Agencies executing data exchange agreements involving access to FTI subject to safeguarding requirements must have an approved SSR prior to having access to FTI. Publication 1075 Section 7.2.1 Initial SSR Submissions Instructions. The SSR must be submitted for IRS Safeguards approval at least 90 days prior to the agency receiving FTI.

The agency must address all elements in the SSR template at http://www.irs.gov/uac/Safeguards-Program additionally the initial SSR must contain the evidentiary requirements (artifacts) are focused on:

The Office of Safeguards will perform a comprehensive review of the agency’s entire SSR and each control description for compliance with standards to understand the agency’s overall security posture before approving the SSR and may request additional artifacts as needed.

General:

Safeguard activities shall include , a minimum, the following items:

Agency Disclosure Awareness Program -The agency should describe the efforts to inform all employees having access to FTI of the confidentiality requirements of the IRC, the agency’s security requirements, and the sanctions imposed for unauthorized inspection or disclosure of return information.

Reports of Internal Inspections -The agency should provide copies of a representative sampling of the Inspection Reports and a narrative of the corrective actions taken (or planned) to correct any deficiencies should be included with the annual SSR.

Disposal of FTI -The agency should report the disposal or return of FTI to the IRS or source. The information should be adequate to identify the material destroyed and the date and manner of destruction, including copies of destruction logs.

Other information -The agency should provide other information to support the protection of FTI, in accordance with IRC §6103(p)(4) requirements.

Planned Actions Affecting Safeguard Procedures --Any planned agency or contractor action which would create a major change to current agency procedures or safeguards will be reported. Such major changes would include, but are not limited to, new computer equipment, facilities or systems to perform programming, processing or administrative services requiring access to FTI.

Agency Use of Contractors - Agencies must account for the use of all contractors, permitted by law or regulation, to do programming processing or administrative services requiring access to FTI.

Preparation of an Annual SSR begins with a review of the previous SSR submission:

When agency requests extension to file their annual SSR, refer them Publication 1075 Section 7.2.2 SSR Update Submission Dates

Agencies are required to submit an annual SSR encompassing any changes that impact the protection of FTI:

The following information must be updated in the SSR to reflect updates or change regarding the agency or safeguarding procedures within the reporting period:

Location of the Data- Include an organization chart or narrative description of the receiving agency organization, which includes all functions where tax data must be processed or maintained. If the information is to be used or processed by more than one function, t hen the pertinent information must be included for each function.

Flow of the Data- The report must contain a flow chart or narrative description of:

System of Records- A description of the permanent record(s) used to document requests for, receipt of, dissemination of (if applicable), and final disposition (return to the IRS or destruction) of the FTI (including all electronic media). Agencies and their contractors are expected to be able to provide an "audit trail " for all information requested and received; the trail is to also include copies or distribution beyond the original document/media.

Secure Storage of the Data The agency will provide a description of the security measures employed to provide secure storage for the FTI when it is not in current use. Secure storage encompasses such diverse considerations as locked files or containers, secured facilities, key or combination control, off-site data storage facilities, and restricted areas.

Restricting Access to the Data- A description of the procedures or safeguards to ensure access of FTI is limited to those individuals who have authorized access and have a need to know. Describe any physical barriers to how the information will be protected from unauthorized access when in use by the authorized recipient. Describe any physical barriers to unauthorized disclosure (including all security features where FTI is assessed, used or processed) as well as systemic and/or procedural barriers.

Disposal- For all FTI provided by the IRS, and/or produced by the agency and/or contractor (e.g., print-outs, back-up tapes and the like), and not returned to the IRS, provide written agency report that documents the method of destruction by which records were destroyed (See paragraph (5), System of Records above)

Information Technology (IT) Security The written report must describe all automated information systems and networks that receive, process, store, or transmit FTI. We not that all such systems are required to have safeguard measures in place which address all key components of IT security to restrict access to sensitive data. See Publication 1075, Section 9.0. The written report should :

Disclosure Awareness Program- Each agency and contractor who receives returns and return information must have an awareness program wherein employees having access to FTI certify annually of the training received and receipt of the confidentiality provisions of the Internal Revenue Code, as well as, the civil and criminal sanctions for unauthorized inspections or disclosure of FTI. A description of the formal program should be included in the SSR.

Delinquent Safeguard Security Reports (SSR) with incomplete information should initially be resolved through informal telephone contact between the reviewer and the agency.

If a SSR is missing critical information to determine whether FTI is adequately, protected, reasonable attempts, including at least one written request, must be made to obtain the missing information.

Formal procedures to withhold FTI will be initiated if an agency fails to:

.

Reasonable attempts, including at least one written request, must be made to obtain missing information, or corrective action to be implemented .

If an SSR deficiency is minor and will not cause unauthorized disclosures, and the deficiency cannot be immediately corrected then the report will be accepted with the deficiencies noted with the comment in the SSR.

If a control has not been fully implemented, document the current state of the control and anticipated implementation date.

Completing Review Process

In order to promote uniformity in the format of SRR and to ensure that all reviews and reports address the key areas of the IRS’s safeguard requirements, all SRR will be prepared according to this standard format.

Title Page or Cover Sheet- Each report will have a cover sheet, which must be updated with the agency specific information:

Table of Contents (TOC) - After completing the full report the TOC must be updated to ensure the page numbers are correct. The F9 key will update the TOC for Sections A-H. A manual update must be don for the Introduction, Background and Scope sections.

Acronyms Listing- Update the Acronyms Listing with acronyms used throughout the report. Spell out acronyms the first time the acronym is used. Subsequently, use the acronym only.

INTRODUCTION - Verify that the Introduction used matches the code authority for which the agency is receiving information. The DES must choose the correct template to use. If not template exist for the agency, such as for federal agencies, briefly outline the statutory provisions, in general, which permit the disclosure of returns or return information, and the intended purpose or benefit(s) of the disclosures. Any limitations or restrictions imposed by the IRC or regulation can be included in the introduction portion of the report, especially if it is germane to a finding or recommendation elsewhere in the report.

BACKGROUND - Verify the Background used matches the code authority for which the agency is receiving information. If using the e-Trak generated template, you must chose the correct template. This section, which is agency and contractor specific, should contain the name of the agency reviewed, and if applicable, the specific organization(s) or function(s) within that agency. If several, separate, programs are being reviewed, the background section should give a brief description of each program.

SCOPE - This section contains descriptive reviewer information regarding the conduct of the review. This section of the report should give the reader a sense of how the review was conducted and what programs and procedures were included or excluded from the review. In addition, the scope and objectives section should also indicate:

FINDINGS AND RECOMMENDATIONS - All safeguard review reports will address each requirement enumerated in IRC §6103(p)(4), and other requirements determined to be necessary to ensure the confidentiality of FTI and return information. To ensure that all the requirements of the IRC, Publication 1075, and the IRM have been addressed, each subsection of this section will contain a statement of the requirement, followed by a description and discussion of the findings and recommendations for each item under this subsection.

Begin creating the SRR

The DES will input all Section H Parent Findings and component findings from the document loaded to e-Trak by the CSR. Parent findings and component findings will be created for every Section H finding even if only 1 component exists.

Prepare SRR Letter - If the template is not available on e-Trak you must obtain the latest version from SharePoint.

Upload the completed SRR and letter by clicking Documents-<new Documents and Inputting the appropriate information:

Upload other pertinent documents and create case notes as appropriate. The CSR should upload the documents associated with the Section H. If they are not loaded, you must check with the CSR. In addition to uploading the letter and the report, the following documents are reviewed in QR and need to be complete and uploaded prior to moving the case to QR status:

Verify that the findings from the previous review are closed out. This includes all Section H component findings. Make a case note in the previous review case as well as the current case stating the reason for closing the findings (due to a new review).

Prior to moving to QR make sure all notes on the case are updated.

DES (Case Responsible) moves case to Quality Review step

Time Frames to complete the SRR:

TI’s are considered timely if the case in eTrak is released within 30 calendar days. All TI’s in inventory should be worked timely and consider the time sensitive nature of the agency’s inquiry.

TI’s must be forwarded to Quality Review within 20 calendar days after case creation. See IRM 11.3.36.14.3 Quality Review of Technical Inquires for more information regarding the TI Quality Review Process.

If additional information is needed from the inquirer in order to process the TI, the case responsible party will attempt contact by phone or email to obtain the needed information as soon as possible after case assignment. If a timely response is not received the case responsible party will close the TI with an e-mail advising the agency of closure and advise of:

Generally DES will be assigned the following types of Technical Inquires:

Generally Computer Security Reviewers will be assigned the following types of Technical Inquires

Physical Security Inquires from agencies under an open review will generally be handled by the DES assigned to conduct the review. The DES is the agency’s primary POC for all SSR, CAP, and inquires from their agency POC. An Open Review is easily identified on e-Trak by the calendar year the review is scheduled to occur and can also be identified by referencing the Review Schedule.

If the case responsible party determines the TI is an issue that is not covered in Publication 1075 or generally a Safeguards issue do not delay, discuss with Chief, SRT for reassignment and resolution.

If the scope of the inquiry is beyond your expertise, is not from an agency subject to safeguards oversight or does not pertain to the safeguard program, do not delay, discuss with Chief, SRT for reassignment and resolution.

Assigned individual will acknowledge receipt of TI by updating notes in e-Trak case summarizing inquiry.

Research and contact other Safeguards personnel as needed.

Contact the requester, resolve the question(s) at hand and close the TI over the phone whenever possible. Confirm it a written response is needed.

Add appropriate e-Trak notes describing:

Resolve the inquiry during the initial phone discussion.

Complete required research and preparation of written response.

Facilitate discussion with the inquirer in coordination with computer security reviewer/DES if necessary (coordinate with Chief or Chief-designated party to determine appropriate CSR assignment)

Prepare written response, on the original incoming inquiry loaded to e-Trak, and load to Outgoing Documents in e-Trak and load to Outgoing Documents in e-Trak.

Always use the original incoming TI message.

If there were intervening e-mail threads, they may be included in the response loaded to e-Trak Document file for QR to provide amplifying information.

A separate attachment providing the response is not appropriate.

Include all attachments to be sent to the agency as part of the response.

As written, response should be appropriate for forwarding to the agency personnel in response to the original incoming message. Example format is shown below:

Cite Publication 1075 references as appropriate. Answer should provide guidance that is complete but does not just restate Publication 1075 text. Ensure that the agency will fully meet Publication 1075 standards on the issue if they follow the guidance provided.

Do not provide telephone number or e-mail contact information

All Technical Inquires do not require email/written response (see above Ways to Resolve the TI). Utilize the most appropriate method pending the type an extent of issues/inquires raised.

When an e-mail response is required the DES will create an email to the agency requestor, copy to all individuals on original incoming message, using the email dropped into Documents in e-Trak. DES will upload a copy of the e-mail response in Documents.

Technical Inquires are closed on e-Trak by support staff who will:

To meet the timeliness metric for Technical Inquires the case must be Released in e-Trak within the 30 day prescribed timeframe

All correspondence should be sent electronically by Secure Data Transfer or encrypted using SecureZip, to the Safeguardsreports@irs.gov mailbox and include a cover letter signed by the head of the agency or authorized delegate.

Use of a template will enhance the agency’s ability to provide all of the information to process the notification. Template suggested for the agency to use is embedded below. The use of this template will minimize processing errors as well as eliminate the a contractor check sheet as the comments will confirm notification compliance.

Retrieve the 45-Day Notification Letter from the mailbox

Assign an e-Trak case to DES and/or for Computer Security Reviewer (CSR) assignment rules are subject to occasional change and the most current version is located on Data Services SharePoint site)

Upload notification from agency into the created e-Trak case.

Acknowledge receipt of 45 Day Notification via email response

Upload acknowledgement email into created e-Trak case.

Update the e-Trak Case Notes

Notify case assignment to SRT Chief, Mailbox Staff, IRS contractor, CSR and DES via email and update e-Trak.

45 Day Notification Letters for contractor and/or sub-contractor access to FTI are assigned to DES (see Data Services SharePoint site for the most current version of the assignment rules)

Generally 45 Day Notification Letters for Live Data Testing, Non-Agency-Owned-Information-Systems, Data Warehouse, Cloud Computing, VoIP, IVR, Web Portals, and Virtual Environment which requires Information Technology (IT) review are assigned:

DES Process

Computer Security Reviewers Process

45 Day Notices are timely if processed to completion (Release status in eTrak) within 30 days of case creation in eTrak. Des will notify their Chief if there is a delay in processing beyond 30 days and update eTrak notes.

Processing Tax Modeling and IT notification letters often required additional time, DES will work with Statistics of Income (SOI), CSR, IRS contractor, and Senior Technical Advisor as applicable to complete this process in a timely manner. Notify Chief of expected extended time frame if expected to exceed the 30 day due date.

After receipt of assignment notice, retrieve notification form the eTrak document folder and save to your hard drive.

Acknowledge receipt in eTrak by entering eTrak Note.

Review the information provided to ensure it is within the standards in Publication 1075 and all Exhibit 6 information was provided.

In additional information is needed from the agency to process the notification, call and/or email the agency POC listed in the notification as soon as possible after case assignment. The agency should respond directly to you and/or mat respond to SafeguardsReports@irs.gov and cc you. Provide the agency with a specific due dare for the response that is reasonable and within the 30 days allowed for processing 45 Day Notices.

Document any delays in eTrak along with the cause for such delays and notify Chief if delays are expected to exceed the 30 day metric for resolution.

If the agency fails to appropriately respond by the due date issued prepare the non-processible letter.

Document all information received from the agency in the eTrak case created for the Notice and load documents and emails as appropriate.

Prepare Safeguards response letter for approved/confirmed Notices. Always address the letter to the Head of Agency, Director, Deputy Director, etc, if the letter has been signed by them. Do not send the letter addressed to the POC unless this is the only name identified on the letter.

DES must coordinate with the SOI. Specific current email contacts for coordination with SOI can be found in the desk guide for processing 45 Day Notices. Provide the following in this coordination:

If the letter includes contractor notification for Live Data Testing, Non-Agency-Owned-Information-Systems, Data Warehouse, Cloud Computing the process is the same as that for any 45 Day Notification letter IRM 11.3.36.13.3 .

Complete the combination 45 day letter and/or Live Data Testing, Non-Agency-Owned-Information-Systems, Data Warehouse, Cloud Computing when the notification includes contractor notice using the template found in Safeguards SharePoint site upload to eTrak under documents, enter eTrak case note and notify CSR assigned case.

If the Live Data Testing, Non-Agency Owned-Information-Systems, Data Warehouse, Cloud Computing notification does not include contractor notification complete the response letter using the template located at Safeguards SharePoint site, upload e-Trak under documents, enter e-Trak case notes and notify CSR.

The letters/agency responses are signed by the Associate Director (AD). Once CSR has determined that the letter is ready for approval they are to notify the DES assigned as analyst in e-Trak. The DES will then conduct a quality review of the response and the case and submit to AD for signature if the response is appropriate and the case is complete.

Contractor Notice must be made by the Agency, not by their contractor. If Safeguards is in receipt of 45 Day Notice from a contractor, request the Agency resubmit as the requesting official. All 45 day letters must be on agency letterhead and signed by the Head of the Agency. Close the 45 Day Notification e-Trak case using the non-processible template. A new eTrak case will be opened upon receipt of appropriate Notice.

Enter a new note in eTrak reflecting:

Documents to be uploaded into eTrak case

Letter to agency should be uploaded under outgoing correspondence in eTrak and input should include these instructions:

Instructions for submission for approval within eTrak include:

The following documents should be loaded in the Documents file in e-Trak when the Quality Reviewer receives the case file. Each of these documents should be reviewed by the Quality Reviewer.

Written responses should be appropriate for forwarding to the agency personnel in response to additional information needed. If any documentation is missing, the Quality Reviewer should contact the DES/CSR to load the documentation.

Verify that the SSR has provided guidance that is complete. There should be a response for every field within the SSR.

The Quality Reviewer should review the SSR for grammar, punctuation, spelling and formatting throughout the report. Minor corrections (grammar, punctuation, formatting, etc.) can be made by the Quality Reviewer without returning/notifying the DES/CSR. The following items should be reviewed in the SSR.

Quality Review of SSR Transmittal Letter-The Quality Reviewer should review the transmittal letter that is sent to the agency. The Quality Reviewer should make minor corrections to the letter. If there are major changes to the letter the Quality Reviewer should wait until the report is reviewed to load and return the case to the DES/CSR for re-work.

Review the transmittal letter for the following:

When corrections are made that must be addressed by DES/CSR, the SSR will need to be returned using the following procedures:

Completion of SSR Quality Review - Upon completion of quality review (SSR ready for approval/signature) the following procedures should be taken:

SRRs must be forwarded to QR within 35 days review. The following documents should be loaded in the Documents file in e-Trak when the Quality Reviewer receives the case file. Each of these documents should be reviewed by the Quality Reviewer. If any file is missing, the Quality Reviewer should contact the DES to load the file.

Prior to the Safeguard Review, the DES should have received the State Agency Contact Information sheet and the Safeguards Disclosure Security Evaluation Matrix (SDSEM) from the agency. At the end of the review, the DES should complete the SDSEM, listing all failures. Comments should be associated with every failure.

Previous Review Open Findings - The Quality Reviewer must ensure previous open review findings are closed on e-Trak. Previous review findings and all components should be closed by the DES or someone otherwise directed by the Chief upon conducting the on-site review. The DES should have input a note on the current review case and the previous review case indicating that the findings have been closed.

Open CAP Case -If there is an open CAP case associated with the previous review, the DES should forwarded this along with the SSR to OR r. If an open CAP was not received with the report, the Quality Reviewer should conduct a search to determine if one is open.

Verify the DAF that is loaded matches the agency if not notify DES to obtain and reload.

Verify that the SDSEM has been completed with failures notated. There should be a comment for every failure. In most cases the failures should match the findings in the PFR and the SRR. If the SDSEM is not complete, notify the DES to correct and reload. A missing or incomplete SDSEM should not hold up the timeliness of an SRR.

The SRR and transmittal letter should be moved to the Quality Reviewers's desktop to work. The SRR and letter should be saved by the DES in a doc format.

The Quality Reviewer should correct the report and letter using the auto correct tool. The Quality Reviewer should review the report for grammar, punctuation, spelling and formatting throughout the report. Minor corrections (grammar, punctuation, formatting, etc.) to Introduction, Background and Scope, and spacing issues between findings can be made by the Quality Reviewer without returning/notifying the report and/or letter to the DES. The following items should be reviewed in the SRR:

FINDING/NARRATIVE AND RECOMMENDATION -The Quality Reviewer should review the following:

QUALITY REVIEW- SRR TRANSMITTAL LETTER-The Quality Reviewer should review the transmittal letter that is sent to the agency. The Quality Reviewer should make minor corrections to the letter. If there are major changes to the letter the Quality Reviewer should wait until the report is reviewed to load and return the case to the DES for re-work. Review the transmittal letter for the following:

RETURNING REPORT TO DES FOR CORRECTIONS- When corrections are made that must be addressed by the DES, the report and/or letter will need to be discuss and/or returned to the DES for revision.

COMPLETION OF QUALITY REVIEW- Upon completion of quality review (report ready for approval/signature) the following procedures should be taken:

TIs must be forwarded to QR within 20 days for review The following documents should be loaded in the Documents file in e-Trak when the Quality Reviewer receives the case file. Each of these documents should be reviewed by the Quality Reviewer:

As written, response should be appropriate for forwarding to the agency.

If any documentation is missing, the Quality Reviewer should contact the DES to load the documentation.

Verify that the TI has provided guidance that is complete. There should be a response for every question within the TI. If the TI is not complete, notify the DES to correct and reload.

The Quality Reviewer should correct the TI using the autocorrect tool. The Quality Reviewer should review the TI for grammar, punctuation, spelling and formatting throughout the report. Minor corrections (grammar, punctuation, formatting, etc.) can be made by the Quality Reviewer without returning/notifying the DES. The following items should be reviewed in the TI:

If the discussion was held by phone, and the TI response is inaccurate it will be returned to DES and Chief, SRT to clarify our position with the agency POC, preferably with a follow up phone call. Subsequent action must be documented in the e-Trak case notes and forwarded to Technical Advisor for approval and closure.

When corrections are made that must be addressed by the DES, the TI will need to be returned using the following procedures:

Completion of Quality Review – Upon completion of quality review (TI ready for approval/signature) the following procedures should be taken:

Technical Advisor will review response for clarity, accuracy, and consistency with current policy. The Advisor will either:

A-CAP cases must be forwarded to QR within 30 days for review. The following documents should be loaded in the Documents file in e-Trak when the Quality Reviewer receives the case file. Quality Reviewer should contact DES for missing letters:

The Quality Reviewer should correct the transmittal letters using the autocorrect tool. The Quality Reviewer should review the letters, and the Agency Response and IRS Comments in the SRR case for grammar, punctuation, spelling, formatting and spacing issues. Minor corrections (grammar, punctuation, formatting, spacing, etc.) can be made by the Quality Reviewer without returning the case for re-work and/or notifying the DES.

Quality Review Sections A-G

Quality Review Section H

Quality Review of CAP Responses. DES/CSR should have addressed all open findings. Deficiencies within the SRR findings must be clearly noted in the Notes on the CAP case to allow the DES/CSR to correct.

Quality Review of IRS Point of Contact and Head of Agency Letters

Returning CAP to DES for Corrections - When corrections are made that must be addressed by the DES/CSR, the CAP case and/or letters will need to be returned to the DES for revision using the following procedures:

Completion of Quality Review: Upon completion of quality review CAP and letters ready for approval/signature should be taken.

Interviews-During the on-site review, agency employees, contractors and subcontractors will be interviewed. Interviews are valuable in that they provide information based on personal experience. This information can help determine the extent of disclosure, safeguards and security awareness as well as awareness of penalty provisions of IRC §7213, IRC §7213A and IRC § 7431. Additionally, interviews can provide answers to questions regarding operations and procedures. Interviews do not have to be restricted to employees; they may also be conducted with third parties (e.g., custodians, security guards, other tenants) to gather information on the measures used to restrict access to areas housing tax data.

Observation - Observing actual agency on-site operations is a required step in the review process. The DES must tour the areas or departments which handle or store FTI, including the data processing center, regardless of whether it is agency-operated, a shared facility or a contractor facility that receives processes, transmits or stores FTI. The DES should note actual written policy and procedures, actual operational execution of these policies and procedures, as well as work flow. The inspection should also provide information about the following security measures:

Background Check- DES will during an on-site Safeguard Reviews inspect and evaluate agency policy and procedure related to background investigations of employees and contractors with access to and use of FTI as well as a sample of completed employee and contractor background investigations. DES will document on a SRR and CAP a finding and require corrective action by agency of any failure to comply with IRS published standards for agency background investigation requirements. DES will not on a SDSEM any compliance failures associated with specific test cases established with regard to IRS published standards for agency background investigation requirements. SDSEM Test cases to evaluated for compliance include:

Review Guide -Exhibit 11.3.36-1 which contains a security outline that can be used as a tool in evaluating reports and planning Safeguard Reviews. This exhibit is not all inclusive and is used only as a guide to be modified or expanded to meet the requirements of a specific review. Not all questions and review topics may arise as a result of information gathered during the evaluation.

Case file reviews - These consist of spot checks of agency files and the examination of records that contain FTI.

Communication between team members, as the review is progressing, is vital and beneficial, as it can identify problems and provides information that may alter or expedite the review plan. The DES should communicate shared findings with other DES reviewing other agencies. c Ensure shared findings match on all agencies PFRs.

Set aside time the closing conference to discuss the findings with POC. This allows the agency the opportunity to hear the findings and start of remediation.

The PFR and recommendations should be discussed at the closing conference. This allows the agency the opportunity to better understand what the reviewer/team has found and provide additional information, should the agency see the need to do so.

Critical findings must be reported to the Chief immediately, who will then communicate to the Associate Director.

Check with CSR and DES must maintain regular communication during review.

Set a deadline with the agency POC’s for needed policies and procedures generally not later than 2:00 p.m. the day before the closing..

An on-site Need an Use Review of each agency receiving FTI will conducted as part of the Safeguard Review.

A Need and Use Review is considered verification or confirmation of the Need and Use Justification made prior to the release of the requested tax information to the state agency

Compare FTI the agency is using versus FTI received. Determine if the agency should continue to receive all the FTI. If not advise the GL and the Disclosure Manager as appropriate. Document the PFR with appropriate findings

Ensure the agency is compliant with IRS statutes, Federal regulations, existing agency agreements (basic and implementing) service policies and MOU’s.

The scope of the review should be broad enough to provide the reviewer with sufficient information to document a conclusion as to the agency’s need for and use of FTI.

Other key areas to be reviewed would include (but are not limited to):

Verify the Need and Use Justification Statement for Use of Federal Tax Information for Tax Modeling, Revenue Estimation or other Statistical Purposes.

The PFR identifies the items requiring correction to as a result of an IRS Office of Safeguards on-site review. For each finding, the evaluated risk for potential loss, breach or misuse of FTI establishes the recommended timeframe for resolution. The risk category is noted next to each finding in this report to assist the agency in establishing priorities for corrective action. See also IRM 11.3.36.9.

The DES must complete the PFR during the on-site review. The title page, footer and Section E should be complete prior to the review. The document must be completed including the computer security review findings in Section H and printed before the closing conference. The standardized findings with associated risk category are available on the PFR Standardized Findings Document.

SRT Required actions to initiate IRC 6103(p)(7) recommendation:

In general, the closing conference time will be discussed during the first evening meeting with the Chief and finalized as soon as possible thereafter. Closings should be scheduled according to scope, resources, agency availability and Safeguards availability with the final time and date signed off by the Chief. E-mail the agency POC the time of the closing conference . Review the risk categories – emphasizing the critical and significant risks. The DES will review findings in sections A-G and the CSR will review section H. Remind agency personnel that changes in procedures made to comply with recommendations should be documented in the CAP. Remind agency when the next SSR and CAP is due. Always ask the agencies if they have any questions before the close of conference

SDSEM, Policy and Procedures Checklist, Agenda with physical locations and contact numbers, Review Contact Questionnaire.

See IRM 11.3.36.15.1.

See IRM 11.3.36.15.3

See IRM 11.3.36.15.4

The Associate Director, Federal Liaison and Chief SRT will be invited to the closing conference. Generally, since the closings are generally in Washington, DC, the Associate Director will attend the closing conference. The DES is required to send a calendar invite detailing the time, date, location and logistics to the Associate Director, Federal Liaison and Review Team.

FSR documents, SDSEM, Policy and Procedures Checklist, Agenda with physical locations and contact phone numbers, Review Contact Questionnaire and Summary of agency after closing conference included:

The Technical Inquiry & Notification weekly inventory report is based on an e-Trak query that focuses on the case types of Technical Inquiries and Notifications. All states EXCEPT release are included in the query. TIs and Notifications have a due date of 30 days from receipt of inquiry .

The Safeguards Review Report (SRR) weekly reporting is based on an e-Trak query that focuses on “DES assignment” and “due date”. All states Except “Release” are included in the query. SRR’s have a 45 day completion date with a start time based on the closing conference date of the review.

Each Safeguards Review Team analyst will be responsible for producing a weekly SRR inventory report. The SRR will be shared with each SRT Chief on a weekly basis (or as required by SRT Chief) to maintain workload accountability and inventory control. The query will be produced in Excel format unless otherwise determined by SRT Chief.

The Safeguards Security Review Report (SSR) weekly reporting is based on an e-Trak query that focuses on “ IRS contractor assignment” and “due date”. All processing status Except “Release” are included in the query. SSR’s have a 60 day completion date with a start time based on the date the SSR was received in the Safeguards mailbox.

Each Safeguards Review Team analyst will be responsible for producing a weekly SSR inventory report. The SSR will be shared with senior management and each SRT Chief on a weekly basis (or as required by SRT Chief) to identify any areas of concern and to ensure timely processing of reports in compliance with contractual guidance, maintain workload accountability and inventory control. IRS Contractor will be assigned as “Case Responsible” for all SSR cases. IRS Contractor will be responsible for reporting the status of active SSR’s during weekly inventory call (see note below). The query will be produced in Excel format unless otherwise determined by senior management and/or SRT Chief.

The Safeguards Corrective Action Plan (CAP) weekly reporting is based on an e-Trak query that focuses on agencies where open findings exist on the POAM. This indicates that the findings need to be addressed in a CAP. The report focuses on DES assignment, contractor assignment and due date. All processing status Except “Release” are included in the query. CAP’s have a 45 day completion date with a start time based on the date the CAP was received in the Safeguards mailbox.

Each Safeguards Review Team analyst will be responsible for producing a weekly CAP inventory report. This report will be shared with senior management and each SRT Chief on a weekly basis (or as required by SRT Chief) to identify any areas of concern and to ensure timely processing of reports in compliance with contractual guidance, maintain workload accountability and inventory control. SRT Analysts will be assigned on an alternating basis as “Case Responsible”, with subordinate assignments to DES staff (for sections A-G), and to the IRS contractor (for section H) for all CAP cases . IRS Computer Security Reviewers, commonly referred to as 2210, will be responsible for assisting with working Section H of the CAPs on an as needed basis as determined by the SRT Chief. The IRS Contractor will be responsible for reporting the status of active CAP’s during weekly inventory call (see note below). The query will be produced in Excel format unless otherwise determined by senior management and/or SRT Chief.

Follow required actions below when Safeguard Security Reports (SSRs) have not been filed for two consecutive reporting years as follows:

Follow required actions below when CAP have not been filed for two consecutive reporting periods as follows:

Initiate enforcement recommendation below if agency continues to make unauthorized FTI accesses/disclosures after the following has occurred:

Initiate enforcement recommendation below if agency does not mitigate or provide a plan to mitigate critical and significant review findings after the following has occurred:

Initiate enforcement recommendation below if agency will not allow Safeguards to conduct on-site reviews without non-IRS additional background investigations/confidentiality statements will be required to conduct on-site reviews; or will not allow the use of automated tools to evaluate security configurations of IT devices after the following has occurred:

SRT required actions to initiate IRC 6103(p)(7)recommendation:

In all cases where serious deficiencies are found or where required reports are not submitted, the responsible reviewer will attempt to obtain voluntary compliance through discussion and negotiation. (Delegation Order)

When an impasse occurs, involving recipients subject to IRC §6103(p)(4) , the matter should be elevated to the appropriate GLDS management level.

The reviewer should initiate enforcement recommendation if the agency will not allow Safeguards to conduct on-site reviews without non-IRS additional background investigations/confidentiality statements or will not allow the use of automated tools to evaluate security configurations of IT devices after the following has occurred:

Required actions to initiate IRC 6103(p)(7)recommendation include:

If the appropriate management is unable to break the impasse, the recipient agency will be notified in writing of the IRS’s preliminary determination and intention to recommend discontinuance of disclosures.

Such notices will allow 30 calendar days for response. Notices will indicate:

At this time, a written report should be prepared and submitted by the Director, Office of Safeguards to the Director, Governmental Liaison and Disclosure.

If it is determined that Federal tax administration would be impaired because of a safeguards deficiency, a duly delegated IRS official (see Delegation Order 11-2) may immediately suspend disclosures to the agency pursuant to IRC §6103(p)(4)and Treasury Regulation 301.6103(p)(7)-1. This would be the case where unauthorized accesses/disclosures would be made absent the suspension. See IRM 11.3.36.21.

If the 30 day time frame expires without the agency taking satisfactory action, a letter will be drafted to the head of the agency from the Delegation Order 11-2 official notifying the agency that disclosures are being discontinued until such time as the deficiency is corrected. Copies of the letter should be sent to the Director, Office of Safeguards and to the Director, Office of Governmental Liaison, Disclosure and Safeguards. Documentation detailing the uncorrected deficiencies and the agency's reasons, if any, for noncompliance will be organized and maintained.

The Director, Office of Governmental Liaison, Disclosure and Safeguards (GLDS) actions will be similar to those stated in section 5 above. If the Director is unable to break the impasse, the agency head will be notified in writing of the IRS’s preliminary determination and the Director's intention to recommend discontinuance of disclosure. The notice will allow 30 calendar days for response.

If the 30 day time frame expires without the agency taking satisfactory action, two copies of the proposed letter to discontinue disclosures will be drafted to the head of the agency, from the Director's, Office of Governmental Liaison, Disclosure and Safeguards ,notifying the agency that disclosures are being discontinued until such time as the deficiency is corrected. Following the Director's signature, one signed copy will be retained in Headquarters Office, and the other will be forwarded to the Director, Office of Safeguards and to the Director, Governmental Liaison, Disclosure and Safeguards.

The discontinuance of disclosures may take several forms. The appropriate form is dependent upon all of the facts in the case.

All disclosures to an agency may be suspended or permanently cutoff in situations where the deficiency pervades the entire agency or where the agency refuses to submit the required reports.

Suspensions or cutoffs of selected information may be used in cases where the deficiency can be isolated in a certain segment of the agency.