Some examples and categories of IRS SBU data include, but are not limited to:

By definition, documents designated as Official Use Only (OUO) and Limited Official Use (LOU) include SBU data.

For more information, refer to IRM 11.3.12, Disclosure of Official Information, Designation of Documents.

The Freedom of Information Act (FOIA) exempts most SBU data from release to the public under one of the nine exemptions listed in 5 USC 552(b).

The fact that the IRS must release certain information if requested under FOIA does not automatically remove its status as SBU data. [FOIA]

For more information, refer to IRM 11.3.13, Freedom of Information Act.

Examples and categories of PII may include, but are not limited to the following, when used to distinguish or trace an individual’s identity, or when combined with information that is linked or linkable to an individual:

Information about an individual that is linked or linkable to one of the above.

IRS personnel must protect SBU data regardless of whether the same information is in the public record or publicly available. However, less stringent protections might apply in some situations.

Generally, personnel must encrypt SBU data (including PII). However, inside the IRS network, encryption is not required if the IRS proactively makes it available to all personnel on internal resource sites (including, but not limited to, Discovery Directory, Outlook [calendar, profile information, and address book], intranet, and SharePoint or Teams site collections), such as names, SEID, and business contact information. [NIST SP 800-122; [TD P 85-01, Appendix A, AC-20(3)_T.028, and MP-6(3)_T.124]

Email addresses, by themselves as the method of the email conveyance, generally do not need encrypting. However, when combined with the content and attachments of an email, the email address may become SBU data.

As for other SBU data and PII in the public record or publicly available, the requirements differ, depending on the information.

No IRC 6103 public records exemption exists. However, the Information Which Has Become Public Record section of IRM 11.3.11, Information Available to the Public, discusses disclosure of matters that have become public records as a result of tax administration, such as court cases. This is known as the judicially created public records exception.

Treasury security guidance exempts Treasury information made available proactively to the public from certain encryption controls. This exemption implies a public records exception for information the agency makes available to the public. [TD P 85-01, Appendix A, AC-20(3)_T.028, and MP-6(3)_T.124]

The Public Information Listing (PIL) designated by OPM makes certain federal employee information available to the public by FOIA request. For more information, refer to IRM 11.3.13, the Public Information section. [5 CFR 293.311]

IRS policy also authorizes the withholding of the public information items of employees in cybersecurity designated positions. Cybersecurity designated positions are not identified by a specific GS/IR series or position title.

Personnel should exercise caution and consult with PGLD for any questions they might have about application of a public record exception, on a case-by-case basis, prior to reducing privacy protections based on a public record exception. For further information, email *Privacy.

For more information, refer to IRM 11.3.13, Freedom of Information Act.

Little difference exists between PII and what personnel refer to as "sensitive" PII. For the definition of PII, see IRM 10.5.1.2.3, Personally Identifiable Information (PII).

The level of risk increases with the potential level of harm caused by exposed SBU data or PII.

Context is important. PII that does not seem high risk may still require protection if its context makes it risky. For example, a collection of names:

For more information, see IRM 10.5.1.6.1.1, Deciding Risk Levels for SBU Data and PII.

All IRS personnel are responsible and accountable for the effective implementation of privacy protections.

Privacy is personal. Do what’s right with sensitive information. Treat it like it’s your own. Put privacy first.

Use or collect PII only when necessary and relevant for legitimate IRS purposes, namely tax administration and other authorized purposes.

Privacy is a public trust. Limit the use of data to the purpose collected, for what is relevant and necessary for a legitimate IRS purpose. Don’t sell sensitive data.

Limit the collection, use, retention, and disclosure of PII to what is minimally necessary for the specific purposes for which it was collected, unless specifically authorized.

Privacy is simplicity. Data minimization means to access and use only the sensitive information you need. Just because you can access and collect data doesn’t mean you should. Reduce clutter. Keep it only if you must. Dispose of and manage it properly.

The IRS makes its privacy policies and practices readily available to individuals, such that we inform individuals of the collection, use, retention, and disclosure of their PII, and we get individuals’ consent to the greatest extent practical.

Privacy is transparency. Tell individuals what we do with their information and why we need it, so they know what to expect. Get consent to collect data.

Only access or disclose PII to authorized individuals who require the information for the performance of official duties. The IRS does not tolerate browsing of confidential information, including PII and tax information, by unauthorized IRS personnel. Protected information includes confidential information of all individuals, not just taxpayers. Protected information includes, but is not limited to, confidential information of IRS employees, volunteers, practitioners, and other individuals who interact with the IRS.

Privacy is discretion. Keep sensitive information private. Don’t talk about your cases. Share data only with those who have a need to know.

Provide appropriate administrative, technical, and physical safeguards to protect against the unauthorized collection, use, and disclosure of SBU data, including PII and tax information.

Privacy is protection. Safeguard sensitive information. You can’t have privacy without security.

Follow requirements governing the accuracy, completeness, and timeliness of PII to ensure fair treatment of all individuals. Collect information, to the greatest extent practical, directly from the individual to whom it relates.

Privacy is fairness. Be fair. Go to the source for sensitive information. Data is no good if it’s wrong.

Verify all information about an individual with the individual, as well as any other relevant sources, to the greatest extent possible before taking adverse action based on that information. Notify individuals prior to final action to the greatest extent possible.

Privacy is assurance. Verify information and provide individuals with prompt notification before acting.

Allow individuals to access and correct their PII upon request to the maximum extent allowable. Individuals include, but are not limited to, taxpayers, IRS employees, IRS contractors, practitioners, and others who interact with the IRS. Individuals will be able to contest determinations made based on allegedly incomplete, inaccurate, or out-of-date PII to the maximum extent allowable.

Privacy is visibility. Allow individuals to access their own information when allowable. Make it right.

Make IRS personnel aware of the proper treatment of SBU data, including PII and tax information, and train them accordingly.

Privacy is fundamental. Learn what you need to know about privacy. Be aware of how to protect data.

The IRS considers SBU data (including PII and tax information) at a moderate to high risk confidentiality level.

Loss, compromise, or disclosure of SBU data (including PII and tax information) could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual or the IRS.

Harm includes any adverse effects experienced by an individual whose PII was compromised, or adverse effects to the IRS such as a loss of public confidence.

The greater the potential for harm, the more at risk the SBU data becomes. As outlined in NIST SP 800-122:

The greater the risk to SBU data, the stronger the privacy and security protections become. [OMB A-130, NIST SP 800-122] For example, moderate and high risk SBU data require encryption, but publicly available low risk data might not need encryption.

When in doubt about the level of risk of SBU data (including PII and tax information), or the privacy concerns around the data, email *Privacy for help.

For more information about publicly available information, see IRM 10.5.1.2.3.2, Public Record.

For more information on the IT aspects of data security, refer to IRM 10.8.1, Information Technology (IT) Security, Policy and Guidance.

We must protect all SBU data (including PII and tax information). Limit what SBU we share based on authentication, authorization, and need to know. See IRM 10.5.1.2, Key Privacy Definitions. [Purpose Limitation, Strict Confidentiality]

Share SBU data (orally, visually, or electronically) in a way that avoids access by unauthorized persons. Precautions might include preventing visual access and restricting oral disclosure to designated individuals.

You may reproduce SBU data only to the extent needed to carry out official business. Properly destroy flawed or otherwise unusable reproductions. See the Disposition and Destruction section in IRM 10.5.1.6.10, Disposition and Destruction.

For tax information, follow extensive Disclosure rules in the IRM 11.3 series, Disclosure of Official Information.

For Privacy Act information, follow IRM 10.5.6, the Conditions of Disclosure under the Privacy Act section.

Internally: Only share SBU data (including PII and tax information) with other IRS personnel if the recipient’s need for the information is related to their official duties.

The electronic transmission of SBU data (including PII and tax information) requires encryption for security purposes. See IRM 10.5.1.6.2, Encryption, and IRM 10.5.1.6.9.7, Electronic and Online, for more information.

The confidentiality provisions of IRC 6103 restrict release of tax information (whether of an individual or business). Share tax information only with authorized individuals following established written procedures.

Externally: Only share SBU data (including PII and tax information) with authorized individuals outside of IRS, in encrypted files, if you meet all these conditions:

Refer to the IRM 11.3 series (Disclosure of Official Information) or email *Disclosure for more guidance.

IRS personnel must not create unauthorized, unnecessary, or duplicative hardcopy or electronic collections of SBU data (including PII and tax information), such as duplicate, ancillary, shadow, personal copies, or "under the radar" files. [Minimizing Collection, Use, Retention, and Disclosure]

If creating new spreadsheets or databases that include SBU data (including PII and tax information) from a larger file or database is necessary, consider whether it requires a PCLIA.

Remember that the use of cell phones or other cordless devices (cordless land lines) does not automatically create privacy and disclosure concerns. However, use of these devices might raise some vulnerability issues. Refer to IRM 10.8.1, the Telecommunication Devices and the Personally-Owned and Other Non-Government Furnished Equipment sections.

Whenever possible, conduct cellular phone conversations in a private setting (and not in a crowded public setting) to minimize the potential for eavesdropping. Cordless devices are rarely, if ever, used outside of a person’s home and do not lend themselves to conversations in crowded areas, but can still pose a risk of someone overhearing a conversation that the taxpayer does not want overheard.

For contacts initiated by IRS personnel that discuss SBU data (including PII or tax information), you must inform the other party you are calling from a cell phone or other cordless device when in a public place where others could overhear sensitive information. This will alert the other party of the potential for the inadvertent disclosure of their tax information. When calling from a private setting where others cannot overhear the conversation, you don’t have to say the call is originating from a cell or cordless phone.

Even when you don’t expect to discuss sensitive information in a call from a public place, you still should consider telling the other party you are using a cell phone or other cordless device in case a sensitive issue comes up in the discussion.

You must honor the other party’s request not to conduct a conversation concerning sensitive information by cell or cordless phone. Offer them the choice of rescheduling the conversation when a private space or a more secure land line is available. Appropriately document any agreement (if documentation kept, such as history notes).

For taxpayer-initiated contacts, the IRS is under no obligation to find if the taxpayer is using a less secure platform such as a cordless device or cell phone. You can talk about SBU data (including PII or tax information), because the taxpayer accepted any security vulnerability by using such a device to contact the IRS.

Never discuss CNSI over a cell or cordless phone. For more about CNSI, refer to IRM 10.9.1, Classified National Security Information.

For information about text messaging or texting, see IRM 10.5.1.6.9.6, Text Messaging (Texting).

Use the following for answering machine and voicemail guidelines when leaving messages with sensitive information:

When you can’t positively identify the number reached as the taxpayer’s or representative’s, and it is otherwise proper and practical, simply ask for a return call without giving the taxpayer’s name. If the call is in response to an earlier taxpayer inquiry or request, say the call is in response to an earlier inquiry or request. In such a case, you must not say the nature of the original situation nor reveal any specifics about the return call if it involves sensitive information.

Unless authorized by this policy in the limited allowable situations listed in this section, you must not send emails that include SBU data (including PII and tax information) to taxpayers or their authorized representatives, even if requested, because of the risk of improper disclosure or exposure.

When taxpayers request email contact and accept the risk of such, limited allowable situations without risking unauthorized disclosure of SBU data include:

Do not encourage or suggest taxpayers email SBU data (including PII and tax information) unencrypted or outside of a previously approved secure email program.

When responding to unsolicited emails from taxpayers or tax professionals, respond by letter or phone if possible; if address or phone number not available, respond by email. You must:

If you are authorized to email SBU data to authorized recipients, you may email SBU data (including PII and tax information) to those external stakeholders using IRS IT-approved encryption technology (see IRM 10.5.1.6.8) only when:

Do not encourage or suggest stakeholders email SBU data (including PII and tax information) unencrypted or outside of a previously approved secure email program.

For when you receive emails with SBU data from external parties, see IRM 10.5.1.6.8.1, Emails to Taxpayers and Representatives.

Interact with applicants or prospective contractors by email only to answer questions about their information, qualifications, or administrative matters; minimize the exposure of their personal information (such as PII).

For those who must provide IRS with their SBU data (such as PII) to facilitate a business arrangement, ask them to fax, mail, or upload their SBU data to a secure system, such as USAJobs.

IRS personnel must use IRS email for email communications with other IRS personnel about official business matters. They must encrypt all internal email messages that contain SBU data (including PII and tax information) with IT-approved encryption, which includes secure messaging or password-protected encrypted attachments.

For contractors, when provided with an IRS workstation as part of a contract, they must use their IRS workstation and account for all official communication (such as email or instant messaging). Refer to IRM 10.8.2, IT Security Roles and Responsibilities, the Contractor section.

No officer, employee, or contractor of the IRS may use a personal email account to conduct any official business of the government. [PATH] Three limited allowable circumstances include:

For more information on continuity management, contingency planning, or disaster recovery, refer to IRM 10.8.60 and IRM 10.8.62.

The general rule for encrypting SBU data (including PII and tax information) in emails reflects the IRS’s priority to protect sensitive information from unauthorized disclosure causing a risk of loss or harm to individual privacy or to IRS data.

Having evaluated business needs in relation to potential risk, the following limited exceptions for external emails are appropriate.

Limited exception: Subject line of case-related emails to the Department of Justice.

Limited exception: Emails generated to taxpayers or representatives by approved online applications.

Limited exception: IRS employees sending their personal SBU data via encrypted email or encrypted attachment. Personal SBU data is information pertaining only to you.

Limited exception: Emergency emails by Facilities Management and Security Services (FMSS).

IRS offers some alternatives to email to protect taxpayer security and privacy:

These examples of IRS-approved alternatives might not be your only options. Check with your business unit for other secure communication methods.

If IRS personnel carry SBU data (including PII and tax information) in connection with a trip or during daily activities, they must protect it and keep it with them to the extent possible.

If you must leave SBU data (including PII and tax information) unattended in an automobile while traveling between work locations or between work and home, lock it in the trunk. If the vehicle does not have a trunk, conceal the material from plain view and secure it in some manner. When not in transit, secure data in an approved work location (office, approved and securable telework location, or approved taxpayer site in IRS-approved lockable containers).

If you must leave the SBU data (including PII and tax information) unattended in hotel or motel room, lock it in a briefcase and conceal it to the extent possible.

If SBU data (including PII and tax information) is moved from one building to another (even within the same campus) or one location to another even if it is a short distance, take necessary steps to protect the information from unauthorized disclosure, loss, damage, or destruction.

Field employees might have SBU data needing protection while temporarily stored at the taxpayer's site.

For more information about how to protect taxpayer location when using GPS and location services, see IRM 10.5.1.6.11, Global Positioning Systems (GPS) and Location Services.

IRS personnel must follow proper data protection procedures when mailing SBU data. For more information on IRS policy about mail operations, refer to IRM 1.22.5, Mail and Transportation Management, Mail Operations.

For telework mail procedures, refer to IRM 6.800.2, the Mail section, and IRM 1.22.5, the Guidance on Telework Employee Mail and the Home as Post-Of-Duty (HaP) Employees section.

Mail letters and packages with SBU data that weigh less than 13 ounces via United States Postal Service (USPS). These packages do not require double packaging and double labeling. For more information about larger items, see IRM 10.5.1.6.9.3, Shipping through Private Delivery Carrier.

When sending SBU data by mail within the U.S. and Territories (serviced by United States Postal Service [USPS]):

When sending SBU data to offices Overseas:

IRS personnel must follow proper data protection procedures when shipping PII through a private delivery carrier. This practice helps prevent data loss and disclosure, and in case of loss or disclosure, allows the IRS to notify impacted individuals.

For Telework shipping procedures, refer to IRM 6.800.2, the Mail section, and IRM 1.22.5, the Guidance on Telework Employee Mail and the Home as Post-Of-Duty (HaP) Employees sections.

Mail letters and packages with PII that weigh less than 13 ounces via United States Postal Service (USPS). These packages do not require double packaging and double labeling. See IRM 10.5.1.6.9.2, Mail through USPS.

You must ship packages with PII that weigh 13 ounces or more through a private delivery carrier.

For shipping electronic media, including removable media such as USB drives and other portable storage devices, you must encrypt it first. Refer to IRM 10.8.1, the Media Transport section.

For all PII shipments through a private delivery carrier, the sender must follow the procedures included below for properly double packaging, double labeling, and tracking the shipment, including the use of Form 3210, Document Transmittal (or equivalent). Whether you use a Form 3210 or its equivalent, you must include enough information on the transmittal to identify the package contents in case of its loss or disclosure, so the IRS can notify impacted individuals and take steps to decrease the possibility that the information will be compromised or used to perpetrate identity theft or other forms of harm.

When shipping PII through private delivery carrier, you must use UPS CampusShip at all non-Campus locations and non-FMSS-contract-mailroom-supported offices; Campus locations and FMSS-contract-mailroom-supported offices may use UPS CampusShip, but it is not mandatory at those locations. UPS CampusShip is an internet-based shipping system that you can access from any location that has internet access. The IRS has rolled out UPS CampusShip across the country to IRS field offices not serviced by a FMSS contract mailroom. Find information about UPS CampusShip:

CampusShip allows employees to:

You must double-package and double-label PII packages prior to shipping. Double-packaging helps protect the contents if the outer package is damaged or destroyed during the shipping process. Duplicate shipping labels allow proper delivery of the contents without potential disclosure if the external package is damaged or destroyed.

Evaluate the size of the PII shipment and identify appropriate packing materials. The proper type of internal and external packaging depends upon the size and weight of the package. Use the smallest size packaging possible to reduce shipping costs and ensure minimal shifting of contents during shipment.

The sender must also decide whether to ship via ground service or express (Overnight and Second Day Air) services:

For all PII shipments through a private delivery carrier, the sender must prepare Form 3210, Document Transmittal (or its equivalent), identifying the package contents for all packages with PII and asking for recipient acknowledgement. This practice includes shipments to IRS offices, contractors, external agency partners, and even taxpayers (or their representatives, referred to collectively as taxpayers) when applicable. For external partners and taxpayers, use an equivalent to Form 3210. Whether you use a Form 3210 or its equivalent, you must include enough information on the transmittal to identify the package contents in case of its loss or disclosure, so the IRS can notify impacted individuals and take steps to decrease the possibility that the information will be compromised or used to perpetrate identity theft or other forms of harm.

Securely package the PII by placing the contents and the properly completed Form 3210 (or equivalent) in an appropriately sized internal package. The sender keeps Part 4, Sender's copy, of Form 3210 (or equivalent) and includes Part 1, Recipient’s copy, and Part 3, Acknowledgement copy, with the shipment. When you use a transmittal letter as an equivalent of Form 3210, the shipment does not require a paper equivalent to Form 3210 Part 3; the recipient’s verbal or electronic confirmation of receipt suffices as acknowledgement. When sending the package to a specific individual, the sender may choose to notify the recipient via encrypted email, phone, or other method prior to shipment that the package with PII is on its way. The sender may also choose to send an electronic PDF version of Form 3210 (or equivalent) via encrypted email to the intended recipient, so the recipient is aware of the expected shipment.

Internal packaging may include any of the following:

Label the internal package with the following information:

The sender may use a copy of the exterior small package carrier shipping label for the internal label, so print 2 copies (the first for the interior, the other for the exterior).

Place the properly labeled, packaged, and sealed internal package into the external package. External packaging materials may include:

Whenever possible, use a new box; however, you may re-use undamaged packaging materials to ship PII. Only reuse a box if it is rigid and in good condition with no punctures, tears, rips, or corner damages, and all flaps are intact. Remove any existing labels and all other shipment markings if re-using a box.

Use enough packing material inside the package so the contents do not move or shift when shaken.

Do not mark or label external packaging material with information showing that package contents include sensitive information. You can mark packages as "time sensitive" or "process immediately" as applicable to ensure prompt processing. Labels that show sensitive contents include, but are not limited to:

Seal the package with strong clear shipping tape that is two inches or more in width. Do not use string, paper over-wrap, shrink wrap, and/or plastic straps.

Place the shipping label on the top of the package and ensure it is properly adhered and will not separate from the box. Do not place the label over a seam or closure or on top of sealing tape since this could cause it to be damaged or removed from the package.

The sender must monitor the shipment delivery. Follow your organization’s established time frames for Form 3210 (or equivalent) acknowledgement follow-up. Where there is no established time frame in an individual organization, the follow-up action should take place in three business days for overnight shipments and 10 business days for ground shipments.

Once received, the recipient will verify receipt of the contents and sign the acknowledgment copy of the Form 3210 (or equivalent). The recipient will return the Form 3210 (or equivalent) acknowledgement to the sender using secure email (electronic or scanned copy), fax, or mail. If the SSN was not redacted as required on the Form 3210 (or equivalent), redact all but the last four digits of the SSN prior to returning it to the sender.

After receiving the acknowledgement copy (if applicable, equivalent confirmation of receipt), the sender will associate it with the original Form 3210 (or equivalent).

If you do not receive the signed Form 3210 acknowledgement (or equivalent confirmation of receipt) within the established time frame, access the small package carrier's website to track the shipment to find if it was delivered successfully. The tracking number should have been included on Form 3210 (or equivalent) when the shipping labels were prepared or after the number was received from the carrier if Form 9814 was used.

If the tracking information shows the package was delivered, the sender must contact the intended recipient to confirm actual receipt of the package.

If the tracking information indicates the package was not successfully delivered, the sender should closely monitor the tracking information for up to 48 hours (2 business days) after the anticipated delivery date for air services and up to 72 hours (3 business days) after the anticipated delivery date for ground services. If not delivered within these time frames, consider the package lost. The sender must follow the procedures for reporting a loss of hardcopy documents.

Immediately upon discovering or identifying a package is lost, report the loss following IRM 10.5.4. Refer to the internal Report Losses, Thefts or Disclosures of Sensitive Data; Report Lost or Stolen IT Assets and BYOD Assets site.

Business unit management must establish an internal process to identify the package contents and impacted individuals in case of a lost or compromised package. We must be able to identify the contents of the lost package and help the carrier determine if it belongs to the IRS. You must provide detailed information about the contents such as taxpayer last names, check numbers, forms numbers, documents enclosed, etc., including any and all identifying information that might help locate the contents of the package.

Managers must perform, at a minimum, quarterly audits of the Form 3210 (or equivalent) acknowledgement process for packages with PII to ensure proper follow-up is occurring. Managers must document the results of these audits. This procedure will allow IRS managers the opportunity to confirm that PII senders are following up on Form 3210 (or equivalent) acknowledgments within defined time frames so that they identify lost shipments quickly. This reduces the likelihood of exposing PII to an unauthorized user. Local management must decide the proper follow-up time frame as part of the manager’s operational review. Keep Form 3210 (or equivalent) following the existing record retention schedule for each business unit.

Additionally, management should periodically sample mail to ensure the business unit follows this PII shipping policy.

For more information, refer to the PII Hardcopy Shipping.

Refer to IRM 1.15.5, Relocating/Removing Records, for shipping records (such tax or personnel records) to the Federal Records Centers.

Protect faxed SBU data (including PII and tax information) as with any other transmission of SBU data.

Internally, use secure encrypted email, if possible, as an alternate way to send SBU data, instead of faxing. Scan, encrypt, and internally email documents that include SBU data. See IRM 10.5.1.6.8, Email.

If you must fax the information, do not send SBU data to a fax machine without contacting the recipient to arrange for its receipt.

Use a cover sheet for faxes with SBU data that lets the recipient know that it contains sensitive information and requests unintended recipients to report the disclosure and confirm destruction.

For misdirected faxes, refer to IRM 10.5.4, Incident Management Program, the Responsibilities section.

When transmitting SBU data via fax, use Enterprise Electronic Fax (EEF) as the preferred method of faxing documents. Refer to IRM 21.2.3, Systems and Research Programs - Transcripts (the IRS Electronic Fax System section) or the internal EEFax site.

For more information on securely faxing documents, refer to IRM 10.8.1, the Facsimile and Facsimile Devices and AC-20 Use of External Information Systems - Control Enhancements sections.

Protect printed documents with SBU data and follow the IRS Clean Desk Policy in all work locations (including field and telework).

Minimize the printing of SBU data to what is explicitly necessary.

Properly store and dispose of printed materials. See IRM 10.5.1.6.6, Storage, and IRM 10.5.1.6.10, Disposition and Destruction.

Use only IRS-furnished (not personally owned) printers. Refer to IRM 10.8.1, the Printers, AC-20 Use of External Information Systems, and Personally-Owned and Other Non-Government Furnished Equipment sections.

IRS personnel must not use text messaging (texting) for official business.

Refer to IRM 1.15.6, Managing Electronic Records, the Use of Agency-approved Electronic Messaging Systems, Preserving Electronic Messages, and Common Questions about Electronic Messaging sections.

Refer to IRM 10.8.1, the Telecommunication Devices section.

External electronic transmission and online data exchanges address uploading or downloading, secure file transfer, file sharing, peer-to-peer (P2P), collaborative technology and systems, third-party sites (commercially available file-sharing sites in the cloud or private file-sharing on remote servers), and blacklisted sites.

Do not post or upload SBU data (including PII and tax information) online, including IRS official internal or external websites or cloud-based systems or services, unless secured with IT-approved access controls by the IRS (or by an IRS vendor bound by contract to protect the information). [NIST SP 800-122, TD P 85-01]

Use only IRS identifiers (name or email) when conducting official business.

For receiving documents from taxpayers, IRS personnel may offer taxpayers the opportunity to use the Document Upload Tool (DUT) when this option is available. For more information about when you can offer this tool, refer to your business unit procedures.

For internal collaborative electronic or online data sharing, see IRM 10.5.1.6.18, Data on Collaborative Technology and Systems, and IRM 10.5.1.6.18.3, Shared IRS Storage (OneDrive, SharePoint, Teams, and Other IRS Collaborative Sites).

For more information about securing electronic transmissions, refer to IRM 10.8.1, the AC-20 Use of External Systems, the SA-9 External System Services, and the External Collaborative Technology and Systems sections.

For more information about secure emailing, see IRM 10.5.1.6.8, Email.

When moving an office or material, make plans to protect and account for all SBU data (including PII and tax information), as well as government property. Consider the relevant factors of the move (such as the distance involved and the method used in making the move).

Take precautions equal with the type and value of property and data involved.

Place hardcopy waste material with SBU data in locked receptacles specifically marked for sensitive document destruction (SDD or shred bins). This includes material shredded with non-compliant equipment that does not meet requirements.

For one-step destruction of paper with SBU data, use cross-cut shredders which produce particles that are 1 mm x 5 mm (0.04 in. x 0.2 in.) in size (or smaller), or pulverize/disintegrate paper materials using disintegrator devices equipped with a 3/32 in. (2.4 mm) security screen. [NIST SP 800-88, Guidelines for Media Sanitization]

For multi-step destruction of paper, you may use non-compliant methods for the first step. The IRS must then protect the product until it is then destroyed in a manner that renders it unreadable, indecipherable, and irrecoverable. [32 CFR 2002]

For electronic media destruction requirements (for items such as magnetic media, diskettes, hard disks, CDs, external drives, USB drives or other removable media, or other storage devices), refer to IRM 10.8.1, the MP-6 Media Sanitization section, and follow NIST SP 800-88, Guidelines for Media Sanitization.

Refer to the internal Media Destruction Shipping Procedures site on for disposal of electronic media.

Do not put electronic media with hardcopy paper in the sensitive document destruction bins.

For microforms with SBU data (microfilm, microfiche, or other reduced image photo negatives): [NIST SP 800-88, Guidelines for Media Sanitization]

For temporary storage, while waiting for destruction of sensitive waste, you don’t have to put it in a locked receptacle if you follow these requirements for burn bags or shred boxes:

Manage IRS records (hardcopy and electronic), including those with SBU data (such as PII and tax information), properly and follow the Records Control Schedules (RCS) Document 12990 and General Records Schedules (GRS) Document 12829 to prevent unlawful or unauthorized destruction of records.

Disposition and destruction of tax information must follow the Records and Information Management IRM 1.15.2, Types of Records and Their Life Cycle, IRM 1.15.3, Disposing of Records, and IRM 1.15.6, Managing Electronic Records.

Turn over unshredded sensitive information to a contractor provided the contract includes necessary safeguards that ensures compliance with IRC 6103(n) requirements, provides for periodic safeguard reviews, and includes language describing methods of collection, pick-up, storage, and disposition. Refer to IRM 11.3.24, Disclosures to Contractors, the Destruction of Returns and Return Information section.

If an independent contractor collects and destroys tax information media, to prevent the necessity of having an IRS employee present during destruction, the contract must include the safeguard provisions required by IRC 6103(n) and regulations.

CORs hold responsibility for verifying all contractors maintain certification designation with an industry trade association that conducts scheduled and unannounced site inspections and reports out on findings. periodically review work areas to ensure that contractors are discarding sensitive waste material properly.

Do not place paper documents with SBU data in regular recycling containers. Instead, place them in clearly marked secured containers (sensitive document destruction bins).

The preferred approach is to segregate and shred sensitive information following guidelines contained in IRM 10.5.1.6.10, Disposition and Destruction, before turning it over to the recycler.

Another method is to have IRS personnel observe the destruction of sensitive information upon delivery to the recycler. This allows for destruction of sensitive information while maintaining custody of the material up to the moment of destruction. Again, the contractor must follow IRC 6103(n) requirements which provides for safeguards and periodic safeguard reviews.

This exception for the use of personally owned GPS devices is limited to GPS functions only. For example, this does not apply to the use of the non-GPS functions on personally owned mobile computing devices.

Input only taxpayer address information into the GPS device and delete this information from the device once it is no longer necessary. Never input individual or business taxpayer names into the device.

Do not connect the GPS device to an IRS computer, as the device has the potential to introduce computer viruses and malware into the IRS network.

If available, use a security personal identification number (PIN) code with the device to help protect the privacy of tax information in the event the device is lost or stolen.

Take every precaution to prevent the GPS device from being left unattended or unsecured.

Remove portable GPS devices from vehicle when not in use as circumstances allow. In those limited instances where you must leave a portable device in a locked vehicle, store it out of sight in the trunk or glove compartment.

Never leave portable GPS devices in a vehicle overnight.

Do not leave the portable GPS device and any mounts in an unattended vehicle in plain sight. After removing mount, clean the suction cup mount area because it can leave marks on the windshield/dashboard showing that a GPS or other device may be present in the vehicle, increasing the risk of a break-in.

Report the loss or theft of a GPS device with taxpayer addresses (whether a government-issued GPS or a personally-owned GPS), as a potential breach of PII:

Except for the use of GPS in IRM 10.5.1.6.11.1, we strongly encourage you not to use your personal devices (such as phones, tablets, fitness watches, or wearable devices) or applications on them to identify taxpayer or work addresses with location services (geolocation), geotagging, or GPS features of any social media accounts (Facebook Check In, Find My Friends, etc.). Geotagging pinpoints location, which might inadvertently reveal a taxpayer’s home or business, or show activities and location at an IRS office. You should use an IRS-furnished device (if issued) when finding and receiving directions to taxpayer addresses.

When using services that need location, try to avoid using an exact taxpayer address if it might pinpoint the IRS has an interest in the taxpayer.

The Privacy Act prohibits federal agencies from maintaining records on how any individual exercises their First Amendment rights unless certain exceptions apply.

First Amendment rights include religious and political beliefs, freedom of speech and of the press, and freedom of assembly and petition.

Congress intended agencies to apply the broadest reasonable interpretation when determining whether a particular activity is a right guaranteed by the First Amendment.

IRS personnel must not keep files of persons who are merely exercising their constitutional rights.

IRS personnel involved in the design, development, operation, or maintenance of any system of records subject to the Privacy Act must be aware of the restrictions on maintaining records on the exercise of First Amendment rights and alert to any potential violation of those restrictions.

Taxpayers must report income and provide information necessary to verify deductions on their tax returns. The IRS may collect such information although, in some instances, this data may reveal how individuals exercise their First Amendment rights, such as religious affiliation, group membership, or political preference. The IRS may collect this information because statutory exceptions apply. [Privacy Act; Purpose Limitation]

For more information, refer to IRM 10.5.6, the Privacy Act Recordkeeping Restrictions (Civil Liberties Protections) section.

Widely available electronic recording and monitoring technology (such as online meetings, digital cameras, smartphones, and smart devices) raises privacy and security concerns.

Privacy concerns for recording (including, but not limited to, video, photographic, or infrared) in the workplace center around individual employee privacy, the potential disclosure of SBU data (including PII and tax information), and data minimization and retention. [Minimizing Collection, Use, Retention, and Disclosure]

The law for recording others varies by state, but many states require consent of both the recording individual and the recorded individual. To protect individual employee privacy, IRS policy prohibits most recordings because of such variations.

To record in the workplace, you need:

Business need: Minimize recordings in the workplace unless you have a compelling business need. Just referring to notes to refresh your memory after a meeting is not a reason to record.

Examples of compelling business need that allows for limited recording in the IRS workplace with approval and consent include, but are not limited to:

Approval:

Consent: If you must record, get consent to record from all participants. They can give explicit consent (verbal or by other action) or give implied consent after notice of recording by staying on the call or in the meeting. If you intend to disclose the recording for a legitimate business need, get written consent, such as via Form 15293, IRS Privacy Act Consent. Refer to IRM 10.5.6, the Privacy Act Consent for Disclosure section.

Precautions:

The IRS needs to conduct some monitoring of individuals to protect federal systems, information, and personnel. Examples of such monitoring include access logs to IRS facilities and audit trails that monitor IT usage. [Privacy Act]

However, limitations still exist on use of any PII collected, with sharing on a need-to-know basis for its intended use only. [Privacy Act]

Monitoring of the public outside IRS facilities must not occur without first consulting Privacy Policy [Treasury’s Privacy and Civil Liberties Impact Assessment Template and Guidance]. For help, email *Privacy.

For more information about the limitation of monitoring individuals, refer to IRM 10.5.6, the Privacy Act Recordkeeping Restrictions (Civil Liberties Protections) section.

The IRS PCLIA addresses these limitations. For more information about PCLIAs, refer to IRM 10.5.2, Privacy Compliance and Assurance (PCA) Program.

The IRS internet privacy policy notices on IRS.gov inform the public of the information collection procedures and the privacy measures in place for a particular internet website or activity. [OMB-10-23, E-Government Act, OMB A-130, OMB-03-22, Openness and Consent, PT-5]

Link to the IRS Privacy Policy at every major entry point to an IRS internet website or application, as well as on any page collecting substantial personal information from the public. The requirement also may include a unique privacy policy for that website. See IRM 10.5.1.6.16.2, Online Data Collection Website or Application Privacy Policy Notice.

The IRS privacy policy notice is:

Refer to the overarching IRS.gov Internet Privacy Policy notice:
https://www.irs.gov/privacy

A unique privacy policy for a website or application must detail the differences from the IRS.gov privacy policy. This policy applies to any website or application hosted by or for the IRS. [OMB-10-23, E-Government Act, OMB A-130, OMB-03-22, Openness and Consent, PT-5]

The website or application privacy policy must still link to the IRS.gov Privacy Policy.

A simple example or template, with brackets [like this] to fill in the details pertinent to the website or application, is:

If the website or application is more complex, you might need a more complicated policy notice.

For questions or Privacy Policy notice review or approval, email *Privacy.

Any IRS internet website (or link to a third-party site for the IRS) that links to external sites that are not part of an official government domain must post a privacy departure notice. This notice alerts internet visitors that they are about to leave the IRS website and its privacy practices. It advises them to review the website privacy practices for the website they are about to enter. [OMB-10-23, E-Government Act, OMB A-130, OMB-03-22, Openness and Consent, PT-5]

The privacy departure notice must be a pop-up or a statement adjacent to the link.

For the departure notice language, you can use:
You are leaving the IRS website. Protect your privacy. Review the privacy policy available on the websites you are visiting and be cautious about providing your personal information.
[Continue] [Cancel]

IRS intranet or non-publicly accessible privacy policy notices inform personnel of the information collection procedures and the privacy measures in place at a particular intranet site or activity. This notice is a a modified version of the IRS.gov Privacy Policy Notice; see IRM 10.5.1.6.16.1. [OMB-10-23, E-Government Act, OMB A-130, OMB-03-22, Openness and Consent, PT-5]

Link to the internal IRS intranet privacy policy notice at every major entry point to an intranet site, as well as on any page collecting personal information from an individual.

Any IRS intranet site or page that links to external sites that are not part of an official government domain must post a privacy departure notice. This notice alerts IRS personnel that they are about to leave the IRS website and its privacy practices. It advises them to review the privacy practices on the website that they are about to enter. This is a modified version of the privacy departure notice; see IRM 10.5.1.6.16.3.

For the intranet departure notice language, you can use:
You are leaving the IRS intranet. Protect your privacy. Review the privacy policy available on the websites you are visiting and be cautious about providing your personal information.
[Continue] [Cancel]

Do not use persistent cookies or other tracking devices to monitor an individual's visit to IRS intranet sites, except as authorized by OMB regulations.

You may place information that is not SBU data (including PII and tax information) on all calendars without restriction.

You must not post SBU data (including PII and tax information) on public calendars with uncontrolled access.

The following applies any time a business needs to enter some form of SBU data (including PII and tax information) on a shared calendar:

For Business Unit Calendar Meetings/Appointments about Taxpayers:

For Calendars for Offices with Regulatory, Investigative, and/or Advocacy Responsibilities (docketed case meetings):

For Calendars for Offices with Regulatory, Investigative, and/or Advocacy Responsibilities (taxpayer meetings):

For Non-Taxpayer-Related Meetings/Appointments:

Online meeting tools include M365 Teams, Saba Centra, Zoom for Government (ZoomGov), etc. Use only enterprise-approved tools as they will have the necessary authorization and protections, such as encryption, so you can do business with necessary SBU data (including PII and tax information) in a secure environment.

When using approved virtual meeting tools with encrypted communication capability for official IRS business, you must apply these principles:

IRS-approved encrypted online meeting tools may convey SBU data; however, apply the principles of authentication, authorization, and need to know.

To protect your own privacy, keep chats, profile pictures, and background images professional.

To prevent inadvertent disclosure, verify which chat or meeting window you are using to ensure you do not put SBU data in the wrong conversation.

For more information about online meeting privacy considerations, refer to the internal Online Meeting Tools - Privacy Considerations site.

For best practices and answers to questions about using M365 tools, refer to the internal M365 site.

Refer to IRM 10.8.1, the SC-15 Collaborative Computing Devices section.

When putting SBU data (including PII and tax information) on shared storage, check to make sure only those with a need to know have access. Sharing data in collaborative data environments (such as a SharePoint site, a group or team site in Teams, or your OneDrive site) might offer valuable benefits while having inherent privacy risks. Understanding the risks involved with sharing data on these sites is key to managing those risks with tight access, privacy, and security controls in place. Collaborative environment access controls must limit access using proper site, folder, file, or other permissions.

Collaborative environment owners also must ensure their users follow rules and protect privacy.

Most IRS collaborative environments no longer require separate PCLIAs beyond those for their underlying systems. If you use a collaborative environment for a complex processing system using custom code and connecting to other systems, it might become a system that requires a separate system PCLIA. Contact *Privacy to ask if you need a system PCLIA.

For more information, refer to IRM 10.5.2, Privacy Compliance and Assurance (PCA) Program, the Privacy Compliance in Collaborative Environments and the System PCLIAs sections.

For more information, refer to IRM 10.8.1, Information Technology (IT) Security, Policy and Guidance (the SC-15 Collaborative Computing Devices and Applications and the SC-28 Protection of Information at Rest sections), and IRM 2.25.20, Integrated Enterprise Portal-Web Services - SharePoint.

Before contracting for cloud services, address the necessary privacy, records management, and security policies.

PGLD must approve all procurements of cloud computing services that include SBU data (including PII and tax information) via the Privacy and Civil Liberties Impact Assessment (PCLIA) process (required by the ELC and OneSDLC). For more information about OneSDLC, refer to IRM 2.31.1, Lifecycle Management - One Solution Delivery Life Cycle Guidance, or the OneSDLC site.

The IRS PCLIA process addresses privacy concerns for IRS systems with SBU data (including PII and tax information) using cloud computing. These issues include, but are not limited to:

Except for systems principally supporting overseas Federal/Treasury personnel and/or activities, Treasury systems must be located and operated within the U.S. [TD P 85-01, control SA-4_T.193]

PGLD and COR must provide written notification to the contractor when the contractor is allowed to keep Government data at a location outside the U.S.

Failure to follow privacy and security policies and processes might require contract modifications.

For more information on cloud computing issues and cloud deployment models, refer to IRM 10.8.24. Information Technology (IT) Security, Cloud Computing Security Policy, and IRM 10.8.1, Information Technology (IT) Security, Policy and Guidance.

The IRS e-signature principles and federally mandated authentication controls describe how the IRS protects an individual’s identity and assures that only authorized signers are completing the transaction.

For more information, refer to the internal e-Signature site. For any further questions, contact the *PGLD IA eSignature mailbox.

For detailed information on the e-signature program, refer to IRM 10.10.1, Identity Assurance, IRS Electronic Signature (e-Signature) Program.

The Identity Assurance IRM 10.10.2, Authentication Risk Assessments in Non-Digital Channels, details this policy, owned by PGLD’s IA as part of their Omni Channel approach to authentication and authorization for all interactions.

For electronic interactions, this policy defers to the DIRA process (see IRM 10.5.1.7.9, Digital Identity Risk Assessment (DIRA)) for electronic interactions. For all other interactions, this policy applies to assessing the risk in the authentication process of telephone, in-person, and correspondence exchanges of sensitive information with individuals in authenticated customer contact channels.

For more information, refer to the internal NDARA site.

For questions, email *PGLD IA Omni-Innovations

Use of SSNs is acceptable when any of these options mandates such use:

SSN ER compliance requires owners of forms, notices, letters, and systems to apply the following SSN necessary-use criteria to determine whether SSN use is justifiable and necessary:

The IRS must provide information on IRS.gov/privacy to enable individuals to have access to the elements of their personally identifiable information that the IRS collects, as governed by the applicable laws and regulations. [NIST SP 800-53] [OMB M-21-04]

The privacy concerns are that individuals have access to the information that the IRS has on them, as governed by the applicable laws and regulations.

Implementation guidance: The IRS implements this control by publishing SORNs and PCLIAs and handling requests for information under the Privacy Act, IRC, and FOIA.

In this IRM, PGLD policies on the individual access control include, but are not limited to, the sections:

PGLD and IRS also address the individual access control in the following:

This is a joint security and privacy control about literacy training and awareness. For the full text of the control, see the AT-2 Literacy Training and Awareness section of IRM 10.8.1.

The privacy concerns are keeping personnel current on privacy training and awareness.

Implementation guidance: The IRS implements this control by requiring annual mandatory briefings on security and privacy. PGLD contributes to the content of the mandatory briefings, incorporating lessons learned or issues of concern. PGLD employs awareness techniques such as all-employee communications, awareness events, and ad-hoc sessions.

In this IRM, PGLD policies on the literacy training and awareness control include, but are not limited to, the sections listed in the AT-1 references, IRM 10.5.1.8.2.

PGLD and IRS also address the literacy training and awareness control in the sections listed in the AT-1 references, IRM 10.5.1.8.2

This is a joint security and privacy control about role-based training. For the full text of the control, see the AT-3 Role-Based Training section of IRM 10.8.1.

The privacy concerns are keeping personnel current on privacy training and awareness.

Implementation guidance: The IRS implements this control by requiring role-based privacy training for roles with specialized privacy responsibilities.

In this IRM, PGLD policies on the role-based training control include, but are not limited to, the sections listed in the AT-1 references, IRM 10.5.1.8.2.

PGLD and IRS also address the role-based training control in the sections listed in the AT-1 references, IRM 10.5.1.8.2

Provide all personnel with access to PII with initial and annual training in the employment and operation of personally identifiable information processing and transparency controls. [NIST SP 800-53]

The privacy concerns are that all personnel processing PII understand how to protect privacy.

Implementation guidance: The IRS implements this control by requiring annual mandatory role-based briefings on security and privacy.

In this IRM, PGLD policies on the processing personally identifiable information control include, but are not limited to, the sections listed in the AT-1 references, IRM 10.5.1.8.2.

PGLD and IRS also address the processing personally identifiable information control in the sections listed in the AT-1 references, IRM 10.5.1.8.2

This is a joint security and privacy control about training records. For the full text of the control, see the AT-4 Training Records section of IRM 10.8.1.

The privacy concerns are tracking the training records to ensure that all personnel are current on privacy training and awareness.

Implementation guidance: The IRS implements this control by keeping and reviewing records that personnel have taken the annual mandatory briefings on security and privacy.

In this IRM, PGLD policies on the training records control include, but are not limited to, the sections listed in the AT-1 references, IRM 10.5.1.8.2.

PGLD and IRS also address the training records control in the sections listed in the AT-1 references, IRM 10.5.1.8.2.

This is a joint security and privacy control about event logging. For the full text of the control, see the AU-2 Event Logging section of IRM 10.8.1.

The privacy concerns are that logging events (audit logs, audit trails, event logs, etc.) can reveal information about individuals.

Implementation guidance: The IRS implements this control by requiring systems limit the SBU data (including PII and FTI) in audit logs to only that needed for its intended use, grant access only on a need-to-know basis, and document the justification for information collected and shared.

In this IRM, PGLD policies on the event logging control include, but are not limited to, the section IRM 10.5.1.6.14.3, Monitoring Individuals.

PGLD and IRS also address the event logging control in the following:

Limit personally identifiable information contained in audit records to the following elements identified in the privacy risk assessment: Minimum necessary PII identified in the PCLIA. [NIST SP 800-53]

The privacy concerns are that "Limiting personally identifiable information in audit records when such information is not needed for operational purposes helps reduce the level of privacy risk created by a system."

Implementation guidance: The IRS implements this control by requiring systems limit PII in audit records to the minimum necessary.

In this IRM, PGLD policies on the limit personally identifiable information elements control include, but are not limited to, the sections:

PGLD and IRS also address the limit personally identifiable information elements control in the following:

This is a joint security and privacy control about audit record retention. For the full text of the control, see the AU-11 Audit Record Retention section of IRM 10.8.1.

The privacy concerns are that the IRS retains audit records relative to Freedom of Information Act (FOIA) requests, subpoenas, and law enforcement actions for the proper period to maintain transparency.

Implementation guidance: The IRS implements this control by adhering to the IRS records managements requirements.

In this IRM, PGLD policies on the audit record retention control include, but are not limited to, the sections:

PGLD and IRS also address the audit record retention control in the following:

This is a joint security and privacy control about control assessments. For the full text of the control, see the CA-2 Control Assessments section of IRM 10.8.1.

The privacy concerns are to ensure controls operate as intended, sufficiently ensure compliance with applicable privacy requirements, and manage privacy risks.

Implementation guidance: The IRS implements this control by assessing privacy controls.

In this IRM, PGLD policies on the control assessments control include, but are not limited to, the sections listed in the CA-1 references, IRM 10.5.1.8.4.

PGLD and IRS also address the control assessments control in the sections listed in the CA-1 references, IRM 10.5.1.8.4.

This is a joint security and privacy control about plan of action and milestones (POA&Ms). For the full text of the control, see the CA-5 Plan of Action and Milestones section of IRM 10.8.1.

The privacy concerns are to monitor privacy on POA&Ms.

Implementation guidance: The IRS implements this control by requiring System Owners monitor and address privacy risks identified on the PCLIA in a POA&M.

In this IRM, PGLD policies on the plan of action and milestones control include, but are not limited to, the section IRM 10.5.1.4.4, System Owners.

PGLD and IRS also address the plan of action and milestones control in IRM 10.5.2: Roles and Responsibilities.

This is a joint security and privacy control about authorization. For the full text of the control, see the CA-6 Authorization section of IRM 10.8.1.

The privacy concerns are to address privacy requirements before authorization to operate.

Implementation guidance: The IRS implements this control by including privacy in the ELC (specifically PCLIAs) or OneSDLC (across the life cycle).

In this IRM, PGLD policies on the authorization control include, but are not limited to, the sections listed in the CA-1 references, IRM 10.5.1.8.4.

PGLD and IRS also address the authorization control in the sections listed in the CA-1 references, IRM 10.5.1.8.4.

This is a joint security and privacy control about continuous monitoring. For the full text of the control, see the CA-7 Continuous Monitoring section of IRM 10.8.1.

The privacy concerns are to maintain ongoing awareness of developing vulnerabilities.

Implementation guidance: The IRS implements this control by following the Pub 5499, IRS Privacy Program Plan.

In this IRM, PGLD policies on the continuous monitoring control include, but are not limited to, the sections listed in the CA-1 references, IRM 10.5.1.8.4.

PGLD and IRS also address the continuous monitoring control in the sections listed in the CA-1 references, IRM 10.5.1.8.4.

This is a joint security and privacy control about risk monitoring. For the full text of the control, see the CA-7 Continuous Monitoring section of IRM 10.8.1.

The privacy concerns are to monitor and address privacy risks.

Implementation guidance: The IRS implements this control by monitoring risks identified in PCLIAs, BPRAs, POA&Ms, and other assessment practices.

In this IRM, PGLD policies on the risk monitoring control include, but are not limited to, the sections listed in the CA-1 references, IRM 10.5.1.8.4.

PGLD and IRS also address the risk monitoring control in the sections listed in the CA-1 references, IRM 10.5.1.8.4.

This is a joint security and privacy control about impact analyses. For the full text of the control, see the CM-4 Impact Analyses section of IRM 10.8.1.

The privacy concerns are determining how potential changes to a system create new risks to the privacy of individuals and the ability of implemented controls to mitigate those risks.

Implementation guidance: The IRS implements this control by reviewing Major Change Determinations (MCDs) and updating PCLIAs.

In this IRM, PGLD policies on the impact analyses control include, but are not limited to, the sections listed in the CA-1 references.

PGLD and IRS also address the impact analyses control in the sections listed in the CA-1 references.

This is a joint security and privacy control about incident response training. For the full text of the control, see the IR-2 Incident Response Training section of IRM 10.8.1.

The privacy concerns are that IRS personnel need to know who to call or how to recognize an incident or a breach.

Implementation guidance: The IRS implements this control by providing mandatory training on Incident Management that is updated annually, and IM conducts a tabletop annually per OMB M-17-12.

In this IRM, PGLD policies on the incident response training control include, but are not limited to, the sections listed in the IR-1 references, IRM 10.5.1.8.6.

PGLD and IRS also address the incident response training control in the following:

Provide incident response training on how to identify and respond to a breach, including the organization’s process for reporting a breach. [NIST SP 800-53]

The privacy concerns are that IRS personnel need to know who to call or how to recognize a breach involving PII.

Implementation guidance: The IRS implements this control by providing mandatory training that includes information on how to identify and respond to a breach. The training includes links to how to respond to a breach.

In this IRM, PGLD policies on the breach control include, but are not limited to, the sections listed in the IR-1 references, IRM 10.5.1.8.6.

PGLD and IRS also address the breach control in the following:

This is a joint security and privacy control about incident response testing. For the full text of the control, see the IR-3 Incident Response Testing section of IRM 10.8.1.

The privacy concerns are that IRS personnel test incident response capabilities to determine their effectiveness and identify potential weaknesses or deficiencies.

Implementation guidance: The IRS implements this control by testing the breach response plan annually in compliance with OMB M-17-12.

In this IRM, PGLD policies on the incident response testing control include, but are not limited to, the sections listed in the IR-1 references, IRM 10.5.1.8.6.

PGLD and IRS also address the incident response testing control in the following:

This is a joint security and privacy control about incident handling. For the full text of the control, see the IR-4 Incident Handling section of IRM 10.8.1.

The privacy concerns are the IRS has the capability to handle all types of incidents consistent with the incident response plan.

Implementation guidance: The IRS implements this control by coordinating incident handling with IM, Cyber, CSIRC, and other business units as needed.

In this IRM, PGLD policies on the incident handling control include, but are not limited to, the sections listed in the IR-1 references, IRM 10.5.1.8.6.

PGLD and IRS also address the incident handling control in the following:

This is a joint security and privacy control about incident monitoring. For the full text of the control, see the IR-5 Incident Monitoring section of IRM 10.8.1.

The privacy concerns are the IRS tracks and documents incidents.

Implementation guidance: The IRS implements this control by using a tracking system.

In this IRM, PGLD policies on the incident monitoring control include, but are not limited to, the sections listed in the IR-1 references, IRM 10.5.1.8.6.

PGLD and IRS also address the incident monitoring control in the following:

This is a joint security and privacy control about incident reporting. For the full text of the control, see the IR-6 Incident Reporting section of IRM 10.8.1.

The privacy concerns are that the IRS reports incidents or breaches.

Implementation guidance: The IRS implements this control by requiring all personnel report when an incident or breach occurs.

In this IRM, PGLD policies on the incident reporting control include, but are not limited to, the sections listed in the IR-1 references, IRM 10.5.1.8.6.

PGLD and IRS also address the incident reporting control in the following:

This is a joint security and privacy control about incident response assistance. For the full text of the control, see the IR-7 Incident Response Assistance section of IRM 10.8.1.

The privacy concerns are that IRS provides a support resource that offers advice and assistance to personnel for the handling and reporting of incidents.

Implementation guidance: The IRS implements this control by offering a hotline.

In this IRM, PGLD policies on the incident response assistance control include, but are not limited to, the sections listed in the IR-1 references, IRM 10.5.1.8.6.

PGLD and IRS also address the incident response assistance control in the following:

This is a joint security and privacy control about incident response plan. For the full text of the control, see the IR-8 Incident Response Plan section of IRM 10.8.1.

The privacy concerns are that IRS develop and implement a coordinated approach to incident response.

Implementation guidance: The IRS implements this control by following Document 13347, Data Breach Response Playbook, and Document 13347-A, IRS Data Breach Response Plan.

In this IRM, PGLD policies on the incident response plan control include, but are not limited to, the sections listed in the IR-1 references, IRM 10.5.1.8.6.

PGLD and IRS also address the incident response plan control in the following:

Include the following in the Incident Response Plan for breaches involving personally identifiable information:

The privacy concerns are that IRS develop and implement a coordinated approach to incidents.

Implementation guidance: The IRS implements this control by following Document 13347, Data Breach Response Playbook, and Document 13347-A, IRS Data Breach Response Plan.

In this IRM, PGLD policies on the breaches control include, but are not limited to, the sections listed in the IR-1 references, IRM 10.5.1.8.6.

PGLD and IRS also address the breaches control in the following: