GAO: IRS security is weak

Taxpayers’ financial and personal information remains at risk because the Internal Revenue Service has not yet strengthened its information security measures, according to a new Government Accountability Office report.

The IRS fixed 41 of the 81 faults GAO discovered last year, the report states. Nevertheless, “GAO identified new information security control weaknesses that threaten the confidentiality, integrity and availability of IRS’ financial information systems and the information they process,” according to the report, which was released today.

The IRS has not established effective electronic access controls related to network management, user accounts, file permissions and logging and monitoring of security-related events, the report states. The agency has also failed to install other controls to secure computers physically.

“Collectively, these weaknesses increase the risk that sensitive financial and taxpayer data will be inadequately protected against disclosure, modification or loss, possibly without detection, and place IRS operations at risk of disruption,” the report states.

GAO recommends that the IRS align policies related to password age and configuration settings with federal guidelines, review system security plans, give specialized training to contractors, and update emergency action plans.

For emergency plans, the report suggests training non-IRS staff members to restore operations and updating disaster recovery plans. It also recommends installing UNIX-based hardware and equipment for processing applications and data at the IRS’ disaster recovery hot site, an alternative processing place to use in an emergency. Until the agency acts on these recommendations, “it is at risk of not being able to appropriately recover in a timely manner,” the report states.

IRS Commissioner Mark Everson expressed agreement with GAO’s assessment in a Feb. 27 letter to GAO’s director of information technology, Gregory Wilshusen.

“Because the IRS’ solution extends beyond the specific findings and addresses the root cause of the weaknesses at an enterprisewide level, a majority of the weaknesses remain open,” Everson wrote. “However, as a result of this agencywide approach and other initiatives we have under way, the IRS now has stronger controls to protect taxpayer data.”

He said IRS officials share the responsibility for IT security.


  • IT Modernization
    shutterstock image By enzozo; photo ID: 319763930

    OMB provides key guidance for TMF proposals amid surge in submissions

    Deputy Federal CIO Maria Roat details what makes for a winning Technology Modernization Fund proposal as agencies continue to submit major IT projects for potential funding.

  • gears and money (zaozaa19/

    Worries from a Democrat about the Biden administration and federal procurement

    Steve Kelman is concerned that the push for more spending with small disadvantaged businesses will detract from the goal of getting the best deal for agencies and taxpayers.

Stay Connected