Safeguarding Taxpayer Data A GUIDE FOR YOUR BUSINESS

Transcription

1 Safeguardig Taxpayer Data A GUIDE FOR YOUR BUSINESS 1

2 Cotets The Need to Safeguard Taxpayer Data...3 Gettig Started...5 Puttig Safeguards i Place...6 Checklists 1 Admiistrative Activities Facilities Security Persoel Security Iformatio Systems Security Computer Systems Security Media Security Certifyig Iformatio Systems For Use...13 Reportig Icidets...14 Laws ad Regulatios...15 Stadards ad Best Practices...17 Glossary

3 The Need to Safeguard Taxpayer Data Today s idetity thieves are a formidable eemy. They are a adaptive adversary, costatly learig ad chagig their tactics to circumvet the safeguards ad filters put i place to stop them from committig their crimes. Some of the idividuals committig idetity theft refud fraud are members of high-tech global rigs egaged i full-scale orgaized crimial eterprises for stealig idetities ad profitig from that iformatio. As the crimials efforts icrease i sophisticatio, so do the umber ad scope of data breaches, which serves to further expad the etwork ad warehousig of stole ad compromised idetity iformatio, ad i tur icreases the potetial for that stole idetity iformatio to ultimately reverberate through the tax system. I 2015, the IRS called together major players i the tax idustry tax retur preparers, software providers, state tax agecies, payroll providers ad fiacial istitutios for a Security Summit to icrease the cooperatio i place to fight a commo eemy the idetity thieves. Tax preparers are critical players i this partership, ad, because of the taxpayer iformatio they store, icreasigly a target for data theft. Safeguardig taxpayer data is a top priority for the IRS. It is the legal resposibility of govermet, busiesses, orgaizatios, ad idividuals that receive, maitai, share, trasmit or store taxpayers persoal iformatio. Taxpayer data is defied as ay iformatio that is obtaied or used i the preparatio of a tax retur (e.g., icome statemets, otes take i a meetig, or recorded coversatios). Puttig safeguards i place to protect taxpayer iformatio helps prevet fraud ad idetity theft ad ehaces customer cofidece ad trust. This guide will help o-govermetal busiesses, orgaizatios, ad idividuals that hadle taxpayer data to uderstad ad meet their resposibility to safeguard this iformatio. IRS e-file ad paper retur preparers, Itermediate Service Providers, Software Developers, Elec- troic Retur Origiators, Reportig Agets, Trasmitters, their affiliates, ad service providers ca use this guide to determie their data privacy ad security eeds ad implemet safeguards to meet them. > 3

4 These safeguards will help you: Preserve the cofidetiality ad privacy of taxpayer data by restrictig access ad disclosure; Protect the itegrity of taxpayer data by prevetig improper or uauthorized modificatio or destructio; ad Maitai the availability of taxpayer data by providig timely ad reliable access ad data recovery. For a brief descriptio of related laws ad regulatios, refer to the table i Safeguardig Taxpayer Data, Refereces to Applicable Laws ad Regulatios. For refereces to stadards ad best practices, refer to the table i Safeguardig Taxpayer Data, Refereces to Applicable Stadards ad Best Practices. As the crimials efforts icrease i sophisticatio, so do the umber ad scope of data breaches, which serves to further expad the etwork ad warehousig of stole ad compromised idetity iformatio, ad i tur icreases the potetial for that stole idetity iformatio to ultimately reverberate through the tax system. It is critical that we work i partership to combat idetity theft. Major software providers are required to report data thefts to the IRS. We urge idividual tax preparers to otify their local IRS Stakeholder Liaiso of ay data theft to lesse the impact o cliets ad the tax system. 4

5 Gettig Started If you hadle taxpayer iformatio, you may be subject to the Gramm-Leach Bliley Act (GLB Act) ad the Federal Trade Commissio (FTC) Fiacial Privacy ad Safeguards Rules. Whether or ot you are subject to the GLB Act ad the FTC Rules, you could beefit from implemetig the geeral processes ad best practices outlied i FTC iformatio privacy ad safeguards guidelies. Fiacial istitutios as defied by FTC iclude professioal tax preparers, data processors, their affiliates ad service providers who are sigificatly egaged i providig fiacial products or services. They must take the followig steps to protect taxpayer iformatio. Other busiesses, orgaizatios ad idividuals hadlig taxpayer iformatio should also follow these steps because they represet best practices for all. Take resposibility or assig a idividual or idividuals to be resposible for safeguards; Assess the risks to taxpayer iformatio i your office, icludig your operatios, physical eviromet, computer systems ad employees, if applicable. Make a list of all the locatios where you keep taxpayer iformatio (computers, filig cabiets, bags, ad boxes taxpayers may brig you); Write a pla of how you will safeguard taxpayer iformatio. Put appropriate safeguards i place; Use oly service providers who have policies i place to also maitai a adequate level of iformatio protectio defied by the Safeguards Rule; ad Moitor, evaluate ad adjust your security program as your busiess or circumstaces chage. The FTC has fact sheets ad guidelies o privacy ad safeguards for busiesses o their Web site at I additio, you may seek outside professioal help to assess your iformatio security eeds. > 5

6 To safeguard taxpayer iformatio, you must determie the appropriate security cotrols for your eviromet based o the size, complexity, ature ad scope of your activities. Security cotrols are the maagemet, operatioal, ad techical safeguards you may use to protect the cofidetiality, itegrity ad availability of your customers iformatio. Examples of security cotrols are: 1. Lockig doors to restrict access to paper or electroic files; 2. Requirig passwords to restrict access to computer files; 3. Ecryptig electroically stored taxpayer data; 4. Keepig a backup of electroic data for recovery purposes; 5. Shreddig paper cotaiig taxpayer iformatio before throwig it i the trash; 6. Do ot uecrypted sesitive persoal iformatio. Further, Authorized IRS e-file Providers that participate i the role as a Olie Provider must follow the IRS six security, privacy, ad busiess stadards to better serve taxpayers ad protect their idividual icome tax iformatio collected, processed, ad stored. See Safeguardig IRS e-file i Publicatios 1345 for more iformatio. All Authorized IRS e-file Providers who ow or operate a Web site through which taxpayer iformatio is collected, trasmitted, processed, or stored must register their Uiform Resource Locator (URL). See istructios for submittig the URL iformatio. For additioal examples of security cotrols, refer to the Natioal Istitute of Stadards ad Techology (NIST) SP publicatio listed i Safeguardig Taxpayer Data, Refereces to Applicable Stadards ad Best Practices. Puttig Safeguards i Place The followig checklist icludes may activities that ca be icluded i a iformatio security program. It ca help you put i place security procedures ad cotrols to protect taxpayer iformatio. It is importat to cosider all the safeguards that are applicable to your busiess. > 6

7 Checklist 1 ONGOING DONE N/A Admiistrative Activities Complete a Risk Assessmet. Idetify the risks ad potetial impacts of uauthorized access, use, disclosure, disruptio, modificatio or destructio of iformatio ad iformatio systems that ca be used to access taxpayer data. How vulerable is your customer s data to theft, disclosure, uauthorized alteratios or urecoverable loss? What ca you do to reduce the impact to your customers ad your busiess i such a evet? What ca you do to reduce vulerability? Write ad follow a Iformatio Security Pla that: Addresses every item idetified i the risk assessmet. Defies safeguards you wat affiliates ad service providers to follow Requires a resposible perso to review ad approve the Iformatio Security Pla. Requires a resposible perso to moitor, revise, ad test the Iformatio Security Pla o a periodic (recommeded aual) basis to address ay system or busiess chages or problems idetified. Periodically (recommeded aually) perform a Self-Assessmet to: Evaluate ad test the security pla ad other safeguards you have i place. Documet iformatio safeguards deficiecies. Create ad execute a pla to address them. Retai a copy of the Self-Assessmet ad esure it is available for ay potetial reviews. If required by the FTC Privacy Rule, provide privacy otices ad practices to your customers. Specify i cotracts with service providers the safeguards they must follow ad moitor how they hadle taxpayer iformatio. Ask service providers to give you a copy of their writte security policy o safeguardig iformatio. 7

8 Checklist 2 ONGOING DONE N/A Facilities Security Protect from uauthorized access ad potetial dager (e.g., theft, floods ad torados) all places where taxpayer iformatio is located. Write procedures that prevet uauthorized access ad uauthorized processes. Assure that taxpayer iformatio, icludig data o hardware ad media, is ot left u-secured o desks or photocopiers, i mailboxes, vehicles, trash cas or rooms i the office or at home where uauthorized access ca occur. Authorize ad cotrol delivery ad removal of all taxpayer iformatio, icludig data o hardware ad media. Lock doors to file rooms ad/or computer rooms. Provide secure disposal of taxpayer iformatio, such as shredders, bur boxes or temporary file areas util it ca be securely disposed. I 2015, the IRS called for a Security Summit to icrease the cooperatio i place to fight idetity thieves. Tax preparers are critical players i this effort, because of the taxpayer iformatio they store, icreasigly a target for data theft. 8

9 Checklist 3 ONGOING DONE N/A Persoel Security Create ad distribute Rules of Behavior that describe resposibilities ad expected behavior regardig computer iformatio systems as well as paper records ad usage of taxpayer data. Have all iformatio system users complete, sig, ad submit a ackowledgemet that they have read, uderstood, ad agree to comply with the rules of behavior. A example of rules of behavior ca be foud i Appedix A of NIST SP Guide for Developig Security Plas for Federal Iformatio Systems. Esure persoel from third-party providers such as service bureaus, cotractors, ad other busiesses providig iformatio techology services meet the same security requiremets as those applied to your persoel. Address Rules of Behavior for computer system maagemet. Whe iterviewig prospective persoel, explai the expected Rules of Behavior. Whe possible, perform a backgroud ad/or referece check o ew employees who will have cotact with taxpayer iformatio. Coduct backgroud screeigs that are appropriate to the sesitivity of a assiged positio. Scree persoel prior to gratig access to ay paper or electroic data. This will help esure their suitability for a positio requirig cofidetiality ad trust. Have persoel who will have access to taxpayer iformatio sig odisclosure agreemets o the use of cofidetial taxpayer iformatio. Develop ad eforce formal compliace policies ad processes, icludig possible discipliary actio, for all persoel who do ot comply with the busiesses established iformatio security policies ad procedures. Termiate access to taxpayer iformatio (e.g., logi IDs ad passwords) for those employees who are termiated or who o loger eed access. For each employee who is termiated, coduct a exit iterview ad esure the employee returs property that allows access to taxpayer iformatio (e.g., laptops, media, keys, idetificatio cards ad buildig passes). Trai staff o Rules of Behavior for access, o-disclosure ad safeguards of taxpayer iformatio. Provide refresher traiig periodically. 9

10 Checklist 4 ONGOING DONE N/A Iformatio Systems Security Iformatio systems iclude both automated ad maual systems made up of people, machies ad/or methods for collectig, processig, trasmittig, storig, archivig ad distributig data. To help esure the accuracy, validity, cosistecy ad reliability of taxpayer data, you should maage taxpayer data iformatio systems based o the guidelies below. Grat access to taxpayer iformatio systems oly o a valid eed-to-kow basis that is determied by the idividual s role withi the busiess. Put i place a writte cotigecy pla to perform critical processig i the evet that your busiess is disrupted. It should iclude a pla to protect both electroic ad paper taxpayer iformatio systems. Idetify idividuals who will recover ad restore the system after disruptio or failure. Periodically test your cotigecy pla. Back up taxpayer data files regularly (e.g., daily or weekly) ad store backup iformatio at a secure locatio. Maitai hardware ad software as eeded ad keep maiteace records. Taxpayer data is defied as ay iformatio that is obtaied or used i the preparatio of a tax retur (e.g., icome statemets, otes take i a meetig, or recorded coversatios). 10

11 Checklist 5 ONGOING DONE N/A Computer Systems Security Idetify ad autheticate computer system users who require access to electroic taxpayer iformatio systems before gratig them access. You ca maage user idetities by: Idetifyig authorized users of electroic taxpayer iformatio systems ad grat specific access rights/privileges. Assigig each user a uique idetifier. Verifyig the idetity of each user. Disablig user idetifiers after a orgaizatio-defied time period of iactivity. Archivig user idetities. Implemet password maagemet procedures that require strog passwords. Require periodic password chages. Disable ad remove iactive user accouts. Protect electroic taxpayer iformatio systems coected to the Iteret with a barrier device (e.g., firewall, router or gateway). Ay failure of these devices should ot result i a uauthorized release of taxpayer data. Whe storig taxpayer iformatio electroically, cosider followig best practices ad store it o separate secure computers or media that are ot coected to a etwork ad that are password protected ad ecrypted. Ecrypt taxpayer iformatio whe attached to . Ecrypt taxpayer iformatio whe trasmittig across etworks. Regularly update firewall, itrusio detectio, ati-spyware, ati-adware, ati-virus software ad security patches. Moitor computer systems for uauthorized access by reviewig system logs. Lock out computer system users after three cosecutive ivalid access attempts. Remove all taxpayer iformatio oce the retetio period expires by usig software desiged to securely remove data from computers ad media prior to disposig of hardware or media. The FTC Disposal Rule has iformatio o how to dispose of sesitive data. As recommeded by the FTC, reduce risks to computer systems by performig vulerability scas ad peetratio tests periodically. You ca lear more about this at the FTC Web site i their article FTC Facts for Busiess Security Check: Reducig Risks to Your Computer Systems. 11

12 Checklist 6 ONGOING DONE N/A Media Security Store computer disks, removable media, tapes, compact disks, flash drives, audio ad video recordigs of coversatios ad meetigs with taxpayers, ad paper documets i a secure locatio, cabiet, or cotaier. Secure media storage areas, icludig rooms, cabiets, ad computers by locks or key access. Where appropriate, employ a automated mechaism to esure oly authorized access. Restrict authorized access to media storage. Limit removal of taxpayer iformatio to authorized persos ad perform iformatio access audits regularly. Securely remove all taxpayer iformatio whe disposig of computers, diskettes, magetic tapes, hard drives, or ay other electroic media that cotai taxpayer iformatio. The FTC Disposal Rule has iformatio o how to dispose of sesitive data. Shred or bur paper documets before discardig them. It is critical that we work i partership to combat idetity theft. Major software providers are required to report data thefts to the IRS. 12

13 Checklist 7 ONGOING DONE N/A Certifyig Iformatio Systems For Use Determie if risks are acceptable to certify systems for use. Sig a authority to operate. If you use a certified idepedet certificatio compay, cosider the followig: O a periodic (recommeded aual) basis, have a idepedet idividual or busiess with relevat security expertise, evaluate the security plas, cotrols, ad ay other safeguards implemeted i your busiess agaist best practices. Have a report geerated from the audit that certifies that your busiess follows best practices. Esure the report highlights ay deficiecies ad provides recommedatios for their correctio. Develop a pla for your busiess to correct ay deficiecies foud ad to esure that the pla is successfully executed. Retai a copy of the audit report to esure it is available for ay potetial reviews. Be prepared to show how you mitigate risks. 13

14 Reportig Icidets Safeguardig persoally idetifiable taxpayer iformatio is of critical importace to retaiig the cofidece ad trust of taxpayers. Appropriately hadlig iformatio security icidets is also very importat to retaiig the cofidece ad trust of taxpayers. A iformatio security icidet is a adverse evet or threat of a evet that ca result i a uauthorized disclosure, misuse, modificatio or destructio of taxpayer iformatio. If you believe a iformatio security icidet has occurred that affects the cofidetiality, itegrity, or availability of taxpayer data or the ability for the taxpayer to prepare or file a retur, you may eed to report the icidet. The followig table icludes examples of types of icidets. INCIDENT TYPE DESCRIPTION Theft Uauthorized removal of computers, data/records o computer media or paper files. Loss/Accidet Accidetal misplacemet or loss of computers, data/records o computer media or paper files. Uauthorized Access A perso or computer gais logical or physical access without permissio to a etwork, system, applicatio, data, or other resource. Uauthorized A perso violates disclosure or use policies such asirc sectios 6713 & Disclosure/ Usage See Laws ad Regulatios for iformatio o IRC sectios 6713 & Computer System/ Network Attack A virus, worm, Troja horse, or other code-based malicious etity ifects a host ad causes a problem such as disclosure of sesitive data or deial of services. Recommeded actios for icidet reportig are as follows: Idividuals (e.g., employees ad cotractors) who detect a situatio that may be a iformatio security icidet should immediately iform the idividual desigated by the busiess to be resposible for hadlig customer iformatio security. The idividual resposible for hadlig customer iformatio security should gather iformatio about the suspected icidet. If you believe the icidet compromises a perso s idetity or their persoal or fiacial iformatio, we recommed you refer to the FTC documet, Iformatio Compromise ad the Risk of Idetity Theft: Guidace for Your Busiess. Amog other thigs, this referece will help you determie whe to otify local law eforcemet, the Federal Bureau of Ivestigatio, the U.S. Secret Service, the U.S. Postal Ispectio Service, affected busiesses, ad customers. See the Safeguardig Taxpayer Data, Refereces to Applicable Stadards ad Best Practices table for the Iteret lik to this FTC documet. 14

15 Laws ad Regulatios May federal, state, city, ad local govermet laws ad regulatios are i place to safeguard taxpayer data. The followig table icludes a brief descriptio of some of them ad provides refereces to more detailed iformatio. TYPE SUMMARY OF APPLICABLE LAWS AND REGULATIONS Federal/Privacy ad Security The Gramm-Leach-Bliley Fiacial Moderizatio Act of 1999 This statute (otherwise kow as the Gramm-Leach-Bliley Act) (GLB Act), amog other thigs, directed FTC to establish the Fiacial Privacy Rule ad the Safeguards Rule. Federal/Security FTC Stadards for Safeguardig Customer Iformatio Rule (16 CFR Part 314) This Rule (otherwise kow as the Safeguards Rule) requires fiacial istitutios, as defied, which icludes professioal tax preparers, data processors, affiliates, ad service providers to esure the security ad cofidetiality of customer records ad iformatio. It protects agaist ay aticipated threats or hazards to the security or itegrity of such records. I additio, it protects agaist uauthorized access to or use of such records or iformatio which could result i substatial harm or icoveiece to ay customer. This Rule requires that fiacial istitutios develop, implemet ad maitai a Iformatio Security Program. The pla should be writte i oe or more accessible parts ad cotai admiistrative, techical, ad physical safeguards that are appropriate to the busiess size ad complexity, ature ad scope of activities, ad sesitivity of customer iformatio hadled. Sarbaes-Oxley Act of 2002 (17 CFR Parts 232, 240 ad 249) Sectio 404 requiremets apply to all Securities ad Exchage Commissio (SEC) reportig compaies with a market capitalizatio i excess of $75 millio. It requires compaies to establish a ifrastructure to protect ad preserve records ad data from destructio, loss, uauthorized alteratio or other misuse. This ifrastructure must esure there is o room for uauthorized alteratio of records vital to maitaiig the itegrity of the busiess processes. > 15

16 TYPE SUMMARY OF APPLICABLE LAWS AND REGULATIONS Federal/Privacy FTC Privacy of Cosumer Fiacial Iformatio Rule (16 CFR Part 313) This Rule (otherwise kow as the Fiacial Privacy Rule) aims to protect the privacy of the cosumer by requirig fiacial istitutios, as defied, which icludes professioal tax preparers, data processors, affiliates, ad service providers to give their customers privacy otices that explai the fiacial istitutio s iformatio collectio ad sharig practices. I tur, customers have the right to limit some sharig of their iformatio. Also, fiacial istitutios ad other compaies that receive persoal fiacial iformatio from a fiacial istitutio may be limited i their ability to use that iformatio. The FTC Privacy Rule implemets sectios 501 ad 502(b)(2) of the GLB Act requiremets. Title 26: Iteral Reveue Code (IRC) This provisio imposes crimial pealties o ay perso egaged i the busiess of preparig or providig services i coectio with the preparatio of tax returs who kowigly or recklessly makes uauthorized disclosures or uses of iformatio furished to them i coectio with the preparatio of a icome tax retur. Title 26: Iteral Reveue Code (IRC) 6713 This provisio imposes moetary pealties o the uauthorized disclosures or uses of taxpayer iformatio by ay perso egaged i the busiess of preparig or providig services i coectio with the preparatio of tax returs. Iteral Reveue Procedure This procedure requires Authorized IRS e-file Providers to have security systems i place to prevet uauthorized access to taxpayer accouts ad persoal iformatio by third parties. It also specifies that violatios of the GLB Act ad the implemetig rules ad regulatios promulgated by the FTC, as well as violatios of the o-disclosure rules cotaied i IRC sectios 6713 ad 7216 or the regulatios promulgated there uder are cosidered violatios of Reveue Procedure , ad are subject to pealties or sactios specified i the Reveue Procedure. State/Privacy ad Security State Laws May state laws gover or relate to the privacy ad security of fiacial data, which icludes taxpayer data. They exted rights ad remedies to cosumers by requirig idividuals ad busiesses that offer fiacial services to safeguard opublic persoal iformatio. For more iformatio o state laws that your busiess must follow, cosult state laws ad regulatios. 16

17 Stadards ad Best Practices Federal ad state govermets as well as private idustry provide may iformatio security stadards ad best practice guidelies to safeguard cosumer iformatio such as persoal tax data. The Natioal Istitute of Stadards ad Techology (NIST) provides security guidelies ad practices for federal agecies that ogovermetal orgaizatios may also use. Below is a list of refereces o a variety of iformatio safeguard topics that ca help you uderstad ad comply with laws, regulatios ad best practices that may apply to your busiess. TYPE REFERENCES TO APPLICABLE STANDARDS AND BEST PRACTICES Federal/Privacy Gettig Noticed: Writig Effective Fiacial Privacy Notices Iformatio Compromise ad the Risk of Idetity Theft: Guidace for Your Busiess Federal/Security FTC Facts for Busiess: Fiacial Istitutios ad Customer Iformatio: Complyig with the Safeguards Rule FTC Disposal Rule (2005) FTC Busiess Alert: Disposig of Cosumer Report Iformatio? Rule Tells How Security Check: Reducig Risks to Your Computer Systems NIST SP , Guide for Developig Security Plas for Federal Iformatio Systems: Provides guidace o developig a Iformatio Security Pla ad icludes a sample pla i Appedix A. NIST SP , Recommeded Security Cotrols for Federal Iformatio Systems ad Orgaizatios NIST SP Revisio 2, Computer Security Icidet Hadlig Guide NIST SP Revisio 1, Guide for Coductig Risk Assessmets Private Idustry/ Security Idustry Stadards ad Best Practices May private idustry compaies provide best practice advice o protectig iformatio systems ad safeguardig customer data. You ca get more iformatio o idustry stadards ad best practice by researchig the Iteret ad other resources. 17

18 Glossary Adware Computer advertisig software that may or may ot moitor computer use to target ads. Authorized IRS e-file Provider A busiess authorized by the IRS to participate i IRS e-file as a Electroic Retur Origiator, a Itermediate Service Provider, a Reportig Aget, a Software Developer, a Olie Provider, or a Trasmitter. Cofidetiality Restrictios placed o iformatio access ad disclosure, icludig meas for protectig persoal privacy ad proprietary iformatio. Deial of Service A attack that prevets or impairs the authorized use of etworks, systems or applicatios by exhaustig resources. Electroic Retur Origiator (ERO) Authorized IRS e-file Provider that origiates the electroic submissio of returs to the IRS. Ecrypt To covert plai text to uitelligible text usig a cryptographic algorithm. Idetity Theft Misuse of someoe else s persoal iformatio to obtai ew accouts or loas or commit other crimes. Iformatio Resources Iformatio ad related resources, such as staffig, fudig ad iformatio techology. Iformatio Security The process that esures the protectio of iformatio ad iformatio systems from uauthorized access, use, disclosure, disruptio, modificatio or destructio. Iformatio System A set of iformatio resources desigated for the orgaizatio of data for the collectio, processig, maiteace, use, sharig, dissemiatio or dispositio of iformatio. Iformatio Techology Equipmet, system or subsystem of equipmet that is used i the hadlig of data. Iformatio techology icludes computers, acillary equipmet, software, firmware ad similar procedures, services (icludig support services) ad related resources. Itegrity The autheticity or uimpaired coditio of iformatio; icludig reliability for o-repudiatio of origi. Itermediate Service Provider receives tax iformatio from a ERO (or from a taxpayer who files electroically usig a persoal computer, modem, ad commercial tax preparatio software), processes the tax retur iformatio, ad either forwards the iformatio to a Trasmitter or seds the iformatio back to the ERO (or taxpayer for Olie Filig). 18

19 Itrusio Detectio The act of detectig actios that attempt to compromise the cofidetiality, itegrity or availability of a resource. IRS e-file The brad ame of the electroic filig method established by the IRS. Maagemet Safeguards The security safeguards or coutermeasures for a iformatio system that focus o the maagemet of risk ad the maagemet of iformatio system security. No-repudiatio The process i which there is assurace that the seder of iformatio is provided with proof of delivery ad the recipiet is provided with proof of the seder s idetity for future validatio purposes. Olie Provider A Olie Provider allows taxpayers to self-prepare returs by eterig retur data directly ito commercially available software, software dowloaded from a Iteret site ad prepared off-lie, or through a olie Iteret site. Operatioal Safeguards Security for a iformatio system that is primarily implemeted ad executed by people rather tha by a system. Reportig Aget origiates the electroic submissio of certai returs for its cliets ad/or trasmits the returs to the IRS. A Reportig Aget must be a accoutig service, frachiser, bak, or other etity that complies with Rev. Proc , I.R.B. 267, ad is authorized to perform oe or more of the acts listed i Rev. Proc o behalf of a taxpayer. Reportig Agets must submit Form 8655, Reportig Aget Authorizatio, to the IRS prior to or at the same time that they submit a IRS e-file Applicatio. Risk The likelihood that the uwated impact of a icidet will be realized. Risk Assessmet The process of idetifyig risks ad determiig the probability of occurrece, the resultig impact ad additioal security cotrols that would mitigate this impact. Risk Maagemet The process of maagig risks through risk assessmet; cost-beefit aalysis; the selectio, implemetatio, ad assessmet of security cotrols; ad the formal authorizatio to operate the system. The process icludes cosideratio of effectiveess, efficiecy ad costraits due to laws, directives, policies, or regulatios. Safeguard Protective measures prescribed to meet the security requiremets specified for a iformatio system. Safeguards may iclude security features, maagemet costraits, persoel security ad security of physical structures, areas, ad devices. Security Cotrols Safeguards desiged to protect the cofidetiality, itegrity ad availability of a system ad its iformatio. 19 Security Pla Formal documet that provides a overview of the security requiremets for the iformatio system ad describes the security cotrols i place or plaed for meetig those requiremets.

20 Security Requiremets Requiremets that are derived from laws, policies, istructios, regulatios or busiess (missio) eeds to esure the cofidetiality, itegrity ad availability of the iformatio beig processed, stored or trasmitted. Service Provider Ay idividual or busiess that maitais, processes, or is give access to customer iformatio through the provisios of a service agreemet with aother idividual or busiess. Software Developer develops software for the purposes of formattig electroic retur iformatio accordig to IRS e-file specificatios ad/or trasmittig electroic retur iformatio directly to the IRS. Spyware Software istalled ito a iformatio system to gather iformatio o idividuals or orgaizatios without their kowledge. Tax Preparer Ay perso who is egaged i the busiess of preparig or assistig i preparig tax returs. Techical Safeguards Cotrols for a system that are primarily implemeted ad executed by the iformatio system through mechaisms cotaied i the hardware, software or firmware compoets of the system. Threat Ay circumstace or evet with the potetial to adversely impact operatios, assets or idividuals through a iformatio system via uauthorized access, destructio, disclosure, modificatio of iformatio ad/or deial of service. Trasmitter trasmits electroic tax retur iformatio directly to the IRS. EROs ad Reportig Agets may apply to be Trasmitters ad trasmit retur data themselves, or they may cotract with accepted Third-Party Trasmitters that will trasmit the data for them. A Trasmitter must have software ad computers that allow it to iterface with the IRS. Troja Horse A computer program used to attack a computer system by secretly allowig, amog other thigs, uauthorized access or alteratio of data or software. User Idividual or system process authorized to access a iformatio system. Virus A computer program used to compromise a computer system by performig fuctios that may be destructive. A virus may alter other programs to iclude a copy of itself ad execute whe the host program or other executable compoet is executed. Vulerability Weakess i a system through procedures, iteral cotrols or implemetatio that could be exploited or triggered by a threat source. Worm A computer program used to compromise a computer system by impactig performace. A worm ca travel from computer to computer across etwork coectios replicatig itself. 20

21 NOTE: The Iteral Reveue Service prepared this guide as a outreach educatioal effort for all tax preparers, trasmitters, ad software developers. If you have ay commets or suggestios for future updates, please sed a to: Safeguard.data.tp@irs.gov Publicatio 4557 (Rev ) Catalog Number 48905Y Departmet of the Treasury Iteral Reveue Service