Open Recommendations

The Chief Information Officer, in conjunction with the Chief Operating Officer, should revise the DLP rules to be more restrictive to help prevent intentional data exfiltration.

The Chief Information Officer, in conjunction with the Chief Operating Officer, should continue to ensure that the managers and executives responsible for reviewing and approving BEARS ********************** requests carefully review all requests and only approve requests with sufficient and appropriate responses to the required questions.

Update Revenue Procedure 2013-14 to include the language found in the Treasury Regulation § 301.7216-3 that the consent statement must identify the purpose of disclosure and specific recipient(s).

Evaluate whether any clarifications or updates to Revenue Procedure 2013-14 or Treasury Regulation § 301.7216-3 are needed to address concerns or raise awareness of data sharing practices with tax software companies that use pixels.

The Chief Information Officer should ensure that the cloud system immediately completes its pilot program and that an ATO memorandum is approved for the system to remain in production.

The Chief Data and Analytics Officer should develop procedures to ensure that all CDW servers are included in configuration compliance scans as required.

Establish procedures and controls to ensure that the appropriate field in AIMS is updated to include the taxpayer’s reported TPI plus unreported income identified during the examination in order to develop a measure of post-audit TPI.

The Commissioner, LB&I Division, should review the Division’s examination procedures to determine whether changes are needed in support of effective tax administration for large complex taxpayers e.g., large multinational corporations. This should include, but not be limited to, the use of the Economic Substance Doctrine, Principles of Collaboration, and the CAP program.

Subsequently remind agencies with late-filed SSRs or CAPs of best practices at least 60 days prior to their next scheduled filing due date, and that they may request a filing extension at least 30 days before their scheduled due date if extenuating circumstances exist.

Offer standardized training to any new HOA on the safeguard review process and best practices for submitting agency documentation.

Update policies to require follow-up with State agencies concerning any unsubmitted mitigation plans after their mitigation plan due dates have passed.

Develop procedures to ensure that finding information is accurately documented in the PFR, the SRR, and eCase as well as that case updates, case notes, relevant correspondence, and mitigation plan receipt dates are accurately documented in eCase.

Send an annual reminder to all State agencies to notify staff of their responsibility to report data incidents within 24 hours of identification.

Apply the RRA 98 § 1204(b) retention standard when evaluating IRS Collection employees, managers, and executives who intentionally disregard IRS policies concerning levy action on a tax period in which NFTL appeals were filed timely and determinations were still pending, and consider appropriate discipline in accordance with IRM 6.751.1, the manager’s guide to penalty determinations, and in consultation with Labor Relations and Small Business/Self-Employed Division Collection leadership.

Consider developing a TECU workstream for taxpayers that potentially have multiple delinquencies.

Issue clear and consistent procedural guidance for TECU examiners to follow when conducting compliance checks.

Revise the initial contact letters to provide taxpayers the option to submit the requested returns electronically.

The Commissioner, TE/GE Division, should better align procedural guidance for TECU examination referrals with CP&C criteria for assigning cases to the Examination functions.

The Chief Information Officer should re-establish the Technology Retirement Office or implement a similar enterprise-wide program to identify, prioritize, and decommission legacy systems.

Ensure that a process is in place to validate that all audit trail data elements, including investigative elements provided by TIGTA Office of Investigations, are being captured and can be provided by Login.gov prior to using its identity proofing services for IRS IAL2 applications.

The Chief Information Officer should ensure that appropriate IRS management works in conjunction with Login.gov management to assess the extent and impact that the critical vulnerability had on the users who authenticated via Login.gov to access IRS applications and may have had their Personally Identifiable Information sent to unauthorized locations outside of the United States.

The LB&I Division, SB/SE Division Examination, Criminal Investigation, RAAS, and the Digital Assets Initiative Project Office analyze ************2****************** ***************2****************************** of digital assets.

The LB&I Division, SB/SE Division Examination, RAAS, and the Digital Assets Initiative Project Office leverage data pertaining to ***************2****************** *************************2********************************************** compliance activity.

The LB&I Division, SB/SE Division Examination, Criminal Investigation, RAAS, and the Digital Assets Initiative Project Office develop a compliance plan that includes the use of Form 1099-DA data, case identification, and case selection of digital asset cases.

The CIO should ensure that ******************************************* *********************************************** are remediated by the plan of action and milestones due date.