United States Government Publishing Office publisher pbl distributor dst United States Government Accountability Office Accounting and Information Management Division author aut Government Organization text government publication eng GAOREPORTS Legislative Agency Publications gao legislative 2010-08-12 U.S. Government Printing Office 1997-04-08 monographic deposited born digital 35 p. GA 1.13:AIMD-97-49 https://www.govinfo.gov/app/details/GAOREPORTS-AIMD-97-49 P0b002ee18038390f f:ai97049 DGPO 2010-08-12 2011-03-23 GAOREPORTS-AIMD-97-49 machine generated eng fdlp REPORT GAOREPORTS-AIMD-97-49 AIMD-97-49 Computer security Tax information confidentiality Federal employees Confidential communication Internal controls Emergency preparedness Personnel management Electronic forms Data storage Tax returns IRS Electronic Audit Research Log System IRS Integrated Data Retrieval System IRS Distributed Input System IRS Integrated Collection System IRS Totally Integrated Examination System Letter Report AIMD Pursuant to a congressional request, GAO reviewed the Internal Revenue Service's (IRS) computer security, focusing on whether IRS is effectively: (1) managing computer security; and (2) addressing employee browsing of electronic taxpayer data.<p/>GAO noted that: (1) over the last 3 years, GAO has reported on a number of computer security problems at IRS and has made recommendations for strengthening IRS' computer security management effectiveness; (2) nevertheless, IRS continues to have serious weaknesses in the controls used to safeguard IRS computer systems, facilities, and taxpayer data; (3) GAO's recent on-site reviews of security at five facilities disclosed many weaknesses in the areas of physical security, logical security, data communications management, risk analysis, quality assurance, internal audit and security, security awareness, and contingency planning; (4) for example, the five facilities could not account collectively for approximately 6,400 missing units of magnetic storage media, such as tapes and cartridges, which could contain taxpayer data; (5) in addition, printouts containing taxpayer data were left unprotected and unattended in open areas of two facilities where they could be compromised; (6) also, none of the facilities visited had comprehensive disaster recovery plans, which threaten the facilities' ability to restore operations following emergencies or natural disasters; (7) one area of unauthorized access that has been the focus of considerable attention is electronic browsing of taxpayer data by IRS employees; (8) despite this attention, IRS is still not effectively addressing the problem via thorough employee monitoring, accurate recording of browsing violations, or consistent application and publication of enforcement actions; (9) for example, IRS currently does not monitor all employees with access to automated systems and data for electronic browsing activities; (10) in addition, when instances of browsing are identified, IRS does not consistently investigate them or publicize them to deter others from browsing, and does not consistently punish browsers; and (11) until these serious weaknesses are corrected, IRS runs the risk of its tax processing operations being disrupted and taxpayer data being improperly used, modified, or destroyed. https://www.govinfo.gov/content/pkg/GAOREPORTS-AIMD-97-49/html/GAOREPORTS-AIMD-97-49.htm https://www.govinfo.gov/content/pkg/GAOREPORTS-AIMD-97-49/pdf/GAOREPORTS-AIMD-97-49.pdf GAO/AIMD-97-49 https://www.govinfo.gov/app/details/GAOREPORTS-AIMD-97-49 Letter Report GAO/AIMD-97-49; IRS Systems Security: Tax Processing Operations and Data Still at Risk Due to Serious Weaknesses; Computer security Tax information confidentiality Federal employees Confidential communication Internal controls Emergency preparedness Personnel management Electronic forms Data storage Tax returns IRS Electronic Audit Research Log System IRS Integrated Data Retrieval System IRS Distributed Input System IRS Integrated Collection System IRS Totally Integrated Examination System Volume 101 Page 1724 101 Stat. 1724 Public Law 100-235