In its role as the nation’s tax collector, IRS has a demanding responsibility  in collecting taxes, processing tax returns, and enforcing the nation’s tax  laws. Objectives, Scope, and Methodology

The objectives of our review were to determine (1) the status of IRS’s  actions to correct or mitigate previously reported weaknesses at two sites  and (2) whether controls over key financial and tax processing systems  located at the sites are effective in ensuring the confidentiality, integrity,  and availability of financial and sensitive taxpayer data. IRS Has Made Progress in Correcting Previously Reported Weaknesses

IRS has made progress toward implementing more effective information  security controls over key financial and tax processing systems that are  located at two critical data processing sites, and has corrected or mitigated  41 of the 81 specific technical weaknesses that we reported as unresolved  at the time of our last reviews at the selected sites. Electronic access  controls include those related to network management, user accounts and  passwords, user rights and file permissions, and logging and monitoring of  security-relevant events. IRS’s electronic access controls were inadequate. These controls include policies, procedures, and  control techniques to physically secure computer resources, prevent  exploitation of vulnerabilities, and prevent unauthorized changes to system  software. Information Security Program Is Not Yet Fully Implemented

A key reason for the information security weaknesses in IRS’s financial and  tax processing systems was that although the agency has developed and  documented policies and procedures, it has not yet fully implemented its  information security program to help ensure that effective controls were  established and maintained. FISMA requires agencies to develop, document, and implement an  information security program that includes  periodic assessments of the risk and the magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information and information systems;  policies and procedures that (1) are based on risk assessments, (2) cost- effectively reduce risks, (3) ensure that information security is  addressed throughout the life cycle of each system, and (4) ensure  compliance with applicable requirements;  plans for providing adequate information security for networks,  facilities, and systems;  security awareness training to inform personnel—including contractors  and other users of information systems—of information security risks  and of their responsibilities in complying with agency policies and  procedures;  at least annual testing and evaluation of the effectiveness of information  security policies, procedures, and practices relating to management,  operational, and technical controls of every major information system  that is identified in the agencies’ inventories;  a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in their information security  policies, procedures, or practices;  procedures for detecting, reporting, and responding to security   plans and procedures to ensure continuity of operations for information  systems that support the operations and assets of the agency. Conclusions

IRS has made progress in correcting or mitigating previously reported  weaknesses and in implementing controls over key financial and tax  processing systems. However, information security weaknesses—both old  and new—continue to impair its ability to ensure the confidentiality,  integrity, and availability of financial and other sensitive data. Until IRS fully implements a comprehensive agencywide  information security program that includes enhanced policies, procedures,  plans, training, and continuity of operations, its facilities and computing  resources and the information that is processed, stored, and transmitted on  its systems will remain vulnerable.
Why GAO Did This Study

The Internal Revenue Service (IRS) has a demanding responsibility in collecting taxes, processing tax returns, and enforcing the nation's tax laws. It relies extensively on computerized systems to support its financial and mission-related operations. Effective information security controls are essential for ensuring that information is adequately protected from inadvertent or deliberate misuse, disruption, or destruction. As part of its audit of IRS's fiscal year 2005 financial statements, GAO assessed (1) the status of IRS's actions to correct or mitigate previously reported information security weaknesses at two sites and (2) whether controls over key financial and tax processing systems located at the facilities are effective in ensuring the confidentiality, integrity, and availability of financial and sensitive taxpayer data.

What GAO Found

IRS has made progress in correcting or mitigating previously reported information security weaknesses and in implementing controls over key financial and tax processing systems that are located at two of its critical data processing sites. It has corrected or mitigated 41 of the 81 specific technical weaknesses that we reported as unresolved at the time of our last review at those selected sites. Although IRS has made progress, controls over its key financial and tax processing systems located at two sites were ineffective. In addition to the 40 previously reported weaknesses for which IRS has not completed actions, GAO identified new information security control weaknesses that threaten the confidentiality, integrity, and availability of IRS's financial information systems and the information they process. For example, IRS has not implemented effective electronic access controls related to network management, user accounts and passwords, user rights and file permissions, and logging and monitoring of security-related events. In addition, it has not effectively implemented other information security controls to physically secure computer resources, and to prevent exploitation of vulnerabilities and unauthorized changes to system software. Collectively, these weaknesses increase the risk that sensitive financial and taxpayer data will be inadequately protected against disclosure, modification, or loss, possibly without detection, and place IRS operations at risk of disruption. A key reason for IRS's weaknesses in information security controls is that it has not yet fully implemented an information security program to ensure that effective controls are established and maintained. Until IRS fully implements a comprehensive agencywide information security program, its facilities and computing resources and the information that is processed, stored, and transmitted on its systems will remain vulnerable.