IRS Needs Better IT Security Plan, Inspector General Says

The report, written by assistant inspector general for audit Gordon Milbourn, says the IRS has prepared action plans and milestones to track program-level and system-level weaknesses, as required by the White House Office of Management and Budget.

But the process the IRS employs to identify weaknesses and report progress is flawed and ineffective, Milbourn writes. That means the information the IRS provides Treasury and has been inaccurate and misleading. Without effective action and milestone plans, Milbourn says, the IRS can't identify and monitor security weaknesses to ensure that the most significant weaknesses are addressed in a timely fashion.

Among the other observations the inspector general made:

• The IRS failed to provide sufficient emphasis and instill the discipline needed to assure it has a system in place to monitor security weaknesses. As a result, the IRS has reported only general weaknesses for its systems and overstated the actions it has taken to improve its security program. For the most recent plans submitted to Treasury in September, the IRS reported 319 system-level weaknesses for its 80 major IT systems. This number is understated because it represents only management-control limitations such as lack of a certification and accreditation, security plan, or tested contingency plan. Generally, operational and technical control weaknesses weren't reported.
• The agency prepared almost identical plans of action and milestones for each system, noting only broad control topics rather than specific weaknesses.
• Specific actions aimed at correcting the weaknesses weren't detailed, and responsible individuals weren't identified. "Essentially," Milbourn writes, "the [plans] were so vague they couldn't be used in managing and overseeing the security program."
• The IRS overstated progress in addressing the weaknesses. The IRS assumed if a system had been certified and accredited, then nearly all weaknesses noted about the system's plans of action and milestones could be closed. "This assumption isn't valid since certified and accredited systems can still have security weaknesses," Milbourn says. "We know of no testing that was done to identify security weaknesses or to ensure weaknesses were corrected."
• To ensure an effective system is established to monitor security weaknesses, the Inspector General's office recommends that the IRS chief of mission assurance and security services coordinate with the department's CIO and business-unit owners to develop plans that specifically identify all known security weaknesses.
• The IRS chief of mission assurance and security services agrees with the inspector general's recommendations, and has initiated a number of corrective actions. Among them, according to the inspector general's report, is establishing a working group of executives and senior staffers from business units and the agency's modernization and technology services unit to develop and implement an approach to managing the plans. In coordination with the CIO and business unit owners, the chief of mission assurance and security services will develop a plan to allow the reconciliation and validation of corrective actions through the testing process.