In addition, NIST is  responsible for developing standards and guidelines that include  minimum information security requirements. In carrying out its  mission, IRS relies extensively on computerized information systems,  which it must effectively secure to protect sensitive financial and taxpayer  data for the collection of taxes, processing of tax returns, and  enforcement of federal tax laws. Although IRS Has Made Improvements, Information Security Weaknesses Continue to Place Taxpayer and Financial Data at Risk

As we reported in March 2016, IRS has implemented numerous  protections over key financial and tax processing systems; however, it  had not always effectively implemented access and other controls,  including elements of its information security program. In our most recent review we determined that IRS had improved access  controls, but some weaknesses remain. However, key systems we  reviewed had not been configured to encrypt sensitive user  authentication data. Nevertheless, the control weaknesses can be attributed in part to IRS’s  inconsistent implementation of elements of its agency-wide information  security program. The collective effect of the deficiencies in information security from prior  years that continued to exist in fiscal year 2015, along with the new  deficiencies we identified, are serious enough to merit the attention of  those charged with governance of IRS and therefore represented a  significant deficiency in IRS’s internal control over financial reporting  systems as of September 30, 2015. Implementing these recommendations—in addition to the 49 outstanding  recommendations from previous audits—will help IRS improve its controls  for identifying and authenticating users, limiting users’ access to the  minimum necessary to perform their job-related functions, protecting  sensitive data when they are stored or in transit, auditing and monitoring  system activities, and physically securing its IT facilities and resources. We recommended that IRS  correct these weaknesses, but the agency has yet to fully address them. IRS Faces Challenges in Addressing Identity Theft Refund Fraud

The importance of protecting taxpayer information is further highlighted by  the billions of dollars that have been lost to IDT refund fraud, which  continues to be an evolving threat. Given current and emerging risks, in 2015 we expanded our  high-risk area on the enforcement of tax laws to include IRS’s efforts to  address IDT refund fraud. IRS has taken steps to address IDT refund fraud; however, it remains a  persistent and evolving threat. The agency has also taken actions to improve customer service related to  IDT fraud by, for example, providing an increased level of service to  taxpayers calling its identity theft toll-free phone line. Accordingly, we recommended that IRS assess the costs,  benefits, and risks of its authentication options. In November 2015, IRS officials told us that the agency had developed  guidance for its Identity Assurance Office to assess costs, benefits, and  risk of authentication tools. Accordingly, OMB and NIST have prescribed policies, standards, and  guidelines that are intended to assist federal agencies with identifying and  providing information security protections commensurate with the risk and  magnitude of harm resulting from the unauthorized access, use,  disclosure, alteration, and destruction of information and information  systems, including those systems operated by a contractor or others on  behalf of the agency. In particular, DHS is responsible for administering, in consultation with OMB, the implementation of  agency information security policies and practices for information  systems (other than national security systems, Department of  Defense, and the intelligence community’s “debilitating impact”  systems); developing, issuing, and overseeing the implementation of binding  operational directives to agencies on matters such as incident  reporting, contents of agency’s annual reports, and other operational  requirements; and operating the federal information security incident center (the U.S  Computer Emergency Readiness Team or US-CERT), deploying  technology to continuously diagnose and mitigate threats, compiling  and analyzing data, and developing and conducting targeted  operational evaluations, including threat and vulnerability  assessments of systems. In May 2015 DHS issued its first directive, which required all departments  and agencies to review and mitigate all critical vulnerabilities on their  Internet-facing systems.
Why GAO Did This Study

In collecting taxes, processing returns, and providing taxpayer service, IRS relies extensively on computerized information systems. Accordingly, it is critical that sensitive taxpayer and other data are protected. Recent data breaches at IRS highlight the vulnerability of taxpayer information. In addition, identity theft refund fraud is an evolving threat that occurs when a thief files a fraudulent tax return using a legitimate taxpayer's identity and claims a refund.
Since 1997, GAO has designated federal information security as a government-wide high-risk area, and in 2015 it expanded this area to include the protection of personally identifiable information. GAO also added identity theft refund fraud to its high-risk area on the enforcement of tax laws.
This statement discusses (1) IRS's information security controls over tax processing and financial systems and (2) roles that federal agencies with government-wide information security responsibilities play in providing guidance and oversight to agencies. This statement is based on previously published GAO work and a review of federal guidance.

What GAO Found

In March 2016 GAO reported that the Internal Revenue Service (IRS) had instituted numerous controls over key financial and tax processing systems; however, it had not always effectively implemented safeguards intended to properly restrict access to systems and information. In particular, while IRS had improved some of its access controls, weaknesses remained with identifying and authenticating users, authorizing users' level of rights and privileges, encrypting sensitive data, auditing and monitoring network activity, and physically securing its computing resources. These weaknesses were due in part to IRS's inconsistent implementation of its agency-wide security program, including not fully implementing GAO recommendations. The table below shows the status of prior and new GAO recommendations as of the end of its fiscal year (FY) 2015 audit of IRS's information security. GAO concluded that these weaknesses collectively constituted a significant deficiency for the purposes of financial reporting for fiscal year 2015. Until they are effectively mitigated, taxpayer and financial data will continue to be exposed to unnecessary risk.
The importance of protecting taxpayer information is further highlighted by the billions of dollars that have been lost to identity theft refund fraud, which continues to be an evolving threat. While IRS has taken steps to address this issue, as GAO reported in January 2015 it has yet to assess the costs, benefits, and risks of methods for improving the authentication of taxpayers' identity.
The Office of Management and Budget (OMB), National Institute of Standards and Technology (NIST) and the Department of Homeland Security (DHS) provide government-wide guidance and oversight for federal information security. These agencies have taken a number of actions to carry out these responsibilities. For example:
OMB has prescribed security policies, including direction on ensuring that online services provided by agencies are secure and protect privacy.
NIST has developed standards and guidelines for implementing security controls, including those for authenticating users during online transactions.
DHS has issued a directive requiring departments and agencies to mitigate critical vulnerabilities on their Internet-facing systems. It also assists agencies in monitoring their networks for malicious traffic.

What GAO Recommends

In addition to 49 prior recommendations that had not been implemented, GAO made 45 new recommendations to IRS in March 2016 to further improve its information security controls and program. GAO also recommended that IRS assess costs, benefits, and risks of taxpayer authentication options.