IRS has demanding responsibilities in collecting taxes, processing tax  returns, and enforcing the nation’s tax laws, and relies extensively on  computerized systems to support its financial and mission-related  operations. Objectives, Scope, and Methodology

The objectives of our review were to determine (1) the status of IRS’s  actions to correct or mitigate previously reported information security  weaknesses and (2) whether controls over key financial and tax  processing systems were effective in ensuring the confidentiality, integrity,  and availability of financial and sensitive taxpayer information. IRS Has Made Limited Progress in Correcting Previously Reported Weaknesses

IRS has made limited progress toward correcting previously reported  information security weaknesses. It has corrected or mitigated 29 of the 98  information security weaknesses that we reported as unresolved at the  time of our last review. For example, it has  implemented controls for user IDs for certain critical servers by assigning  each user a unique logon account and password and removing unneeded  accounts (guest-level);  improved physical protection for its procurement system by limiting  computer room access to only those individuals needing it to perform their  duties;    developed a security plan for a key financial system; and    updated servers that had been running unsupportable operating systems. IRS also has  established six enterprisewide objectives for improving information  security, including initiatives for protecting and encrypting data, securing  information technology assets, and building security into new  applications. For example, IRS continues to, among other things,    use passwords that are not complex,    grant excessive electronic access to individuals not warranting such    allow sensitive data to cross its internal network unencrypted,    allow changes to occur on the mainframe that are not properly monitored  ineffectively remove physical access authorizations into sensitive areas, install patches in an untimely manner, and improperly segregate incompatible duties. Significant Weaknesses Continue to Place Financial and Taxpayer Information at Risk

In addition to this limited progress, other significant weaknesses in  controls intended to restrict access to data and systems, as well as other  information security controls continue to threaten the confidentiality and  availability of its financial and tax processing systems and information,  and limit assurance of the integrity and reliability of its financial and  taxpayer information. IRS did not always enforce strong password management on systems at  the three sites reviewed. As a result, IRS is at increased risk of unauthorized access to, and  disclosure of, financial and taxpayer information, inadvertent or deliberate  disruption of services, and destruction or loss of computer resources. IRS did not always effectively implement configuration management  policies. IRS Has Not Fully Implemented Its Information Security Program

A key reason for the information security weaknesses in IRS’s financial  and tax processing systems is that it has not yet fully implemented its  agencywide information security program to ensure that controls are  effectively established and maintained. FISMA requires each agency to  develop, document, and implement an information security program that,  among other things, includes    periodic assessments of the risk and magnitude of harm that could result  from the unauthorized access, use, disclosure, disruption, modification, or  destruction of information and information systems;   policies and procedures that (1) are based on risk assessments, (2) cost- effectively reduce risks, (3) ensure that information security is addressed  throughout the life cycle of each system, and (4) ensure compliance with  applicable requirements;   plans for providing adequate information security for networks, facilities,    security awareness training to inform personnel of information security  risks and of their responsibilities in complying with agency policies and  procedures, as well as training personnel with significant security  responsibilities for information security;   periodic testing and evaluation of the effectiveness of information security  policies, procedures, and practices, performed with a frequency depending  on risk, but no less than annually, and that include testing of management,  operational, and technical controls for every system identified in the  agency’s required inventory of major information systems;   a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in its information security  policies, procedures, or practices; and   plans and procedures to ensure continuity of operations for information  systems that support the operations and assets of the agency. These deficiencies represent a material weakness in IRS’s  internal controls over its financial and tax processing systems.
Why GAO Did This Study

The Internal Revenue Service (IRS) relies extensively on computerized systems to carry out its demanding responsibilities to collect taxes (about $2.7 trillion in fiscal year 2007), process tax returns, and enforce the nation's tax laws. Effective information security controls are essential to ensuring that financial and taxpayer information is adequately protected from inadvertent or deliberate misuse, fraudulent use, improper disclosure, or destruction. As part of its audit of IRS's fiscal years 2007 and 2006 financial statements, GAO assessed (1) IRS's actions to correct previously reported information security weaknesses and (2) whether controls were effective in ensuring the confidentiality, integrity, and availability of financial and sensitive taxpayer information. To do this, GAO examined IRS information security policies and procedures, guidance, security plans, reports, and other documents; tested controls over key financial applications at three IRS data centers; and interviewed key security representatives and management officials.

What GAO Found

IRS made limited progress toward correcting previously reported information security weaknesses. It has corrected or mitigated 29 of the 98 information security weaknesses that GAO reported as unresolved at the time of its last review. For example, IRS implemented controls for user IDs for certain critical servers, improved physical protection for its procurement system, developed a security plan for a key financial system, and upgraded servers that had been using obsolete operating systems. In addition, IRS established enterprisewide objectives for improving information security, including initiatives for protecting and encrypting data, securing information technology assets, and building security into new applications. However, about 70 percent of the previously identified information security weaknesses remain unresolved. For example, IRS continues to, among other things, use passwords that are not complex, grant excessive access to individuals who do not need it, and install patches in an untimely manner. In addition to this limited progress, other significant weaknesses in various controls continue to threaten the confidentiality and availability of IRS's financial processing systems and information, and limit assurance of the integrity and reliability of its financial and taxpayer information. IRS has not consistently implemented effective controls to prevent, limit, or detect unauthorized access to computing resources from within its internal network. For example, IRS did not always (1) enforce strong password management for properly identifying and authenticating users, (2) authorize user access to only permit access needed to perform job functions, (3) encrypt sensitive data, (4) effectively monitor changes on its mainframe, and (5) physically protect its computer resources. In addition, IRS faces risks to its financial and taxpayer information due to weaknesses in implementing its configuration management policies, as well as appropriately segregating incompatible job duties. Accordingly, GAO has reported a material weakness in IRS's internal controls over its financial and tax processing systems. A key reason for the weaknesses is that the agency has not yet fully implemented its agencywide information security program to ensure that controls are effectively established and maintained. As a result, IRS is at increased risk of unauthorized disclosure, modification, or destruction of financial and taxpayer information.