Purpose: This IRM section provides policies and guidance to carry out respective responsibilities regarding security of the Integrated Data Retrieval System (IDRS) and other applications, which contain taxpayer return and return information.

Audience: This IRM is directed toward Small Business/Self Employed (SB/SE), Campus Examination, Field Examination, Headquarters Examination and Examination Specialty Programs, Managers and IDRS Unit Security Representatives. The audience includes the following operations:

Policy Owner: The Director, SB/SE Examination is responsible for issuing policy.

Program Owner: The program owner is Examination Case Selection.

Primary Stakeholders: Area-wide SB/SE Examination IDRS Security Representatives in North Atlantic, Central, South Atlantic, Midwest, Gulf States, Western, Southwest, Specialty and Campus Examination/Automated Underreporter Program (AUR).

Program Goals: The primary goal of this IRM is to provide procedural guidance, which will ensure consistency across the organization. This includes the timely review and certification of security reports, addressing user support inquiries not detailed in another IRM.

Contact Information: To recommend changes or make any other suggestions related to this IRM section, see IRM 1.11.6.6, Providing Feedback About an IRM Section - Outside of Clearance.

IDRS Security Role Designations and Responsibilities are delegated to individuals responsible for overseeing IDRS Security.

This IRM section focuses on four security role designations and responsibilities pertinent to IDRS security. They are:

For more information on security roles and responsibilities for specific security personnel, operations and functions, see IRM 10.8.34.3, Roles and Responsibilities.

The USR is the first point of contact for IDRS users at the unit level and must:

Exhibit 4.2.9-5 identifies common types of user support issues. For a list of IDRS security frequently asked questions and answers, refer to the IDRS Security Program link: http://idrssecurity.web.irs.gov/IDRS/IDRSSecurityFAQ.asp

IDRS units are established based on the Internal Revenue Service (IRS) business organization structure. Each business organization i.e., Small Business/Self-Employed, Wage and Investment, Large Business and International, and Tax-Exempt and Government Entities, has an assigned Organization Code Range. For SB/SE Examination, the Organization Code Range, Organization, Function and Unit Number Range are shown in IRM Exhibit 10.8.34-13: IDRS Organization Codes Overview - SB/SE Headquarters & Area Offices.

To establish an IDRS unit, the USR must make sure that the unit number is consistent with the function area as defined in the Treasury Integrated Management (TIMIS) and within the IDRS unit range and organization code as defined by IRM 10.8.34, IDRS Security Controls.

An IDRS Unit Number is a five-digit number that is categorized as follows:

The chart below list SB/SE Field Examination campuses and Area Offices.

In SB/SE Examination, all units in the same territory should be kept within the same block of numbers and to the extent possible, should be sequenced by group, i.e., the fifth digit of the unit number should be the same as the group number as shown in the organization code structure.

IDRS units must not contain employees from different business organizations or Area Offices.

An IDRS unit may consist of one or more IDRS users who are in the same territory, group, or section. Example: When an employee group only has a few IDRS users, users from the same territories may be included in the same IDRS unit. This is known as a “mixed” IDRS unit (employees report to different managers but are in the same territory.) A mixed IDRS unit is established to control single users in one IDRS unit.

No unit shall have a manager or USR in the same IDRS unit as the employees they oversee.

The USR must coordinate with the manager to create or assign an IDRS unit that falls under the managers’ jurisdictions.

Request to establish an IDRS unit is made on Form 9937, IDRS Unit Request, via IORS.

When an employee transfers between an IDRS unit within the same Area, an OL5081 is not required.

The USR is responsible for transferring the employee’s account on IDRS. The USR shall coordinate with the gaining manager to confirm the appropriate command codes to be added to the transferring employee’s profile.

When an employee transfers within the same business organization to a different campus, an OL5081 is required to delete the employee from their current campus. If the employee still needs access to IDRS in their new campus, the employee should contact their assigned USR for further instructions.

The gaining USR shall assist the manager and employee with the transfer.

The user will also need to request to have their terminal pointed to the new campus.

When an employee transfers within the same business organization, on the same campus with a different Office Identifier (OI), an OL5081 is not required.

The gaining USR is responsible for transferring the employee’s IDRS account to the new unit.

When an employee transfers to another business organization within the same campus with a different Office Identifier, an OL5081 is not required.

The gaining and losing USR must coordinate to transfer the employee’s account to the appropriate IDRS unit.

When an employee transfers to another business organization on a different campus, an OL5081 is required to delete the employee from their current campus. If the employee still need access to IDRS in their new BOD, the employee should contact their assigned USR for further instructions.

The gaining USR may assist the employee with the transfer.

Technical Services provide technical and procedural support to Field Examination.

Technical Services was realigned under four Examination Field Areas:

The USR for the aforementioned areas shall provide full IDRS security support to Technical Services employees and managers.

IDRS units established for Technical Service employees shall fall within the Organization unit range of 680 – 699. See IRM Exhibit 10.8.34-13, IDRS Organization Codes Overview - SB/SE Headquarters & Area Offices

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

The USR must coordinate with the unit manager to delete command codes from employees’ profiles that are unauthorized and/or not being used or needed for their work assignment or position title.

The USR must query their units to identify units that contain security command codes to ensure security command codes are only in units approved by management to function as USRs, Alternate USRs or TSAs.

The USR must review the status of Alternate USRs and TSAs on a yearly basis to determine if they are still performing back-up USR support. If no longer providing support, ensure the security command codes are removed from the user’s profile.

The USR must review the MPAF to determine if the command codes in the UCCP and Limited Profile are appropriate for the work performed by the users in the unit.

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

IORS is a web-based application that makes IDRS security reports available online to IDRS security staffs and authorized business reviewers.

IORS users are authorized to view security reports based on their reviewer permissions role. There are two IORS Report Reviewer roles:

Only the Primary Report Reviewer can certify IORS reports.

The USR is designated as the Primary Report Reviewer for SB/SE Examination IDRS units, and is responsible for reviewing all transactions on the weekly and monthly security reports, and certification of required reports.

The Primary Report Reviewer shall not be the reviewer of their own transactions and shall not appear as the IORS Primary Reviewer on the IUUD for the unit that they are in.

Managers of IDRS users may be designated as Secondary Report Reviewers and can view, add comments, and print IORS reports for their assigned unit.

To review IORS reports, command code REPTS is required in the report reviewer’s IDRS profile.

Managers who only need IDRS to review IORS reports are put in IORS specific units, i.e. XX900- XX910.

There are four weekly security reports available to authorized report reviewers. They are:

There are three monthly reports available to authorized report reviewers. They are:

Certification of security reports is mandatory. After the review and documentation of reports, the USR must complete the Report Level Items as shown in Exhibit 4.2.9-4.

Level action, comments and certification will apply to all units.

The IUUD Database is a resource where employees can obtain current information about IDRS units and IDRS security personnel.

The IUUD is designed to assist employees, managers and security personnel to locate IDRS users and their managers associated with their five-digit IDRS unit number.

The IUUD also identifies the Primary USRs, Alternate USRs, Primary IORS Report Reviewers, TSAs, and managers for all IDRS units within a business organization.

The USR is responsible for ensuring the accuracy of the information on the IUUD. To accomplish this, the USR shall:

Form 13230 was developed for IRS Managers to designate individuals within their business organization, the ability to perform IDRS security related activities.

All individuals requesting the security role designation of Unit Security Representative, IORS Primary Report Reviewer, Alternate Unit Security representative, and Terminal Security Administrator, must submit Form 13230 to EOPs Security Account Administrators for approval.

Form 13230 must be approved by second-level management or higher.

A current initial USR Training Certificate or USR Refresher Training Certificate must accompany this form. A certificate is considered current if training was taken within six months from the date Form 13230 was last submitted for approval.

When the security personnel will provide USR security coverage to more than one IDRS Campus, a separate Form 13230 is required for unit coverage for that campus.

The order in which to provide IDRS security coverage for a unit or units are as follows:

All audit trail records, as well as IDRS audit logs, are available for review and analysis in the SAAS Data warehouse by authorized users. Security reviews in SAAS may be expanded at any time to include additional applications.

SAAS provides on-line analytical processing access to audit trail data to detect security violations.

Business units are responsible for reviewing SAAS audit trails and certifying accesses to taxpayer data.

The SB/SE Examination Operations USRs are responsible for the review and certification of security events that appear on the Transcript Delivery System (TDS) and the Modernized e-File (MeF)-RRD reports.

A security event is not classified as a security violation or an incident but could potentially be an unauthorized attempt to the security of IRS systems or data.

The Cybersecurity staff will e-mail the USR an Open Access report, weekly, and an Access to Employee report for MeF and TDS when available.

The Open Access report is subject to a sample review and certification. The business organization determines the sample percentage, which is subject to change.

The Access to Employee report is subject to 100% review and certification by the USR.

The USR must generally certify sample reports within 14 calendar days of receipt. Management may approve longer certification dates, as appropriate.

Certification procedures are the same for both the SAAS reports and the IORS reports. The USR is required to research each Taxpayer Identification Number (TIN) to determine if the access is business-related AND validate that the access is supported by one of the following:

When there is no direct case assignment, but the case is controlled on ERCS, the USR shall validate the access.

If the USR is unable to certify an access through independent research or managerial response, the USR must submit a referral to TIGTA for follow-up in accordance with IRM 10.8.34.6.3.1.2.3, Security Reports Requiring Certification by a Primary Report Reviewer.

Unlike IORS, SAAS does not have the capability to capture review comments. Therefore, the USR shall maintain their completed report, with comments, in a saved filed for a length of time as prescribed by your business organization. Certification results are submitted to IT Cybersecurity as directed.

Employees may use this form to document accesses to taxpayer information when not supported by direct case assignments.

This form can also be used when accesses are performed in error or may raise a suspicion of an unauthorized access. False statements may lead to additional inquiries or charges.

Employees are authorized to access taxpayer information to perform their official tax related duties and assignments.

Employees are not authorized, under any circumstances, to initiate an access to their own tax information or that of other individuals or businesses when they have a personal or outside business relationship where the access could cause or create the appearance of a possible conflict of interest.

Employees are required to review the Privacy Act Notification on Form 11377.

Use of Form 11377 or Form 11377-E is voluntary.

The manager must forward the completed Form 11377/11377-E, to the Head of Office Designee (HOD), by close of business or as soon as possible.

In SB/SE Examination Operations, the HOD is the Area Office’s assigned USR. To locate the Area’s Office HOD, please refer to the UNAX Website: https://portal.ds.irsnet.gov/sites/vl003/RelatedResources/BU-Head-of-Office-Designees-Form-11377-11377E.pdf PDF

Form 11377-E shall be sent to the HOD via secure e-mail.

Copies of Form 11377 or Form 11377-E containing taxpayer data, may not be retained by the employee or the employee’s manager.

The USR shall review all Forms 11377/11377-E to ensure proper completion and shall upload Forms to the Taxpayer Data Access Library’s SharePoint Site including any attachments.

Form 11377/11377-E must be uploaded on SharePoint within five business days of receipt and are retained for six years from the upload date.

All Forms 11377 received by United States mail, shall be scanned by the USR. If the USR does not have the ability to scan Form 11377, then the USR shall file these forms in a secure location with a retention period of six (6) years from the upload date as required in Document 12990, IRS Records Control. Schedules (RCS) 29, Item 270 to ensure the National Archives and Records Administration (NARA) approved records disposition prevents unauthorized/unlawful destruction of records.

The naming convention of Form 11377/11377-E is: SEID-MMDDYYYY-##.

The USR must respond promptly to requests from Labor Relations or TIGTA and provide copies of any Form 11377/11377-E requested for an ongoing investigation.

The OL5081 Application streamlines the request process for adding, deleting, modifying and password resets for authorized IRS employees to get access to IRS systems.

Employees access the OL5081 application on the IRS Intranet website https://ol5081.enterprise.irs.gov.

(3) The following is SB/SE Field Examination IDRS Applications by Campus:

The following is Specialty Program IDRS Applications by Campus:

The OL5081 shall not contain Sensitive PII Data such as the employee’s social security number.

The USR and manager have permissions to approve, deny or return a request.

The manager approving the OL5081 must:

The USR approving the OL5081 must:

Password Management is a feature on IDRS that enables users who have forgotten their IDRS password to get a new temporary IDRS password without having to submit an Online 5081 request.

PWMGT greatly reduces the number of temporary passwords issued by EOPS Security Account Administrators and saves users wait time of having a temporary password issued.

USRs shall strongly encourage all users to activate IDRS Password Management.

USRs shall review the monthly Password Management Activations report on IORS to identify IDRS users who have not activated this feature.

Command Code PWACT (Password Activation), allow users to activate Password Management.

Command Code PWMGT (Password Management), allows users who have forgotten their user-generated password to generate a new temporary password.

Once signed on IDRS with the temporary password, the user will be prompted to change the temporary password to a user-generated password.

CMODE is a non-profiled command code and does not have to be put in an IDRS user's profile.

Command code CMODE enables IDRS users to access other campuses' database without having to sign off IDRS.

If the IDRS user has not been authorized access to another campuses' database, the attempted use of the command code will not result in a security violation for the user.

CMODE requires that the IDRS user keep their same user profile and command codes from their home campus when accessing other campuses’ databases.

IDRS users shall be authorized by their managers and approved by their USRs to have CMODE privileges.

The USR shall grant users permission to access other campuses with command code UPEMP and Definer “S.” The permissions will appear as “Authorized Foreign Accesses” on IDRS.

Users may transfer their profile from one database to another, by entering command code CMODE along with the approved location acronym or Office Identifier. The campus and the field Exam Location Codes and Office Identifiers are:

When the IDRS user completes the work on a campus database, the user may enter CMODE and the location acronym or office identifier to go to another approved campus' database, or to return to their home campus database location. IDRS users may also sign off IDRS while their profiles are pointed to another campus' database.

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

≡ ≡ ≡

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

Unauthorized Access (UNAX) is the willful unauthorized access or inspection of taxpayer information, both electronic and paper, and is a crime, punishable upon conviction, by fines, prison terms and termination of employment.

IRS policy only allows employees to access tax returns and return information when the information is needed to carry out their tax administration duty.

USRs will perform reviews of security reports to help detect unauthorized (UNAX) activities on IDRS and other systems that employees use to access taxpayer information.

USRs are responsible for IDRS security. Any IDRS user found not to be following security rules, shall be advised and counseled by management and appropriate action must be taken immediately.

If an IDRS Security personnel, USR, manager, or other report reviewer encounters any indication of illegal or improper activity, he/she shall refer the case and findings to the proper management and/or TIGTA officials. For the telephone number of your local TIGTA office, view the map PDF on their website.

IRS employees are never authorized to access their own records or records of:

Control-D Web (sometimes referred to as Web Access) is a web-based software that allows viewing of reports electronically.

Control-D Web reduced the requests for prints at campuses and it allows faster access and greater report management for IDRS users.

IDRS Campus sites no longer print command code TRPRT requests. IDRS users who need a TRPRT print will need to get prints using Control-D Web.

Control-D Web access server guarantees a secured environment for accessing and viewing reports, and it verifies users and passwords before allowing report access.

Inactivity during an active session causes a time-out and terminates the session. This prohibits unauthorized viewers when users neglect to log out or lock their workstation.

All employees and managers will gain access to Control-D Web via the Online 5081 process.

For additional information on Control -D Web, refer to: http://mits.web.irs.gov/idse/.

IAT is an application that interacts with IDRS to streamline the IDRS research and input processes.

IAT requires less manual input making research and case actions more efficient and accurate.

IAT uses IDRS to gather and submit data. If IDRS is down, or a command code is down, IAT will not function, or may function improperly.

IDRS users may use IAT to retrieve and research account information. Most tools will not be available if the user is not signed on IDRS.

USRs may use the Managerial Tool feature in IAT to perform more than one update at a time to employees’ profiles in a unit, such as:

Individual updates to an employee’s profile can also be performed using this tool, such as:

To get IAT, employees may install through the Symantec Software Portal, or submit a ticket through OS GetServices and request the Integrated Automation Technologies (IAT) software.

For additional information on IAT, refer to the application’s websitehttps://organization.ds.irsnet.gov/sites/WiMttIat/home/default.aspx.

AMS is a web-based application that emphasizes the sharing of business data and provides a consolidated and synchronized view of taxpayer data and contact information from various IRS systems.

Many IDRS users request access to AMS. USRs should know the following:

USRs may identify users who use AMS by querying command codes AISDL, DMSDL in IORS.

When a TIN is entered into AMS, the AISDL command is issued, and a LINDX command is issued. The AISDL is audited to the user, the LINDX is not. On successful AISDL, if the user is profiled for Disclosure, a DMSDL command code will be issued and audited to the user.

The IDRS Automated Command Code Access Control prevents IDRS users with certain roles from having specified command codes in their profiles. If a user is not profiled for an adjustment command code in IDRS they will be restricted from performing adjustment actions in AMS.

An employee must sign on IDRS before they open the AMS program. When they are finished with AMS, they can just close the AMS window. However, the AMS program does not automatically sign the employee off IDRS. The user is responsible for signing off IDRS outside of AMS.

For additional information on AMS, refer to the application’s website http://ams.web.irs.gov/index.asp.

The USR shall e-mail first-time IDRS users an “Orientation Package” that includes but not limited to the following information: