In fiscal year 2006, IRS collected about $2.5 trillion in tax  payments, processed hundreds of millions of tax and information returns,  and paid about $277 billion in refunds to taxpayers. Objectives, Scope, and Methodology

The objectives of our review were to determine (1) the status of IRS’s  actions to correct or mitigate previously reported weaknesses at two data  processing sites and (2) whether controls over key financial and tax  processing systems located at three sites were effective in ensuring the  confidentiality, integrity, and availability of financial and sensitive  taxpayer information. IRS Made Limited Progress in Correcting Previously Reported Weaknesses

IRS has made limited progress toward correcting previously reported  information security weaknesses at two data processing sites. Specifically,  it has corrected or mitigated 25 of the 73 weaknesses that we reported as  unresolved at the time of our last review. Significant Weaknesses Continue to Place Financial and Taxpayer Information at Risk

Significant weaknesses in access controls and other information security  controls continue to threaten the confidentiality, integrity, and availability  of IRS’s financial and tax processing systems and information. A primary  reason for these weaknesses is that IRS has not yet fully implemented its  information security program. As a result, IRS’s ability to perform vital  functions could be impaired and the risk of unauthorized disclosure,  modification, or destruction of financial and sensitive taxpayer  information is increased. Access controls include those related to user identification and  authentication, authorization, cryptography, audit and monitoring, and  physical security. IRS did not consistently audit and monitor security-relevant system  activity on its applications. FISMA requires each agency to  develop, document, and implement an information security program that,  among other things, includes    periodic assessments of the risk and the magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information and information systems;   policies and procedures that (1) are based on risk assessments, (2) cost- effectively reduce risks, (3) ensure that information security is addressed  throughout the life cycle of each system, and (4) ensure compliance with  applicable requirements;    plans for providing adequate information security for networks, facilities,    security awareness training to inform personnel of information security  risks and of their responsibilities in complying with agency policies and  procedures, as well as training personnel with significant security  responsibilities for information security;   at least annual testing and evaluation of the effectiveness of information  security policies, procedures, and practices relating to management,  operational, and technical controls of every major information system that  is identified in the agency’s inventories;   a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in its information security  policies, procedures, or practices; and   plans and procedures to ensure continuity of operations for information  systems that support the operations and assets of the agency. These deficiencies represent a  material weakness in IRS’s internal controls over its financial and tax  processing systems. A key reason for these weaknesses is that the agency  has not yet fully implemented critical elements of its agencywide  information security program. Until IRS (1) fully implements a  comprehensive agencywide information security program that includes  risk assessments, enhanced policies and procedures, security plans,  training, adequate tests and evaluations, and a continuity of operations  process for all major systems and (2) begins to address weaknesses across  the service, its facilities, computing resources, and the financial and  sensitive taxpayer information on its systems will remain vulnerable. I) on a draft of this  report, the Commissioner of Internal Revenue stated that IRS understands  that information security controls are essential for ensuring information is  adequately protected from inadvertent or deliberate misuse, disruption, or  destruction.
Why GAO Did This Study

In fiscal year 2006, the Internal Revenue Service (IRS) collected about $2.5 trillion in tax payments and paid about $277 billion in refunds. Because IRS relies extensively on computerized systems, effective information security controls are essential to ensuring that financial and taxpayer information is adequately protected from inadvertent or deliberate misuse, fraudulent use, improper disclosure, or destruction. As part of its audit of IRS's fiscal years 2006 and 2005 financial statements, GAO assessed (1) IRS's actions to correct previously reported information security weaknesses and (2) whether controls were effective in ensuring the confidentiality, integrity, and availability of financial and sensitive taxpayer information. To do this, GAO examined IRS information security policies and procedures, guidance, security plans, reports, and other documents; tested controls over five critical applications at three IRS sites; and interviewed key security representatives and management officials.

What GAO Found

IRS has made limited progress toward correcting or mitigating previously reported information security weaknesses at two data processing sites, but 66 percent of the weaknesses that GAO had previously identified still existed. Specifically, IRS has corrected or mitigated 25 of the 73 information security weaknesses that GAO reported as unresolved at the time of our last review. For example, IRS has improved password controls on its servers and enhanced audit and monitoring efforts for mainframe and Windows user activity, but it continues to (1) use inadequate account lockout settings for Windows servers and (2) inadequately verify employees' identities against official IRS photo identification. Significant weaknesses in access controls and other information security controls continue to threaten the confidentiality, integrity, and availability of IRS's financial and tax processing systems and information. For example, IRS has not implemented effective access controls related to user identification and authentication, authorization, cryptography, audit and monitoring, physical security, and other information security controls. These weaknesses could impair IRS's ability to perform vital functions and increase the risk of unauthorized disclosure, modification, or destruction of financial and sensitive taxpayer information. Accordingly, GAO has reported a material weakness in IRS's internal controls over its financial and tax processing systems. A primary reason for the new and old weaknesses is that IRS has not yet fully implemented its information security program. IRS has taken a number of steps to develop, document, and implement an information security program. However, the agency has not yet fully or consistently implemented critical elements of its program. Until IRS fully implements an agencywide information security program that includes risk assessments, enhanced policies and procedures, security plans, training, adequate tests and evaluations, and a continuity of operations process for all major systems, the financial and sensitive taxpayer information on its systems will remain vulnerable.