In April 1997, we reported on serious weaknesses at five IRS facilities that we visited. We reported that until these weaknesses are corrected, IRS runs the risk of its tax processing operations being disrupted and taxpayer data being improperly used, modified, or destroyed. IRS has acted to address recommendations made in our April 1997 report by preparing and transmitting to the Congress a high-level action plan for identifying and correcting the security weaknesses at all of its facilities including the five facilities discussed in our prior report; reevaluating and establishing a new approach to managing computer security that involves the resolution of security weaknesses and issues by facility type, including computing centers, service centers, district offices, and others; and submitting to the Congress its plan for improving the service’s management approach to computer security. IRS Has Not Yet Fully Institutionalized Its Servicewide Computer Security Management Program

Although IRS has made significant strides in improving computer security at certain facilities, an effective servicewide computer security management program has not yet been fully implemented. Our current review identified weaknesses that remain uncorrected at the five facilities visited during our prior audit and additional weaknesses we identified at those locations and at a sixth facility included in this review. If properly implemented, this system would improve IRS’ capability to detect unauthorized accesses to taxpayer data. Examples of these weaknesses follow. Conclusions

IRS has made significant progress in correcting its serious weaknesses in computer security controls intended to safeguard IRS computer systems, data, and facilities. Until IRS identifies and corrects all of its critical computer security weaknesses and fully institutionalizes an effective servicewide computer security management program, the service will continue to expose its tax processing operations to the risk of disruption; taxpayer data to the risk of unauthorized use, modification, and destruction; and taxpayers to loss and damages resulting from identity fraud and other financial crimes. IRS specified the actions it has taken or plans to take to adequately mitigate the remaining weaknesses and stated that an additional 12 percent of the weaknesses have been corrected since the completion of our review. We will review the actions taken by IRS to mitigate the remaining weaknesses as part of our audit of IRS’ fiscal year 1998 financial statements.
Why GAO Did This Study

Pursuant to a congressional request, GAO reviewed the Internal Revenue Service's (IRS) progress in correcting serious computer security weaknesses at five IRS facilities, focusing on: (1) additional security weaknesses identified at the five facilities and at an IRS facility not included in GAO's previous report; and (2) steps IRS has taken or plans to take to implement a service-wide computer security management program.

What GAO Found

GAO noted that:(1) IRS is making significant progress to improve computer security over its facilities; (2) since GAO's April 1997 report, IRS has acknowledged the seriousness of its computer security weaknesses, consolidated overall responsibility for computer security management within one executive-level office under its Chief Information Officer, reevaluated its approach to computer security management, and developed a high-level plan for mitigating the weaknesses GAO identified; (3) GAO found that IRS has corrected or mitigated the risks associated with 63 percent of the weaknesses discussed in its prior report; (4) while progress has been made, serious weaknesses continue to exist at the five facilities visited during GAO's prior audit, and it identified several additional weaknesses at those locations and at a sixth facility included in this review; (5) these weaknesses exist primarily because IRS has not yet fully institutionalized its computer security management program; (6) these weaknesses affect IRS' ability to control physical access to its data processing facilities and sensitive taxpayer data and computer programs, prevent or detect unauthorized changes to taxpayer data or computer software, and restore essential IRS operations following an emergency or natural disaster; (7) until these weaknesses are mitigated, IRS continues to run the risk of its tax processing operations being disrupted; (8) furthermore, sensitive taxpayer data entrusted to IRS could be disclosed to unauthorized individuals, improperly used or modified, or destroyed, thereby exposing taxpayers to loss or damages resulting from identity fraud and other financial crimes; (9) in comments agreeing with GAO's recommendations, IRS stated that since the end of GAO's review, it had also specified actions planned and under way to address the remaining weaknesses; and (10) GAO will review those actions as part of its audit of IRS' fiscal year 1998 financial statements.