Actions Have Been Taken to Improve Security Controls for the Planned Expanded Use of Login.gov; However, Additional Security Improvements Are Needed

Submitting OIG:

Treasury Inspector General for Tax Administration

Date Issued:

Tuesday, July 23, 2024

Agency Reviewed / Investigated:

Internal Revenue Service

Submitting OIG-Specific Report Number:

2024-200-032

Location(s):

Agency-Wide

Type of Report:

Audit

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

Report updated under NDAA 5274:

View Document:

Attachment	Size
2024200032fr.pdf	1.7 MB

Recommendation Number	Recommendation Status	Significant Recommendation
1	Open	No
Develop and periodically update consolidated guidance to comprise all audit trail data elements, including investigative elements provided by TIGTA Office of Investigations, that CSPs must capture and provide for IRS IAL2 applications.
2	Open	No
Ensure that a process is in place to validate that all audit trail data elements, including investigative elements provided by TIGTA Office of Investigations, are being captured and can be provided by Login.gov prior to using its identity proofing services for IRS IAL2 applications.
3	Open	No
The Chief Information Officer should ensure that DIRA guidance is updated to include a quality review process to help ensure that DIASs are accurate prior to issuance.
4	Open	No
Current continuous monitoring security review guidelines are followed by timely performing reviews of Login.gov artifacts, documenting the results in a monthly Continuous Monitoring Report, and timely submitting the report to the Authorizing Official for review as required.
5	Open	No
Appropriate IRS management works in conjunction with Login.gov management to assess the extent and impact that the critical vulnerability had on the users who authenticated via Login.gov to access IRS applications and may have had their Personally Identifiable Information sent to unauthorized locations outside of the United States.
6	Open	No
The Chief Information Officer should ensure that the FedRAMP continuous monitoring security review guidelines and report template are updated to ensure that the Continuous Monitoring Reports include essential report elements.

Recommendation Number

Recommendation Status

Significant Recommendation

Additional Details

Open

Develop and periodically update consolidated guidance to comprise all audit trail data elements, including investigative elements provided by TIGTA Office of Investigations, that CSPs must capture and provide for IRS IAL2 applications.

Open

Ensure that a process is in place to validate that all audit trail data elements, including investigative elements provided by TIGTA Office of Investigations, are being captured and can be provided by Login.gov prior to using its identity proofing services for IRS IAL2 applications.

Open

The Chief Information Officer should ensure that DIRA guidance is updated to include a quality review process to help ensure that DIASs are accurate prior to issuance.

Open

Current continuous monitoring security review guidelines are followed by timely performing reviews of Login.gov artifacts, documenting the results in a monthly Continuous Monitoring Report, and timely submitting the report to the Authorizing Official for review as required.