PGLD works with other Business Units to provide the IRS with the tools and resources necessary to protect sensitive taxpayer and employee data from potential identity theft due to IRS incidents involving the loss or theft of IRS IT assets and Bring Your Own Device (BYOD) assets containing SBU data, including PII and tax information; the loss or theft of physical and electronic documents that include SBU data, including PII and tax information; and inadvertent unauthorized disclosures of SBU data, including PII and tax information.

PGLD also leads IRS privacy and records policies, coordinates privacy protection guidance and activities, responds to privacy complaints, and promotes data protection awareness throughout the IRS.

Since September 2007, the IM Office (previously known as the ITIM Office) in PGLD (previously known as PIPDS) has been responsible for administering and managing IRS program requirements by ensuring IRS incidents involving the loss or theft of IRS IT assets and BYOD assets containing SBU data, including PII and tax information; the loss or theft of physical and electronic documents that include SBU data, including PII and tax information; and inadvertent unauthorized disclosures of SBU data, including PII and tax information, are investigated, analyzed and resolved by PGLD/IM.

IM is dedicated to assisting taxpayers and government employees potentially impacted by IRS incidents involving SBU data, including PII and tax information, by working quickly and thoroughly to investigate the incidents to decrease the possibility that the information will be compromised and used to perpetrate identity theft or other forms of harm. See IRM 10.5.4.4.4, PGLD/Incident Management Risk Assessment, and Exhibit 10.5.4-1, Glossary of Incident Management Terms, Definitions, and Acronyms, for additional information about, and examples of, harm/risk of harm.

IM manages the reporting, risk assessment, and tracking of IRS incidents involving SBU data, including PII and tax information, as well as notification to potentially impacted individuals.

IM has the following responsibilities related to administering the Incident Management Program in the IRS:

Containment. The BU data owner must take immediate action to contain the incident or data breach to prevent any further PII exposure, e.g., if employee or taxpayer data is inadvertently exposed on the internet, the BU data owner must immediately take steps to remove the data and/or close the access; or, if DVDs have been shared with material that should have been redacted, the BU must take steps to immediately recover them and request the recipient remove public access (if the information was made publicly available) and replace it with the proper data. The BU should contact Cybersecurity’s Online Fraud Detection and Prevention Office if assistance is required to contain a data breach involving an electronic transmission such as email or a data breach involving the posting of information on the internet. Additional actions related to containment will depend on the nature of the breach and may involve other BUs as needed.

Mitigation. The BU data owner must analyze the event circumstances to mitigate or lessen the impact of the incident or data breach. Necessary actions may include requesting the person who erroneously received a notice, letter, or transcript, to return or destroy it; asking the incorrect recipient of a fax, EEFax, email, etc., to destroy or delete it; or asking the person who received an erroneously addressed or misdelivered shipment to secure the shipment and await collection by an IRS employee. Necessary actions by the BU may also include physically recovering hardcopy documents or coordinating with TIGTA to ensure all recovery options are considered.

Prevention. The BU data owner must determine the necessary steps to prevent similar incidents or data breaches in the future. This could entail investigating the cause of the incident or data breach and developing a prevention plan if necessary. A prevention plan may include a security audit of both physical and technical security, a review and/or development of policies and procedures, and a review of employee training.

Providing Requested Information. The reporting employee or BU data owner must provide all information requested by PGLD/IM, e.g., complete, unredacted SSNs, names, dates, etc., within two business days of request to ensure timely reporting and taxpayer notification. If a delay is likely, contact IM at 267-466-0777 to facilitate next steps.

Disciplinary Actions. Discipline can result for failure to protect equipment or information, as well as for a manager’s failure to supervise and train as it pertains to PII information. A BU data owner whose employee experiences a data loss, theft, or disclosure, or asset loss or theft, because the employee did not properly safeguard the data or asset, must contact the servicing Labor Relations Specialist to discuss the appropriateness of any disciplinary action. For disciplinary actions related to losses or thefts of laptops or other electronic devices, or the loss, theft or disclosure of SBU data, including PII and tax information, and improperly safeguarding electronic or paper records, see Document 11500, IRS Manager’s Guide to Penalty Determinations, and IRM 6.751.1, Discipline and Disciplinary Actions: Policies, Responsibilities, Authorities, and Guidance.

Contacting Potentially Impacted Individuals to Request Replacement Documents. Although PGLD/IM notifies the potentially impacted individuals of an IRS data breach if it’s determined there’s a potential risk of harm to the individuals as a result of the data breach (such as the potential for identity theft), the BU data owner is responsible for contacting the potentially impacted individuals if an original document, or remittance (such as a personal check), was lost, stolen, or destroyed, to explain that the original document or remittance was lost, stolen, or destroyed, and to request that the individual resend the document or remittance. Established functional taxpayer contact processes must be followed when requesting replacement documents or remittances from the potentially impacted individuals. See IRM 10.5.4.4.4, PGLD/Incident Management Risk Assessment, and Exhibit 10.5.4-1, Glossary of Incident Management Terms, Definitions, and Acronyms, for additional information about, and examples of, harm/risk of harm.

Quarterly Scorecard Report. The Quarterly Scorecard Reports (in PDF format) list the number of reported data breaches received by PGLD/IM per quarter per Business Operating Division (BOD). The Reports, which are shared with each respective BOD, provide an analysis of all reported data breaches identified as a loss, theft, or inadvertent unauthorized disclosure based on the type of asset, location, and risk assessment code. The Quarterly Scorecard Report is also shared with the Privacy Compliance office in PGLD to determine if there are any processes for which a Business PII Risk Assessment (BPRA) can be performed. The BPRA is used to identify vulnerabilities and make recommendations for changes to improve IRS security and privacy policies and practices. A separate Quarterly Scorecard Report capturing the performance of the IRS overall is also provided to each BOD. The IRS Quarterly Scorecard Report provides an analysis of all reported data breaches identified as a loss, theft, or inadvertent unauthorized disclosure as well as those identified as other, such as Private Debt, SPIIDE, UNAX, etc.

Quarterly E-Trak Data Extract Report. The e-Trak Data Extract Reports (in Excel format), which list the losses, thefts, and inadvertent unauthorized disclosures reported to PGLD/IM per BOD, is usually provided quarterly but can be provided more frequently (such as monthly) upon request by the BOD. The extract provides an analysis of all reported data breaches identified as a loss, theft, or inadvertent unauthorized disclosure based on the type of asset, location, reporting employee, and risk assessment code.

Weekly Code Red Recommendations Reports. The Code Red Recommendations Report lists data breaches potentially impacting individuals likely to be at risk of identity theft or other harm due to the loss, theft, or disclosure of PII. The Report is presented to the PII Working Group weekly by PGLD/IM for information only; no concurrence or approval by the PII Working Group (PIIWG) is required.

PGLD/IM conducts quarterly Operational Reviews to evaluate key performance measures to ensure agency program requirements are met.

PGLD/IM uses established Business and Organizational measures to measure the timeliness of IRS data breach notifications.

PGLD/IM uses the Quarterly Scorecard Report which contains information from e-Trak (a web interface for case tracking) to assess Business Unit and IRS performance.

PGLD/IM reconciles redeemed identity protection/identity monitoring codes monthly to ensure the codes assigned to potentially impacted individuals via Letter 4281C were redeemed by the individuals to whom they were assigned before the monthly invoice is paid.

PGLD/IM generates a Code Red Recommendations Report weekly listing the data breaches deemed to be Code Red (data breaches requiring notifications) to notify the PPC Director and the IMEP Associate Director of the data breaches pending notification.

PGLD/IM reviews all PII Breach Reporting Forms and alerts the Records and Information Management (RIM) Program Office if official records have been reported as lost, stolen, or destroyed on the PII Breach Reporting Form in accordance with IRM 1.15.3.4, Unauthorized Disposition of Records, and 36 CFR 1230, Unlawful or Accidental Removal, Defacing, Alteration, or Destruction of Records.

An incident involving the loss or theft of an IRS IT asset or BYOD asset containing PII, or the loss or theft of a physical document that includes PII, or the inadvertent unauthorized disclosure of PII, is known as a data breach. See the Data Breach definition below. Often, an occurrence may be first identified as an incident, but later identified as a data breach once it is determined that the incident involves PII, as is often the case with a lost or stolen laptop or electronic storage device.

A data breach is not limited to an occurrence where a person other than an authorized user potentially accesses PII by means of a network intrusion, a targeted attack that exploits website vulnerabilities, or an attack executed through an email message or attachment. A data breach may also include the loss or theft of physical documents that include PII and portable electronic storage media that store PII, the inadvertent disclosure of PII on a public website, or an oral disclosure of PII to a person who is not authorized to receive that information. It may also include an authorized user accessing PII for an other than authorized purpose. Often, an occurrence may first be identified as an incident, but later identified as a data breach once it’s determined that the incident involves PII, as is often the case with a lost or stolen laptop or electronic storage device.

Some common examples of a data breach include:

Any incident that is likely to result in demonstrable harm to the national security interests, foreign relations, or the economy of the United States, or to the public confidence, civil liberties, or public health and safety of the American people; or,

A breach that involves personally identifiable information (PII) that, if exfiltrated, modified, deleted, or otherwise compromised, is likely to result in demonstrable harm to the national security interests, foreign relations, or the economy of the United States, or to the public confidence, civil liberties, or public health and safety of the American people.

Records. The term "records" includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them. (44 USC 3301).

Unauthorized Destruction. Unauthorized destruction is the removal from the legal custody of the Federal Government or the alienation, alteration, or mutilation of records without regard to the provisions of IRS Records Control Schedules (RCS 8 through 37) located in IRS Document 12990, Records and Information Management Records Control Schedules (Catalog 57910D), and General Records Schedules (GRS) located in IRS Document 12829, General Records Schedules (Catalog 54713E).

Reporting to NARA. Per 36 CFR 1230.14, How do agencies report incidents?, all federal agencies must report promptly any unlawful or accidental removal, defacing, alteration, or destruction of records in the custody of that agency to the National Archives and Records Administration (NARA). The IRS Records Officer reports any IRS incidents of erroneous records destruction to NARA.

The term PII refers to information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.

Some examples of PII are: name, such as full name, maiden name, mother’s maiden name, alias, or name control (first four letters of last name); address information, such as street address or email address; a unique set of numbers or characters assigned to a specific individual, such as telephone numbers, Social Security number (or last four digits of SSN), passport number, driver’s license number, email or Internet Protocol (IP) address, or Standard Employee Identifier (SEID); personal characteristics and data, such as date and place of birth, age, height, or weight; and biometric information such as x-rays, fingerprints, retina scan, or DNA.

For more information about PII and additional examples, visit the Personally Identifiable Information page in the Disclosure and Privacy Knowledge Base Site; see IRM 10.5.1, Privacy and Information Protection, Privacy Policy; and IRM 10.8.1.3.16.1.3, Personally Identifiable Information (PII).

SBU data includes, but is not limited to: Federal Tax Information (FTI), Personally Identifiable Information (PII), Protected Health Information (PHI), certain procurement information, system vulnerabilities, case selection methodologies, systems information, enforcement procedures, and investigation information.

SBU data includes categories of protected information which many IRS personnel handle on a daily basis, such as PII and tax information. It also includes other categories, such as procurement (which can include general procurement and acquisition, small business research and technology, and source selection) and system information (which can include critical infrastructure categories like information systems vulnerability information, physical security, and emergency management).

For more information about SBU, visit the Sensitive But Unclassified (SBU) Data page in the Disclosure and Privacy Knowledge Base Site and IRM 10.5.1, Privacy and Information Protection, Privacy Policy.

Return information includes, but is not limited to, a taxpayer’s: identity; income, payments, deductions, exemptions, or credits; assets, liabilities, or net worth; and tax liability investigation status (whether the IRS ever investigates or examines the return).

Redacting, masking, truncating, or sanitizing tax information does not change its nature. It’s still tax information.

Tax information in IRS business processes comes under many names, such as FTI, IRC 6103 protected information, taxpayer data, taxpayer information, tax return information, return information, case information, SBU data, and PII.

Tax information is SBU data. IRC 6103 protects tax information from unauthorized disclosure. When tax information relates to an individual, that SBU data is also PII.

Release of tax information (whether of an individual or business) is restricted by the confidentiality provisions of IRC 6103(a).

For more information about tax information, see IRM 10.5.1, Privacy and Information Protection, Privacy Policy.

The Disclosure and Privacy Knowledge Base Site

The Report Losses, Thefts or Disclosures page in the Disclosure and Privacy Knowledge Base Site

The If/Then Guide for Reporting Incidents and Data Breaches which is listed in the Other Related Resources section of the Report Losses, Thefts or Disclosures page in the Disclosure and Privacy Knowledge Base Site

Document 13347, Data Breach Response Playbook

Document 13347-A, IRS Data Breach Response Plan

Document 13056, Shipping Procedures for Personally Identifiable Information (PII)

Document 13144, Proper PII Shipping Procedures

M-06-15, Safeguarding Personally Identifiable Information, May 22, 2006. This Memorandum was rescinded and replaced by OMB Memorandum M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information.

M-06-16, Protection of Sensitive Agency Information, June 23, 2006. This Memorandum was rescinded by OMB Memorandum M-17-15, Rescission of Memoranda Relating to Identity Management.

M-06-19, Reporting Incidents Involving Personally Identifiable Information and Incorporating the Cost for Security in Agency Information Technology Investments, July 12, 2006. This Memorandum was rescinded and replaced by OMB Memorandum M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information.

M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007. This Memorandum was rescinded and replaced by OMB Memorandum M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information.

M-12-18, Managing Government Records Directive, November 28, 2011. This Memorandum was rescinded by OMB Memorandum M-19-21, Transition to Electronic Records.

M-16-04, Cybersecurity Strategy and Implementation Plan (CSIP) for the Federal Civilian Government, October 30, 2015. This Memorandum was rescinded by OMB Memorandum M-19-03, Strengthening the Cybersecurity of Federal Agencies by enhancing the High Value Asset Program.

M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, January 3, 2017. This Memorandum rescinded and replaced OMB Memoranda M-07-16, M-06-19, M-06-15, and Recommendations for Identity Theft Related Data Breach Notification (September 20, 2006).

M-19-03, Strengthening the Cybersecurity of Federal Agencies by enhancing the High Value Asset Program, December 10, 2018. This Memorandum consolidated and updated previous requirements from OMB Memorandum M-16-04, Cybersecurity Strategy and Implementation Plan (CSIP) for the Federal Civilian Government, and OMB Memorandum M-17-09, Management of Federal High Value Assets.

M-19-21, Transition to Electronic Records, June 28, 2019. This memorandum rescinded OMB Memorandum M-12-18, Managing Government Records Directive.

M-23-03, Fiscal Year 2023 Guidance on Federal Information Security and Privacy Management Requirements, December 2, 2022.

M-23-07, Update to Transition to Electronic Records, December 23, 2022.

The Federal Information Security Modernization Act of 2014 (FISMA) (Pub. L. No. 113-283, Title II), December 2014, amended the Federal Information Security Management Act of 2002 (FISMA) to: (1) reestablish the oversight authority of the Director of the Office of Management and Budget (OMB) with respect to agency information security policies and practices, and (2) set forth authority for the Secretary of Homeland Security (DHS) to administer the implementation of such policies and practices for information systems.

The President’s Identity Theft Task Force created a strategic plan to combat identity theft. The documents are available on the Federal Trade Commission website under News and Events/Press Releases at https://www.ftc.gov/news-events/press-releases/2007/04/presidents-identity-theft-task-force-releases-comprehensive. See The President’s Identity Theft Task Force Report, Combating Identity Theft: A Strategic Plan, (April 2007), and The President’s Identity Theft Task Force Report, Combating Identity Theft, Volume II: Supplemental Information, (April 2007), both located at https://www.ftc.gov/reports/combating-identity-theft-strategic-plan, and The President’s Identity Theft Task Force Report, September 2008, https://www.ftc.gov/sites/default/files/documents/reports/presidents-identity-theft-task-force-report/081021taskforcereport.pdf.

Treasury Directive 85-01, Department of the Treasury Information Technology (IT) Security Program, dated March 10, 2008, https://home.treasury.gov/about/general-information/orders-and-directives/td85-01, authorized the issuance of Treasury Department Publication (TD P) 85-01, Treasury Information Technology Security Program, which contains Department-wide IT security requirements and supporting guidance. Per TD P 85-01, dated December 12, 2017, "The primary purpose of the Treasury IT Security Program is to establish comprehensive, uniform cybersecurity policies and standards for the protection of Departmental assets. The IT Security Program serves as a foundation for the bureaus to use for their cybersecurity programs and in developing supplemental, bureau-specific policies, requirements, and operating directives." See also TD P 85-01 Appendix A, Minimum Standard Parameters for Non-National Security Information and Information Systems.

Treasury Directive 25-08, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, dated December 22, 2009, https://home.treasury.gov/about/general-information/orders-and-directives/td25-08, established the Department of the Treasury’s PII protection and breach response and notification policy and plan. This directive also authorized the issuance of a handbook or other guidance to implement this policy.

Treasury’s Departmental Incident Response Plan, dated October 10, 2018, established Departmental incident response (IR) procedures. Section 1.4, Authority Establishment, states, "IR procedures for addressing incidents concerning a breach of personally identifiable information (PII) are established in accordance with OMB-M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information."

IRM 10.5.1, Privacy and Information Protection, Privacy Policy

IRM 10.5.5, Privacy and Information Protection, Unauthorized Access, Attempted Access or Inspection of Taxpayer Records (UNAX) Program Policy, Guidance and Requirements

IRM 1.15, Records and Information Management

IRM 11.3, Disclosure of Official Information

IRM 10.5.6, Privacy and Information Protection, Privacy Act

IRM 1.1.27, Organization and Staffing, Privacy, Governmental Liaison and Disclosure (PGLD)

The Office of Privacy, Governmental Liaison and Disclosure (PGLD) Incident Management Office (IM). Report the data breach to PGLD/IM using the PII Breach Reporting Form if the data breach involves: erroneous taxpayer correspondence involving the disclosure of SBU data, including PII and tax information, i.e., a notice, letter, or transcript, which was mailed, emailed, faxed, EEFaxed, or generated or transmitted via the Income Verification Express Service (IVES), Return and Income Verification Services (RAIVS), Transcript Delivery System (TDS), Secure Data Transport (SDT), or other electronic transmission, to the wrong address or addressee; or notices, letters, transcripts, faxes, or other electronic/digital documents sent with mixed entity information such as correct taxpayer information is on page one, but unrelated taxpayer information is on page two; two letters for different taxpayers in the same envelope; the attachment in the correspondence is for a different taxpayer, etc.; or an inadvertent unauthorized disclosure of SBU data, including PII and tax information, such as a verbal disclosure, or an email sent to the wrong person or not properly encrypted; or the loss, theft, or unauthorized destruction of documents containing SBU data, including PII and tax information, such as hardcopy records, documents, or case files, packages lost or stolen during UPS or FedEx shipment, or lost or stolen remittances; or an electronic disclosure of SBU data, including PII and tax information, in IRMs, Training Materials, PowerPoints, IRS Source, SharePoint, etc., or on external systems/sites such as WhatsApp, GitHub, etc.

The Situational Awareness Management Center (SAMC). Report the incident to SAMC (within 30 minutes) using the Incident Reporting Link and selecting the button, Report a New Physical Incident, if the incident involves the loss or theft of Identification (ID) Media, including SmartID cards, Physical Access Control (PAC) cards, Pocket Commissions (credentials), etc., building access cards, building or room keys, legacy ID cards, government property or equipment, or physical security incidents and/or threats. See IRM 10.2.5, Physical Security Program, Identification Media, and IRM 10.2.8, Physical Security Program, Incident Reporting, or visit the Facilities Management and Security Services FMSS Incident Reporting page for additional reporting requirements and to learn more about FMSS and SAMC.

The Computer Security Incident Response Center (CSIRC). Report the incident/data breach to CSIRC using the Computer Security Incident Reporting Form, or by calling CSIRC at 240-613-3606, if the incident/data breach involves: the loss or mishandling of IRS information technology resources; or the loss or theft of an IRS IT asset, e.g., an IRS issued computer, laptop, router, printer, cell phone, BlackBerry, or removable storage media (CD/DVD, flash drive, floppy, etc.); or the loss or theft of a non-government furnished/personally owned mobile device that accesses, processes, transmits, or stores IRS information, in support of the Bring Your Own Device (BYOD) program; or an IRS IT asset or BYOD asset lost or stolen during UPS or FedEx shipment.

CSIRC will report incidents to TCSIRC for assessment and reporting to the United States Computer Emergency Readiness Team (US-CERT) as necessary.

For data breaches reported to PGLD/IM through the online reporting tool, IM will report to TCSIRC data breaches meeting Treasury’s reporting requirements.

The PPC Director in PGLD will coordinate with Treasury when additional reporting may be required to law enforcement, oversight entities, or Congress.

An IRS employee follows all procedures to verify the identity of a caller before disclosing any information, only to later find that he or she is not talking to the taxpayer or the taxpayer’s authorized representative. The employee terminates the call at that point without disclosing any further information.

An IRS employee faxes return information as requested by a taxpayer or authorized representative. The employee follows all established procedures for faxing SBU data, including PII and tax information, only to later find that the fax number provided by the taxpayer or authorized representative was incorrect.

An IRS employee follows all established procedures for locating a potential new address for a taxpayer, and a letter is generated to that address in an attempt to contact the taxpayer. A person who receives the correspondence at that address contacts the IRS to say the individual does not live there.

The IRS sends correspondence to the last known address of a taxpayer. A person who receives the correspondence at that address contacts the IRS to say the individual does not live there.

An IRS employee follows procedures in IRM 21.1.3.12, Suicide Threats, to disclose a taxpayer's name, address/location, and/or telephone number to Law Enforcement because the taxpayer threatened suicide and/or threatened harm to another individual. In this situation, the disclosure of this information is not prohibited by law; therefore, although the Suicide Threat must be reported to Disclosure, TIGTA, SAMC, and the Office of Employee Protection, no reporting to PGLD/IM is necessary unless directed to do so by Disclosure. See IRM 21.1.3.12, Suicide Threats, IRM 10.2.8, Physical Security Program, Incident Reporting, IRM 11.3.34.3, Expedited Procedures in Emergency Situations, and the Governmental Liaison, Disclosure and Safeguards (GLDS) Unique Situations page for the procedures to follow when a taxpayer threatens suicide or when it is appropriate to contact the local Law Enforcement authority versus federal or State Law Enforcement authorities.

A data breach is reported to PGLD/IM via PGLD’s PII Breach Reporting Form if the data breach involves erroneous taxpayer correspondence involving the disclosure of SBU data, including PII and tax information, i.e., a notice, letter, or transcript, which was mailed, emailed, faxed, EEFaxed, or generated or transmitted via IVES, RAIVS, TDS, SDT, or other electronic transmission, to the wrong address or addressee; or notices, letters, transcripts, faxes, or other electronic/digital documents sent with mixed entity information such as correct taxpayer information is on page one, but unrelated taxpayer information is on page two; two letters for different taxpayers in the same envelope; the attachment in the correspondence is for a different taxpayer, etc.; or an inadvertent unauthorized disclosure of SBU data, including PII and tax information, such as a verbal disclosure, or an email sent to the wrong person or not properly encrypted; or the loss, theft, or unauthorized destruction of documents containing SBU data, including PII and tax information, such as hardcopy records, documents, or case files, packages lost or stolen during UPS or FedEx shipment, or lost or stolen remittances; or an electronic disclosure of SBU data, including PII and tax information, in IRMs, Training Materials, PowerPoints, IRS Source, SharePoint, etc., or on external systems/sites such as WhatsApp, GitHub, etc.

An incident/data breach is reported to CSIRC via CSIRC’s Computer Security Incident Reporting Form if the incident/data breach involves the loss or mishandling of IRS information technology resources, or the loss or theft of an IRS IT asset or an asset in the Bring Your Own Device (BYOD) program, or an IRS IT asset or BYOD asset lost or stolen during UPS or FedEx shipment, or if it involves multiple assets, i.e., an IRS IT asset or BYOD asset and hardcopy records or documents containing SBU data, including PII and tax information. Note that the form and instructions for incidents/data breaches involving IT assets are different from the forms and instructions for all other data breaches.

An incident is reported to SAMC via SAMC’s Incident Reporting Link if the incident involves the loss or theft of ID media, including SmartID cards, PAC cards, Pocket Commissions (credentials), etc., building access cards, building or room keys, legacy ID cards, government property or equipment, or physical security incidents and/or threats. Note the reporting requirement time frame for SAMC is within 30 minutes of discovery.

The *PII mailbox is a centralized communication tool used by PGLD/IM to send and receive all communications throughout the data breach intake process. Data breach summaries with a brief description of the data breach are automatically sent via email to the *PII mailbox whenever data breaches are reported to CSIRC via the Computer Security Incident Reporting Form or to PGLD/IM via the PII Breach Reporting Form.

The PGLD/IM and CSIRC Breach/Incident Reporting Forms provide an inventory of possible compromised data elements, the source of the data, whether the data was encrypted, and any other special factors that need to be considered, such as data being used in a criminal or grand jury investigation.

The Impacted Individuals and/or Business Excel Spreadsheet provides an inventory of the names and TINs of all the individuals potentially impacted by the data breach.

Customers: Affects a significant number of individuals or high-profile individuals;

Business Results: Overwhelming increase of phone traffic, reduced taxpayer access to IRS systems or online applications, negative affect on revenue protection; or,

IRS Reputation: Potential for extensive media involvement, congressional interest, or negative exposure.

Cybersecurity may identify a potential breach of an IRS system or application.

PGLD or another BU may identify a loss, theft, or disclosure of SBU data, including PII and tax information, with unusual circumstances.

A third-party data owner may identify a breach of SBU data, including PII and tax information.

Notify PGLD and IRS senior management as needed.

Take immediate action to contain potential data leakage and mitigate risk, such as engaging Cybersecurity’s Online Fraud Detection and Prevention (OFDP) Office to deactivate a fraudulent website; recovering hardcopy documents; or coordinating with TIGTA to ensure all recovery options are considered.

Identify members needed for a Breach Response Team (BRT) or Working Group (WG).

Notify the Department of Treasury as applicable.

The High-Risk Data Breach Quick Reference Guide contains the high-level process to follow when a high-risk data breach is identified.

Document 13347, Data Breach Response Playbook, contains detailed procedures on the proper steps to take if your area has a high-risk data breach to help you minimize harm to taxpayers, document the data breach, and manage the risk assessment process.

Step 1: Examine key factors. Each of the three factors identified by OMB Memorandum M-17-12 (the nature and sensitivity of the PII potentially compromised by the data breach; the likelihood of access and use of the PII potentially compromised by the data breach; and the type of data breach) is assessed in relation to the specific data breach to determine the potential likelihood of harm to individuals. See (4) below for additional information on the risk assessment factors.

Step 2: Determine risk factor ratings. Each of the three factors is rated based on its impact level (high, moderate, low, or no impact) with corresponding points from 3 to 0 assigned to each impact level.

Step 3: Categorize or classify the data breach. Based on the total factor rating points the data breach is categorized into one of four levels. Data breaches with a total factor rating point between 8 and 9 are considered Level Three (High Impact). Potentially impacted individuals involved in a data breach categorized as Level Three (High Impact) will be sent a data breach notification letter.

Nature and Sensitivity of the PII. The nature and sensitivity of the PII potentially compromised by the data breach, including the potential harms that an individual could experience from the loss or compromise of the type of PII. At a minimum, the following items are considered when assessing the nature and sensitivity of the PII potentially compromised by a data breach: Data Elements, including an analysis of the sensitivity of each individual data element as well as the sensitivity of all the data elements together; Context, including the purpose for which the PII was collected, maintained, and used; Private Information, including the extent to which the PII, in a given context, may reveal particularly private information about an individual or constitutes information that an individual would generally keep private; Vulnerable Populations, including the extent to which the PII identifies or disproportionately impacts a particularly vulnerable population; and Permanence, including the continued relevance and utility of the PII over time and whether the information is easily replaced or substituted or will permanently identify an individual.

Likelihood of Access and use of the PII. The likelihood of access and use of the PII potentially compromised by the data breach, including whether the PII was properly encrypted, or rendered partially or completely inaccessible by other means. The following items are considered when assessing the likelihood of access and use of PII potentially compromised by a data breach: Security Safeguards, including whether the PII was properly encrypted, or rendered partially or completely inaccessible by other means; Format and Media, including whether the format of the PII or the media on which it is maintained may make it difficult and resource-intensive to use; Duration of Exposure, including how long the PII was exposed; and Evidence of Misuse, including any evidence confirming that the PII is being misused, or that it was never accessed.

Type of Data Breach. The type of data breach, including the circumstances of the data breach, as well as the actors involved and their intent. The following items are considered when determining the type of data breach: Intent, including whether the PII was compromised intentionally, unintentionally, or whether the intent is unknown; and Recipient, including whether the PII was disclosed to a known or unknown recipient, and the trustworthiness of a known recipient.

The evaluation of an IRS data breach results in a likelihood of harm to the potentially impacted individuals. See IRM 10.5.4.4.4, PGLD/Incident Management Risk Assessment, and Exhibit 10.5.4-1, Glossary of Incident Management Terms, Definitions, and Acronyms, for additional information about, and examples of, harm/risk of harm.

Personal information was intentionally accessed or disclosed without authorization if the access or disclosure results in an administrative proposal of disciplinary or adverse action against an IRS employee but not criminal indictment.

To comply with OMB and Treasury Department directives which mandate notification to potentially impacted individuals if there is a potential risk that the compromised data may be used by someone other than the owner of the information to commit a crime or fraud.

To comply with IRC 7431 when there is an unauthorized access or disclosure resulting in an administrative proposal of disciplinary or adverse action against an employee.

To minimize the possible negative impact of the compromised data on the taxpayer/victim.

To ensure the IRS' relationship with the impacted individual(s) will not be so damaged as a result of the data breach that it negatively impacts his or her tax filing and paying obligations.

A dedicated toll-free telephone number staffed by trained IRS personnel to respond to general data breach-related inquiries

Information on websites and other resources providing information about identity theft prevention and protection

Coordination with Business Units on IRS data breaches that affect an individual's tax account, such as phishing schemes