not include external penetration testing of IRS computer facilities. We performed evaluations at six IRS facilities—the five facilities visited during our previous review and one additional facility. We requested and received IRS comments on the results of our on-site evaluations from the Director of the Office of Systems Standards and Evaluation, who has servicewide responsibility for computer security. We did not verify IRS’ statements regarding corrective actions taken subsequent to our site visits but plan to do so during future reviews. To evaluate IRS’ computer security management, we assessed information pertaining to computer controls in place at headquarters and field locations and held discussions with headquarters officials. We did not assess the computer-related controls that IRS plans to incorporate under any of its long-term plans to modernize its tax processing systems. We also did not assess IRS efforts to resolve the Year 2000 computing crisis. Our work was performed at IRS headquarters in Washington, D.C., and at six facilities located throughout the United States from November 1997 through July 1998. We performed our work in accordance with generally accepted government auditing standards. IRS has taken and is taking action to implement the recommendations contained in our April 1997 report to improve computer security. For example, IRS designated computer security as a material weakness in its fiscal year 1997 Federal Managers’ Financial Integrity Act report, acknowledging the seriousness of these computer-related general control weaknesses and the risk they pose to the agency’s operations. IRS has established the Office of Systems Standards and Evaluation to centralize responsibility for IRS security and privacy issues. The office is staffed with over 60 security, privacy, systems life-cycle, and administrative specialists led by two senior executives who report to the Chief Information Officer. The office is responsible for establishing and enforcing standards and policies for all major security programs including, but not limited to, physical security, data security, and systems security. IRS has acted to address recommendations made in our April 1997 report by preparing and transmitting to the Congress a high-level action plan for identifying and correcting the security weaknesses at all of its facilities including the five facilities discussed in our prior report; reevaluating and establishing a new approach to managing computer security that involves the resolution of security weaknesses and issues by facility type, including computing centers, service centers, district offices, and others; and submitting to the Congress its plan for improving the service’s management approach to computer security. In addition, the Office of Systems Standards and Evaluation has developed computer security awareness briefings on unauthorized access to taxpayers’ records, conducted computer security reviews at IRS facilities, and developed a tracking system for reporting the status of actions planned or taken to correct the weaknesses identified in our April 1997 report. We confirmed that IRS has corrected or has implemented compensating controls that mitigated the risks associated with 63 percent of the total weaknesses identified in our April 1997 report. Each facility had varying degrees of success resolving the weaknesses previously reported. The actual rate of resolution ranged from 42 percent to 80 percent. Corrective actions taken by one or more of the five facilities include strengthening the overall controls over physical access to IRS facilities, reducing the number of IRS employees authorized to read or change sensitive system files and/or taxpayer data, conducting risk analyses of the facilities and of locally developed computer programs, updating and testing some disaster recovery plans, and improving overall security awareness. Although IRS has made significant strides in improving computer security at certain facilities, an effective servicewide computer security management program has not yet been fully implemented. Our study of the security management practices of leading organizations found that these organizations successfully managed their information security risks through an ongoing cycle of risk management activities. As shown in figure 1, each of these activities is linked in a cycle to help ensure that business risks are continually monitored, policies and procedures are regularly updated, and controls are in effect. The risk management cycle begins with an assessment of risks and a determination of needs. This assessment includes identifying cost-effective policies and related controls. The policies and controls, as well as the risks that prompted their adoption, must be communicated to those responsible for complying with them and implemented. Finally, and perhaps most important, there must be procedures for evaluating the effectiveness of policies and related controls and reporting the resulting conclusions to those who can take appropriate corrective action. In addition, our study found that a strong central security management focal point can help ensure that the major elements of the risk management cycle are carried out and can serve as a communications link among organizational units. Since our April 1997 report, IRS has taken several actions consistent with the risk management cycle described above to improve its servicewide computer security management program. For example, IRS created the Office of Systems Standards and Evaluation as the central focal point for computer security within IRS, published revised computer security policies and procedures, promoted security awareness, and is evaluating controls at many of its facilities. However, several actions have not yet been completed or performed. For example, IRS has not fully (1) assessed risks for all of its facilities, networks, major systems, and data, (2) evaluated controls over key computing resources, and (3) implemented actions to eliminate or mitigate all of the weaknesses identified during computer control evaluations.