SAMC is tasked with receiving and promptly reporting all physical security incidents and/or threats. SAMC’s mission is to document, archive and report incidents, threats, and emergencies by supporting the Internal Revenue Service’s law enforcement partners to ensure the safety of IRS personnel, facilities, and infrastructure. Additionally, SAMC disseminates, documents, and responds to inquiries from the Department of the Treasury, governmental agencies, and other federal law enforcement partners. This is important as SAMC must be kept apprised of situations that could require the immediate assistance and/or attention of the IRS Commissioner, the Chief, FMSS, and/or other IRS Leadership.

SAMC operates 24 hours 7 days a week and is the focal point for incident reporting. SAMC monitors and routes incident reports to the appropriate IRS personnel.

Treasury Directive (TD), TD P 85-01, Treasury Information Technology Security Program, February 28, 2022

Restructuring and Reform Act (RRA) 98, 26 United States Code (USC) 7608 (b) and Public Law 105-206 or The Internal Revenue Service Restructuring and Reform Act of 1998

Homeland Security Act of 2002 and 40 USC 1315

Chief, FMSS prescribes and oversees security incident reporting, policy, and guidance.

AD, Security oversees planning, developing, implementing, evaluating, and controlling security incident reporting.

Each FMSS Operations AD and TM will ensure each SSC adheres to the IRS Incident Reporting Program.

Section Chief, SAMC, is responsible for:

The SSC is responsible for:

SCR/AO is responsible for reporting facility closures affected by any major equipment failures, natural disasters, acts of nature, or severe weather.

All IRS Personnel are responsible for:

Program Goals: To ensure servicewide incident reporting for IRS Headquarters (HQ) and provide senior leader awareness and analysis.

Program Reports: Provide information regarding reporting of the program objectives. It is not intended to provide instruction for completing any reports. Identify the data sources, storage location, and the primary purpose for this data.

Program Effectiveness: The timely and accurate incident processing, incident reporting, and notification to appropriate stakeholders.

Internal Control - Random Sampling Process: Ensures that SAMC complies with the 15-minute timeframe for incident processing.

Annual Review: Review the processes included in this manual annually to ensure accuracy and promote consistent tax administration.

Internal Control - Random Sampling Process – ensures that the WS complies with the 15-minute timeframe for incident processing within the TRC application.

Direct Threat - A threat is made through verbal communication when an individual threatens to harm a government employee, others, themselves, or any public officials. Threat can be communicated telephonic, in writing, through the postal service, through other electronic means or by body language. A threat can also be made to a government employee away from government property when the person making the threat has identified the individual by the nature of their work. Threats must be reported to law enforcement, onsite Protective Security Officer (if available) and management.

Federal Protective Service (FPS) - An organization within the Department of Homeland Security (DHS) that protects federal facilities, their occupants, and visitors by providing law enforcement and protective security services/officers.

Follow Up Incident Report (FUIR) - Report generated and prepared by the impacted SSC and used by the TIRC to outline the actions taken by FMSS to mitigate the reported incident/threat.

Incident - An occurrence of an action or situation, such as an act of human intervention or an act of nature (e.g., storm or fire) that requires a physical security response.

Indirect Threat - Any verbal or nonverbal communication that raises a concern of potential violence. The comment is stated indirectly about a government employee, person, themselves, government officials or towards a government facility. The communications can be received in person, through body language, in writing, by telephone, by fax or other electronic means.

Information Technology (IT) Security - IT security service provider responsible for ensuring IRS compliance with federal statutory, legislative, and regulatory requirements governing confidentiality, integrity, and availability of IRS electronic systems, services, and data.

Infrastructure - The basic equipment and structures (e.g., phones, desks, electricity, buildings) that are needed for the IRS to function properly.

Insider Threat - An insider threat includes but is not limited to, Unauthorized Access (UNAX) violations; workplace violence and threats; domestic violence; concerning or inappropriate behavior; security breaches; background investigations; and information disclosures.

Level 1 Incident - Incidents (actual or alleged) involving a direct or imminent threat or implied threat of physical harm to employees, contractors, visitors; damage, and/or destruction of IRS facility, infrastructure, property, and/or equipment; and/or actual or potential compromise of IRS data. Incidents can be direct (e.g., face to face or via phone call); indirect (e.g., email, mail, or other social media;) or other (e.g., defacement of property, conveyed via another party or source).

Level 2 Incident - Incidents (actual or alleged) involving an indirect threat of physical harm to employees, contractors, visitors; damage and/or destruction of IRS facility, infrastructure, property, and/or equipment; and/or actual or potential compromise of IRS data. Incidents can be indirect (e.g., verbal via phone call, email, mail, or other social media;) or other (e.g., defacement of property, conveyed via another party or source).

Level 3 Incident - Incidents involving no direct or indirect physical harm to employees, contractors, visitors; damage, and/or destruction of IRS facility, infrastructure, property and/or equipment; and/or actual or potential compromise of IRS data. Example of incidents include, minimal security or management involvement, security exercises, and loss, theft, or unrecoverable ID media.

Personally Identifiable Information (PII) - Is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.

Personnel - Refers to IRS employees and contractors.

Privacy, Governmental Liaison and Disclosure (PGLD) - An IRS organization whose mission is to protect the sensitive information and privacy of taxpayers and employees.

Security Exercises - Security awareness drills such as Shelter-in-Place, Fire Drill, and Active Shooter.

SAMC - A 24/7 program within FMSS responsible for incident and threat reporting servicewide. The SAMC also serves as the central point for all incident communications and notifications.

Stakeholder - IRS business unit or individual responsible for security oversight and/or with a need to know.

Taxpayer Assistance Center (TAC) - An IRS location that provides taxpayers with tax assistance face-to-face.

Threat - A person or thing likely to cause damage or danger.

Treasury Inspector General for Tax Administration (TIGTA) - A Treasury organization committed to the prevention and detection of fraud, waste, and abuse within the IRS and related entities.

TIGTA Incident Notification Submittal (TINS) - Incidents submitted by TIGTA to SAMC.

Threat and Incident Response Center (TIRC) - Group that monitors and reviews incidents and threats to the IRS. Stakeholder organizations, including: FMSS, TIGTA, Criminal Investigation (CI), PGLD, IT Cyber Security, and FPS.

Threat Response Center (TRC) - Database software application used by the Watch Standers to manage all incident and threats reported to SAMC.

Watch Stander (WS) - SAMC personnel that receive and process incidents and distribute to appropriate stakeholders.

IRM 10.2.9, Occupant Emergency Planning

IRM 10.5.4, Privacy and Information Protection, Incident Management Program

IRM 10.8.1, Information Technology, Policy and Guidance

IRM 21.3.4, Taxpayer Contacts, Field Assistance

Insider threat Capability Concept of Operations