Some examples and categories of IRS SBU data include, but are not limited to:

By definition, documents designated as "Official Use Only" (OUO) and "Limited Official Use" (LOU) include SBU data.

For more information, refer to IRM 11.3.12, Disclosure of Official Information, Designation of Documents.

The Freedom of Information Act (FOIA) exempts most SBU data from release to the public under one of the nine exemptions listed in 5 U.S.C. 552(b).

However, the fact that the IRS must release certain information if requested under FOIA does not automatically remove its status as SBU data. [FOIA]

For more information, refer to IRM 11.3.13, Freedom of Information Act.

Examples and categories of PII may include, but are not limited to the following, when used to distinguish or trace an individual’s identity, or when combined with information that is linked or linkable to an individual:

Information about an individual that is linked or linkable to one of the above.

IRS personnel must protect SBU data regardless of whether the same information is in the public record or publicly available. However, less stringent protections might apply in some situations.

Generally, personnel must encrypt SBU data (including PII). However, inside the IRS network, encryption is not required if the IRS proactively makes it available to all personnel on internal resource sites (including, but not limited to, Discovery Directory, Outlook [calendar, profile information, and address book], intranet, and SharePoint site collections), such as names, SEID, and business contact information. [NIST SP 800-122; [TD P 85-01, Appendix A, AC-20(3)_T.028, and MP-6(3)_T.124]

Email addresses, by themselves as the method of the email conveyance, generally do not need encrypting. However, when combined with the content and attachments of an email, the email address may become SBU data.

As for other SBU data and PII in the public record or publicly available, the requirements differ, depending on the information.

No IRC 6103 public records exemption exists. However, the Information Which Has Become Public Record section of IRM 11.3.11, Other Information Available to the Public, discusses disclosure of matters that have become public records as a result of tax administration, such as court cases. This is known as the judicially created public records exception.

Treasury security guidance exempts Treasury information made available proactively to the public from certain encryption controls. This exemption implies a public records exception for information the agency makes available to the public. [TD P 85-01, Appendix A, AC-20(3)_T.028, and MP-6(3)_T.124]

The Public Information Listing (PIL) designated by OPM makes six items of information available to the public by FOIA request. These items include: [5 CFR 293.311]

However, OPM exempts release of information on employees in these sensitive positions:

IRS policy also authorizes the withholding of the public information items of employees in cybersecurity designated positions. Cybersecurity designated positions are not identified by a specific GS/IR series or position title.

Personnel should exercise caution and consult with PGLD for any questions they might have about application of a public record exception, on a case-by-case basis, prior to reducing privacy protections based on a public record exception. For further information, email *Privacy.

For more information, refer to IRM 11.3.13, Freedom of Information Act.

Little difference exists between PII and what personnel refer to as "sensitive" PII.

As defined in the PII section in IRM 10.5.1.2.3, personally identifiable information means information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual. [OMB A-130]

The level of risk increases with the potential level of harm caused by exposed SBU data or PII.

Context remains important. PII that does not seem high risk may still require protection if its context makes it risky. For example, a collection of names:

For more information, see also the Deciding Risk Levels for SBU Data and PII section in IRM 10.5.1.6.1.1.

All IRS personnel are responsible and accountable for the effective implementation of privacy protections. [PVR-01]

PII will be collected and used only when necessary and relevant for legitimate IRS purposes, namely tax administration and other authorized purposes. [PVR-02]

Limit the collection, use, retention, and disclosure of PII to what is minimally necessary for the specific purposes for which it was collected, unless specifically authorized. [PVR-03]

The IRS will make its privacy policies and practices readily available to individuals, such that individuals will be informed of the collection, use, retention, and disclosure of their PII, and will obtain individuals’ consent to the greatest extent practicable. [PVR-04]

PII will only be accessed by or disclosed to authorized individuals who require the information for the performance of official duties. The IRS will not tolerate browsing of confidential information, including PII, by unauthorized IRS personnel. Protected information includes confidential information of all individuals, not just taxpayers. Protected information includes, but is not limited to, confidential information of IRS employees, volunteers, practitioners, and other individuals who interact with the IRS. [PVR-05]

IRS personnel will provide appropriate administrative, technical, and physical safeguards will be provided to protect against the unauthorized collection, use, and disclosure of SBU data, including PII. [PVR-06]

Requirements governing the accuracy, completeness, and timeliness of PII will be to ensure fair treatment of all individuals. IRS personnel will collect information, to the greatest extent practicable, directly from the individual to whom it relates. [PVR-07]

IRS personnel will verify all information about an individual with the individual, as well as any other relevant sources, to the greatest extent possible before taking adverse action based on that information. We will notify individuals prior to final action to the greatest extent possible. [PVR-08]

Individuals will be able to access and correct their PII upon request to the maximum extent allowable. Individuals include, but are not limited to, taxpayers, IRS employees, IRS contractors, practitioners, and others who interact with the IRS. Individuals will be able to contest determinations made based on allegedly incomplete, inaccurate, or out-of-date PII to the maximum extent allowable. [PVR-09]

IRS personnel will be made aware of, and appropriately trained, in the proper treatment of SBU data, including PII. [PVR-10]

Loss, compromise, or disclosure of SBU data (including PII and tax information) could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual or the IRS.

Harm includes any adverse effects experienced by an individual whose PII was compromised, or adverse effects to the IRS such as a loss of public confidence.

The greater the potential for harm, the more at risk the SBU data becomes. As outlined in NIST SP 800-122:

The greater the risk to SBU data, the stronger the privacy and security protections become. [OMB A-130, NIST SP 800-122] For example, moderate and high risk SBU data require encryption, but publicly available low risk SBU data might not need encryption.

When in doubt about the level of risk of SBU data (including PII and tax information), or the privacy concerns around the data, email *Privacy for help.

For more information about publicly available information, see also the Public Record section in IRM 10.5.1.2.3.2.

For more information on the IT aspects of data security, refer to IRM 10.8.1, Information Technology (IT) Security, Policy and Guidance.

We must protect all SBU data (including PII and tax information). What SBU data we may share is limited. [PVR-02, PVR-05]

Disseminate SBU data (orally, visually, or electronically) in such a manner to avoid access by unauthorized persons. Precautions might include preventing visual access and restricting oral disclosure to designated individuals.

You may reproduce SBU data on regular office copiers to the extent needed to carry out official business. Properly destroy flawed or otherwise unusable reproductions. See also the Disposition and Destruction section in IRM 10.5.1.6.10.

Follow extensive Disclosure rules in the IRM 11.3 series, Disclosure of Official Information.

Internally: Only share SBU data (including PII and tax information) with other IRS personnel if the recipient’s need for the information is related to their official duties.

The electronic transmission of SBU data (including PII and tax information) requires encryption for security purposes. See also the Encryption section in IRM 10.5.1.6.2 for more information.

The confidentiality provisions of IRC 6103 restrict release of tax information (whether of an individual or business). Share tax information only with authorized individuals following established written procedures.

Externally: Only share SBU data (including PII and tax information) with authorized individuals outside of IRS, in encrypted files, if you meet all these conditions:

Refer to the IRM 11.3 series (Disclosure of Official Information) or email *Disclosure for more guidance.

IRS personnel must not create unauthorized, unnecessary, or duplicative hardcopy or electronic collections of SBU data (including PII and tax information), such as duplicate, ancillary, shadow, personal copies, or "under the radar" files. [PVR-03]

If creating new spreadsheets or databases that include SBU data (including PII and tax information) from a larger file or database is necessary, consider whether it requires a PCLIA.

Protect all SBU data (including PII and tax information) processed, stored, or transmitted outside the IRS with IT-approved encryption methods, unless specifically excluded in the IRM. This includes, but is not limited to, SBU data in email, removable media (such as USB drives), on mobile computing devices, and on computers and mobile devices.

IRS IT-approved encryption methods include, but are not limited to, Symantec Endpoint Encryption Removable Storage (SEERS, formerly known as GERS, Guardian Edge Removable Storage), password-protected SecureZip, and secure messaging via Outlook.

See the Virtual Library for more information about encrypting documents, emails, and email attachments on the Encryption page on the PGLD Disclosure and Privacy Knowledge Base on IRS Source.

Refer to specific requirements in these IRMs:

Within the IRS, protect all SBU data (including PII and tax information) with encryption and access controls, limiting access only to approved personnel with a need to know.

Within the IRS network, encrypt emails using the Secure Enterprise Messaging System.

Refer to specific data encryption requirements in IRM 10.8.1, Information Technology (IT) Security, Policy and Guidance, in the Encryption, Access Control, Media Protection, and Physical and Environmental Protection sections.

Refer to the SecureZip and SEERS (formerly GERS) brochures in the Encryption page on the PGLD Disclosure and Privacy Knowledge Base on IRS Source.

Instructions for using SecureZip and SEERS (formerly GERS) to encrypt attachments also are available on the IT4U site on IRS Source.

Remember that the use of cell phones or other cordless devices (cordless land lines) does not automatically create disclosure concerns. However, use of these devices might raise some vulnerability issues. Refer to the Telecommunication Devices and the Personally-Owned and Other Non-Government Furnished Equipment sections of IRM 10.8.1.

Whenever possible, conduct cellular phone conversations in a private setting (and not in a crowded public setting) to minimize the potential for eavesdropping. Cordless devices are rarely, if ever, used outside of a person’s home and do not lend themselves to conversations in crowded areas, but can still pose a risk of someone overhearing a conversation that the taxpayer does not want overheard.

For contacts initiated by IRS personnel that discuss SBU data (including PII or tax information), you must inform a taxpayer you are calling from a cell phone or other cordless device when in a public place where others could overhear sensitive information. This will alert the taxpayer of the potential for the inadvertent disclosure of their tax information. When calling from a private setting where others cannot overhear the conversation, you don’t have to disclose that the call is originating from a cell or cordless phone.

Even when a call from a public place is not expected to discuss sensitive information, you still should consider telling the taxpayer you are using a cell phone or other cordless device in case a sensitive issue comes up in the discussion.

You must honor a taxpayer’s request not to conduct a conversation concerning sensitive information by cell or cordless phone. Offer the taxpayer the choice of rescheduling the conversation when a more secure land line is available. Appropriately document any agreement (if documentation kept, such as history notes).

For taxpayer-initiated contacts, the IRS is under no obligation to determine if the taxpayer is using a less secure platform such as a cordless device or cell phone. Any necessary dialogue, including the disclosure of SBU data (including PII or tax information), is authorized because the taxpayer has accepted any security vulnerability by using such a device to contact the IRS.

Never discuss NSI over a cell or cordless phone. For more about NSI, refer to IRM 10.9.1, Classified National Security Information.

For information about text messaging or texting, see also the Text Messaging (Texting) section in IRM 10.5.1.6.9.6.

Use the following for answering machine and voicemail guidelines when leaving messages with sensitive information:

When you can’t positively identify the number reached as the taxpayer’s, and it is otherwise appropriate and practical, simply ask for a return call without giving the taxpayer’s name. If the call is in response to an earlier taxpayer inquiry or request, say the call is in response to an earlier inquiry or request. In such a case, you must not say the nature of the original situation nor reveal any specifics about the return call if it involves sensitive information.

Normally, do not leave sensitive information on the answering machine of the taxpayer’s designee under IRC 6103(c) because these designees cannot further authorize IRS to disclose the taxpayer’s information to anyone else, and IRS cannot be certain who will pick up the message.

Do not send emails that include SBU data (including PII and tax information) to taxpayers or their authorized representatives, even if requested, because of the risk of improper disclosure or exposure.

When taxpayers request email contact and accept the risk of such, limited allowable situations without risking unauthorized disclosure of SBU data include:

When responding to unsolicited emails from taxpayers or tax professionals, respond by letter or phone; if address or phone number not available, respond by email. IRS personnel must:

Do not email SBU data (including PII and tax information) to other external stakeholders unless specifically authorized. Refer to IRM 11.3.1, Disclosure of Official Information, Introduction to Disclosure.

Send SBU data (including PII and tax information) through password-protected encrypted attachments or through a previously authorized privacy- and IT-approved secure email program. For example, refer to the LBI Secure Email program site.

Email SBU data (including PII and tax information) outside the IRS in encrypted, password-protected attachments or secure email only when:

See Emails to Taxpayers and Representatives in IRM 10.5.1.6.8.1 when receiving emails from external parties that contain SBU data (including PII and tax information).

Interact with applicants or prospective contractors by email only to answer questions about their information, qualifications, or administrative matters; minimize the exposure of their personal information (such as PII).

For those who must provide IRS with their SBU data (such as PII) to facilitate a business arrangement, ask them to fax, mail, or upload their SBU data to a secure system, such as USAJobs.

IRS personnel must use IRS email for email communications with other IRS personnel about official business matters. They must encrypt all internal email messages that contain SBU data (including PII and tax information) with IT-approved encryption, which includes secure messaging or password-protected encrypted attachments.

For contractors, when provided with an IRS workstation as part of a contract, they must use their IRS workstation and account for all official communication (e.g., email, instant messaging). Refer to the Contractor section of IRM 10.8.2, IT Security Roles and Responsibilities.

No officer, employee, or contractor of the IRS may use a personal email account to conduct any official business of the government. Three limited allowable circumstances include:

The general rule for encrypting SBU data (including PII and tax information) in emails reflects the IRS’s priority to protect sensitive information from unauthorized disclosure causing a risk of loss or harm to individual privacy or to IRS data.

Having evaluated business needs in relation to potential risk, the following limited exceptions for external emails are appropriate:

Special rules apply when transmitting customer satisfaction or other surveys by email.

For details on the Survey process, refer to IRM 10.5.2.

If IRS personnel carry SBU data (including PII and tax information) in connection with a trip or during daily activities, they must keep it with them to the extent possible.

If you must leave SBU data (including PII and tax information) unattended in an automobile while traveling between work locations or between work and home, lock it in the trunk. If the vehicle does not have a trunk, conceal the material from plain view and secure it in some manner. When not in transit, secure data in an approved work location (office, approved and securable telework location, or approved taxpayer site in IRS-approved lockable containers).

If you must leave the SBU data (including PII and tax information) unattended in hotel or motel room, lock it in a briefcase and conceal it to the extent possible.

If SBU data (including PII and tax information) is being moved from one building to another (even within the same campus) or one location to another even if it is a short distance, take necessary steps to protect the information from unauthorized disclosure, loss, damage or destruction.

Field employees might have SBU data needing protection while temporarily stored at the taxpayer's site.

For more information about how to protect taxpayer location when using GPS and location services, see also the Global Positioning Systems (GPS) and Location Services section in IRM 10.5.1.6.11.

IRS personnel must follow proper data protection procedures when mailing SBU data.

You may mail letters and packages with SBU data that weigh less than 13 ounces via United States Postal Service (USPS). These packages do not require double packaging and double labeling.

When sending SBU data by mail within the U.S. and Territories (serviced by United States Postal Service [USPS]):

When sending SBU data to offices Overseas:

IRS personnel must follow proper data protection procedures when shipping PII.

You may mail letters and packages with PII that weigh less than 13 ounces via United States Postal Service (USPS). These packages do not require double packaging and double labeling.

You must ship packages with PII that weigh 13 ounces or more through a private delivery carrier.

If the package contains PII and is being shipped through a private delivery carrier, the sender must follow the procedures included below for properly double packaging, double labeling, and tracking the shipment, including the use of Form 3210, Document Transmittal.

When shipping PII through private delivery carrier, the use of UPS CampusShip is mandatory at all locations except Campus locations and offices serviced by a FMSS contract mailroom. UPS CampusShip is an Internet-based shipping system that you can access from any location that has Internet access. The IRS has rolled out UPS CampusShip across the country to IRS field offices not serviced by a FMSS contract mail room. Find training material in the following UPS CampusShip documents:

CampusShip allows employees to:

Packages with PII must be double-packaged and double-labeled prior to shipping. Double-packaging helps ensure the contents are protected if the outer package is damaged or destroyed during the shipping process. Duplicate shipping labels allow proper delivery of the contents without potential disclosure if the external package is damaged or destroyed.

Evaluate the size of the PII shipment and identify appropriate packing materials. The appropriate type of internal and external packaging depends upon the size and weight of the package. Use the smallest size packaging possible to reduce shipping costs and ensure minimal shifting of contents during shipment.

The sender must also determine whether to ship via ground service or express (Overnight and Second Day Air) services:

For internal shipments, the sender must prepare Form 3210, Document Transmittal, identifying the package contents for all packages with PII. For easier tracking, the sender may include the small package carrier tracking number in the "Remarks" area of Form 3210 on Part 4 (sender’s copy).

Securely package the PII by placing the contents and the properly completed Form 3210 in an appropriately sized internal package. The sender keeps Part 4, Sender's copy, of Form 3210 and includes Part 1, Recipient’s copy, and Part 3, Acknowledgement copy, with the shipment. When possible, when sending the package to a specific individual, the sender may choose to notify the recipient via email, phone, or other method prior to shipment that the package with PII is on its way. The sender may also choose to send an electronic PDF version of Form 3210 via secure email to the intended recipient, so the recipient is aware of the expected shipment.

Internal packaging may include any of the following:

Label the internal package with the following information:

The sender may use a copy of the exterior small package carrier shipping label for the internal label.

Place the properly labeled, packaged, and sealed internal package into the external package. External packaging materials may include:

Whenever possible, use a new box; however, you may re-use undamaged packaging materials to ship PII. Only reuse a box if it is rigid and in good condition with no punctures, tears, rips, or corner damages, and all flaps are intact. Remove any existing labels and all other shipment markings if re-using a box.

If appropriately sized packaging is not available, use cushioning material inside the package so the contents do not move or shift when shaken. Cushioning material should consist of materials that are readily available, and you can re-use them. It is not necessary to buy prefabricated materials specifically designed to cushion packages for this purpose. Examples of cushioning material include non-confidential paper, shredded administrative paper, obsolete forms, newspaper, and/or commercially bought Styrofoam peanuts, air bags, etc. Place the cushioning material around the items in the box. Close and shake the box to see whether you have enough cushioning material; add more cushioning material if you hear or feel the contents shifting.

Do not mark or label external packaging material with information showing that package contents include sensitive information. You can mark packages as "time sensitive" or "process immediately" as applicable to ensure timely processing. Labels that show sensitive contents include, but are not limited to:

Seal the package with strong clear shipping tape that is two inches or more in width. Do not use string, paper over-wrap, shrink wrap, and/or plastic straps.

Place the shipping label on the top of the package and ensure it is properly adhered and will not separate from the box. Do not place the label over a seam or closure or on top of sealing tape since this could cause it to be damaged or removed from the package.

The sender must be responsible for monitoring the delivery of the shipment. Follow your organization’s established time frames for Form 3210 acknowledgement follow-up. Where there is no established time frame in an individual organization, the follow-up action should take place in three business days for overnight shipments and ten business days for ground shipments.

Once the shipment is received, the recipient will verify receipt of the contents and sign the acknowledgment copy of the Form 3210. The recipient will return the Form 3210 acknowledgement to the sender using secure email (electronic or scanned copy), fax, or mail. If the SSN was not redacted as required on the Form 3210, redact all but the last four digits of the SSN prior to returning it to the sender. After receiving the acknowledgement copy, the sender will associate it with the original Form 3210.

If the Form 3210 acknowledgement isn't received within the established time frame, the sender should access the small package carrier's website to track the shipment to determine if it was delivered successfully. The tracking number should have been included on Form 3210 when the shipping labels were prepared or after the number was received from the carrier if Form 9814 was used.

If the tracking information shows the package was delivered, the sender must call the intended recipient to confirm actual receipt of the package.

If the tracking information indicates the package was not successfully delivered, the sender should closely monitor the tracking information for up to 48 hours (2 business days) after the anticipated delivery date for air services and up to 72 hours (3 business days) after the anticipated delivery date for ground services. If the package is not delivered within these time frames, the package is considered lost and the sender should follow the procedures for reporting a loss of hardcopy documents.

Immediately upon discovering or identifying a package is lost, report the loss following IRM 10.5.4. Refer to the Report Losses, Thefts or Disclosures of Sensitive Data; Report Lost or Stolen IT Assets and BYOD Assets site on the PGLD Disclosure and Privacy Knowledge Base on IRS Source.

Managers must perform, at a minimum, quarterly audits of the Form 3210 Acknowledgement process for packages with PII to ensure appropriate follow-up is occurring. This procedure will allow IRS managers the opportunity to validate that PII senders are following up on Form 3210 Acknowledgments within defined time frames so that lost shipments are identified quickly. This reduces the likelihood that the PII could be exposed to an unauthorized user. Local management must determine the proper follow-up time frame as part of the manager’s operational review. Maintain Form 3210 following the existing record retention schedule for each Business Unit.

For more information, refer to the PII Hardcopy Shipping page on the PGLD Disclosure and Privacy Knowledge Base on IRS Source.

Refer to IRM 1.15.5, Relocating/Removing Records, for shipping records (such tax or personnel records) to the Federal Records Centers.

Protect faxed SBU data (including PII and tax information) as with any other transmission of SBU data.

Use secure encrypted email internally, if possible, as an alternate way to send SBU data, instead of using a stand-alone fax machine. Scan, encrypt, and internally email documents that include SBU data. Do not email taxpayers or their representatives. See also the Email section in IRM 10.5.1.6.8 for more information.

If you must fax the information, do not send SBU data to a fax machine without contacting the recipient to arrange for its receipt.

When transmitting SBU data via fax, use Enterprise Electronic Fax (EEFax) as the preferred method of faxing documents. Refer to IRS Electronic Fax System section of IRM 21.2.3, Systems and Research Programs, Transcripts, or the EEFax site on IRS Source.

For more information on securely faxing documents, refer to the Facsimile and Facsimile Devices and AC-20 Use of External Information Systems - Control Enhancements sections of IRM 10.8.1.

Protect printed documents with SBU data and follow the IRS Clean Desk Policy in all work locations (including field and telework).

Minimize the printing of SBU data to what is explicitly necessary.

Properly store and dispose of printed materials. See also the Storage section, IRM 10.5.1.6.6, and the Disposition and Destruction section, IRM 10.5.1.6.10.

Use only IRS-furnished (not personally owned) printers. Refer to the AC-20 Use of External Information Systems and Personally-Owned and Other Non-Government Furnished Equipment sections of IRM 10.8.1.

IRS personnel must not use text messaging (texting) for official business.

Refer to the Preserving Electronic Messages section of IRM 1.15.6, Managing Electronic Records.

Refer to the Telecommunication Devices section of IRM 10.8.1.

Electronic transmission addresses uploading or downloading, secure file transfer, file sharing, peer-to-peer (P2P), firewall rules, collaborative technology and systems, and blacklisted sites.

For more information about securing electronic transmissions, refer to those key words in IRM 10.8.1 and the CSIRC Firewall Rule Set Configuration Management section in IRM 10.8.54, Information Technology (IT) Security, Minimum Firewall Administration Requirements.

For more information about secure emailing, see also the Email section in IRM 10.5.1.6.8.

When moving an office or material, make plans to protect and account for all SBU data (including PII and tax information), as well as government property. Consider the relevant factors of the move (such as the distance involved and the method used in making the move).

Take precautions equal with the type and value of property and data involved.

Place hardcopy waste material with SBU data in locked receptacles specifically marked for sensitive document destruction (SDD or shred bins). This includes material shredded with non-compliant equipment that does not meet requirements.

For one-step destruction of paper with SBU data, use cross-cut shredders which produce particles that are 1 mm x 5 mm (0.04 in. x 0.2 in.) in size (or smaller), or pulverize/disintegrate paper materials using disintegrator devices equipped with a 3/32 in. (2.4 mm) security screen. [NIST SP 800-88, Guidelines for Media Sanitization]

For multi-step destruction of paper, you may use non-compliant methods for the first step, if the product is then destroyed in a manner that renders it unreadable, indecipherable, and irrecoverable. [32 CFR 2002]

For electronic media destruction requirements (for items such as magnetic media, diskettes, hard disks, CDs, external drives, USB drives, or other storage devices), refer to the MP-6 Media Sanitization section in IRM 10.8.1 and follow NIST SP 800-88, Guidelines for Media Sanitization.

Refer to the Media Destruction Shipping Procedures page on IRS Source for disposal of electronic media.

Do not put electronic media with hardcopy paper in the sensitive document destruction bins.

For microforms with SBU data (microfilm, microfiche, or other reduced image photo negatives): [NIST SP 800-88, Guidelines for Media Sanitization]

For temporary storage, while waiting for destruction of sensitive waste, you don’t have to put it in a locked receptacle if you follow these requirements for burn bags or shred boxes:

Ensure IRS records (hardcopy and electronic), including those with PII, are managed appropriately and follow the Records Control Schedules (RCS) Document 12990 and General Records Schedules (GRS) Document 12829 to prevent unlawful/unauthorized destruction of records.

Disposition and destruction of tax information must follow the Records and Information Management IRM 1.15.2, Types of Records and Their Life Cycle, IRM 1.15.3, Disposing of Records, and IRM 1.15.6, Managing Electronic Records.

Unshredded sensitive information may be turned over to a contractor provided the contract includes necessary safeguards that will ensure compliance with IRC 6103(n) requirements, provides for periodic safeguard reviews, and includes language describing methods of collection, pick-up, storage, and disposition.

In the event tax information media is to be collected and destroyed by an independent contractor, to preclude the necessity of having an IRS employee present during destruction, the contract must include the safeguard provisions required by IRC 6103(n) and regulations.

CORs will periodically review work areas to ensure that contractors are discarding sensitive waste material properly.

CORs will conduct periodic unannounced inspections at the off-site contractor facilities (including cloud service providers) where contractors handle IRS SBU data. Document results of these inspections, including identification of any privacy, records, or security issues, and document verification that the contractor has taken proper corrective actions on any privacy, records, or security issues observed or identified.

Do not place paper documents with SBU data in regular recycling containers. Instead, place them in clearly marked secured containers (sensitive document destruction bins).

The preferred approach is that sensitive information be segregated and shredded following guidelines contained in Disposition and Destruction, IRM 10.5.1.6.10, prior to turning it over to the recycler.

Another method is to have IRS personnel observe the destruction of sensitive information upon delivery to the recycler. This allows for destruction of sensitive information while maintaining custody of the material up to the moment of destruction. Again, the contractor must be in compliance with IRC 6103(n) requirements which provides for safeguards and periodic safeguard reviews. However, we don’t recommend this method because of the resource requirements.

This exception for the use of personally owned GPS devices is limited to GPS functions only. For example, this does not apply to the use of the non-GPS functions on personally owned mobile computing devices.

Input only taxpayer address information into the GPS device, and delete this information from the device once it is no longer necessary. Never input individual or business taxpayer names into the device.

Do not connect the GPS device to an IRS computer, as the device has the potential to introduce computer viruses and malware into the IRS network.

If available, use a security personal identification number (PIN) code with the device to help protect the privacy of tax information in the event the device is lost or stolen.

Take every precaution to prevent the GPS device from being left unattended or unsecured.

Remove portable GPS devices from vehicle when not in use as circumstances permit. In those limited instances where you must leave a portable device in a locked vehicle, store it out of sight in the trunk or glove compartment.

Never leave portable GPS devices in a vehicle overnight.

Do not leave the portable GPS device and any mounts in an unattended vehicle in plain sight. After removing mount, clean the suction cup mount area because it can leave marks on the windshield/dashboard showing that a GPS or other device may be present in the vehicle, increasing the risk of a break-in.

Report the loss or theft of a GPS device with taxpayer addresses (whether a government-issued GPS or a personally-owned GPS), as a potential breach of PII:

We strongly encourage you not to use your personal devices (such as phones, tablets, fitness watches, or wearable devices) or applications on them to identify taxpayer or work addresses with location services, geotagging, or GPS features or any social media accounts (Facebook Check In, Find My Friends, etc.). Geotagging pinpoints location, which might inadvertently reveal a taxpayer’s home or business, or show activities and location at an IRS office. You should use an IRS-furnished device (if issued) when locating and receiving directions to taxpayer addresses.

When using services that need location, try to avoid using an exact taxpayer address if it might pinpoint the IRS has an interest in the taxpayer.

The Privacy Act prohibits federal agencies from maintaining records on how any individual exercises their First Amendment rights unless certain exceptions apply.

First Amendment rights include religious and political beliefs, freedom of speech and of the press, and freedom of assembly and petition.

Congress intended agencies to apply the broadest reasonable interpretation when determining whether a particular activity is a right guaranteed by the First Amendment.

IRS personnel must not keep files of persons who are merely exercising their constitutional rights.

IRS personnel involved in the design, development, operation, or maintenance of any system of records subject to the Privacy Act must be aware of the restrictions on maintaining records on the exercise of First Amendment rights and alert to any potential violation of those restrictions.

Taxpayers must report income and provide information necessary to verify deductions on their tax returns. The IRS may collect such information although, in some instances, this data may reveal how individuals exercise their First Amendment rights, such as religious affiliation, group membership, or political preference. The IRS may collect this information because statutory exceptions apply. [Privacy Act; PVR-02]

For more information, refer to the Recordkeeping Restrictions section of IRM 10.5.6, Privacy Act.

Widely available electronic recording and monitoring equipment (such as digital cameras and smartphones) raise privacy and security concerns. IRS personnel must not make recordings or conduct monitoring of any type (including, but not limited to, audio, video, photographic, or infrared) in IRS facilities without a business need and prior FMSS approval (except audio recordings, which require direct supervisor approval) or at alternative duty stations duties remote to the conventional office site (e.g., satellite locations, employee’s residence). Refer to the Photography and Video Recordings Prohibition and the Alternative Duty Stations - IRS Telework Program sections of IRM 10.2.11, Physical Security Program, Basic Security Concepts.

Privacy concerns for recording in the workplace center around individual employee privacy and the potential disclosure of SBU data (including PII and tax information).

The law for recording others in the workplace varies by state, but many states require consent of both the recording individual and the recorded individual. To protect individual employee privacy, IRS policy prohibits most recordings because of such variations.

IRS personnel may use their smartphones (or other devices with recording capabilities) in the workplace. However, you must take reasonable precautions that no unauthorized recordings or disclosures occur. When working on any form of SBU data (including PII and tax information), such precautions include muting or disabling voice-activated devices and smartphone applications (such as FaceTime, Siri or Google Now (“Okay Google”) on phones, tablets, etc.). For more information about precautions, see also the Telework section in IRM 10.5.1.6.12 about digital assistants, smart devices, IoT, and other devices that can record or transmit sensitive audio or visual information.

Certain circumstances allow for limited recording in the IRS workplace. They include:

If you receive proper approval and consent to make a recording or take a photograph, you must not record or photograph SBU data (including PII and tax information). Ensue those items are not in view or earshot of the device.

If SBU data (including PII and tax information) appears in an electronic recording nonetheless, you must protect the recording as SBU data and must not disclose the information unless a statutory exemption applies under IRC 6103 or the Privacy Act (depending on the nature of the data).

For more information, refer to IRM 10.8.26; IRM 11.3.1, Introduction to Disclosure; and IRM 10.5.6, Privacy Act.

The IRS needs to conduct some monitoring of individuals to protect federal systems, information, and personnel. Examples of such monitoring include access logs to IRS facilities and audit trails that monitor IT usage. [Privacy Act]

However, limitations still exist on use of any PII collected, with sharing on a need-to-know basis for its intended use only. [Privacy Act]

Monitoring of the public outside IRS facilities must not occur without first consulting Privacy Policy [Treasury’s Privacy and Civil Liberties Impact Assessment Template and Guidance]. For help, email *Privacy.

For more information about the limitation of monitoring individuals, refer to the Privacy Act Recordkeeping Restrictions section of IRM 10.5.6, Privacy Act.

The IRS PCLIA addresses these limitations. For more information about PCLIAs, refer to IRM 10.5.2, Privacy Compliance and Assurance (PCA) Program.

The IRS Internet privacy policy notices on IRS.gov inform the public of the information collection procedures and the privacy measures in place for a particular Internet website or activity. [E-Government Act, OMB A-130, OMB-03-22, PVR-04]

Post the IRS privacy policy notices at every major entry point to an IRS Internet website or application, as well as on any page collecting substantial personal information from the public. The requirement includes, at a minimum, a link to the IRS.gov privacy policy. It also may include a unique privacy policy for that website.

The IRS privacy policy notice is:

Refer to the overarching IRS.gov Internet Privacy Policy notice:
https://www.irs.gov/privacy

A unique privacy policy for a website or application can detail the differences from the IRS.gov privacy policy. This policy applies to any website or application hosted by or for the IRS. [E-Government Act, OMB A-130, OMB-03-22, PVR-04]

The website or application privacy policy must still link to the IRS.gov Privacy Policy.

A simple example, with blanks to fill in the details pertinent to the website or application, is:

More complicated policy notices might be needed if the website or application is more complex.

Any IRS Internet website (or link to a third-party site for the IRS) that links to external sites must post a departure notice. This notice alerts Internet visitors that they are about to leave the IRS website and its privacy practices. It advises them to review the website privacy practices for the website they are about to enter. Refer to the IRS Internet Departure Notice page on the IRS Source. [PVR-04]

IRS Intranet (for example, IRS Source) privacy policy notices inform personnel of the information collection procedures and the privacy measures in place at a particular intranet site or activity.

Post the IRS privacy policy notice at every major entry point to an intranet site, as well as on any page collecting personal information from an individual.

The IRS intranet privacy policy notice is:

Any IRS intranet site or page that links to external sites must post a departure notice. This notice alerts IRS personnel that they are about to leave the IRS website and its privacy practices. It advises them to review the privacy practices on the website that they are about to enter. Refer to the IRS Intranet departure notice on IRS Source.

Do not use persistent cookies or other tracking devices to monitor an individual's visit to IRS intranet sites, except as authorized by OMB regulations.

You may place information that is not SBU data (including PII and tax information) on all calendars without restriction.

You must not post SBU data (including PII and tax information) on public calendars with uncontrolled access.

The following applies any time a business needs to enter some form of SBU data (including PII and tax information) on a shared calendar:

For Business Unit Calendar Meetings/Appointments about Taxpayers:

For Calendars for Offices with Regulatory, Investigative, and/or Advocacy Responsibilities (docketed case meetings):

For Calendars for Offices with Regulatory, Investigative, and/or Advocacy Responsibilities (particular taxpayer meetings):

For Non-Taxpayer-Related Meetings/Appointments:

Online meeting tools include Skype for Business, Saba Centra, Webex, Zoom for Government (ZoomGov), etc. Use only enterprise-approved tools as they will have the necessary authorization and protections, such as encryption.

When using Saba Centra, Webex, ZoomGov, and other approved virtual meeting tools with encrypted communication capability for official IRS business:

IRS-approved encrypted online meeting tools may convey SBU data; however, do not use instant messaging (such as Skype) to conduct official business without saving an official record. Refer to the Use of Agency-approved Electronic Messaging Systems section in IRM 1.15.6.

For more information about online meeting privacy considerations, refer to the Online Meeting Tools - Privacy Considerations section of the PGLD Disclosure and Privacy Knowledge Base site on IRS Source.

The IRS shared network drives (such as I drive, S drive, home directories or other shared resource) are governed in part by the section SC-28 Protection of Information at Rest in IRM 10.8.1, Information Technology (IT) Security, Policy and Guidance. This policy makes it clear that only those with a need to know may have access to SBU data (including PII and tax information) on shared drives, with tight access and controls in place. Because of these controls, encryption is not required.

To protect the privacy of employee and tax information, the law and IRS policy require a PIA when the IRS uses PII in Information Technology to ensure examination and mitigation of privacy risks, with few exceptions.

For more information on PIAs and PCLIAs, refer to IRM 10.5.2, Privacy Compliance and Assurance.

Sharing data in collaborative data environments, such as SharePoint, might offer valuable benefits while having inherent privacy risks. Understanding the risks involved with sharing data on these sites allows for risk management.

SharePoint access controls must limit access using site, folder, and file permissions as appropriate.

Site collection owners also must ensure SharePoint users follow rules and protect privacy.

A SharePoint PIA is required any time a SharePoint site collection contains SBU data (including PII and tax information). The IRS reviews these privacy protections through the SharePoint PIA process. For more information on SharePoint PCLIAs, refer to IRM 10.5.2, Privacy Compliance and Assurance (PCA) Program.

For more information on Collaborative Environments, refer to IRM 10.8.1, Information Technology (IT) Security, Policy and Guidance, and IRM 2.25.20, Integrated Enterprise Portal-Web Services, SharePoint.

Before contracting for cloud services, address the necessary privacy, records management, and security policies.

PGLD must approve all procurements of cloud computing services that include SBU data (including PII and tax information) via the Privacy and Civil Liberties Impact Assessment (PCLIA) process (required by the ELC).

The IRS PCLIA process addresses privacy concerns for IRS systems with SBU data (including PII and tax information) using cloud computing. These issues include, but are not limited to:

Except for systems principally supporting overseas Federal/Treasury personnel and/or activities, Treasury systems must be located and operated within the U.S. [TD P 85-01, control SA-4_T.193]

PGLD and COR must provide written notification to the contractor when the contractor is allowed to maintain Government data at a location outside the U.S.

Failure to comply with privacy and security policies and processes might require contract modifications.

For more information on cloud computing issues and cloud deployment models, refer to IRM 10.8.24. Information Technology (IT) Security, Cloud Computing Security Policy, and IRM 10.8.1, Information Technology (IT) Security, Policy and Guidance.

Online accessible shared storage includes commercially available file-sharing sites in the cloud or private file-sharing on remote servers.

Use only IRS Enterprise-approved sites. For more information, refer to the Cloud Front Door.

Use only IRS identifiers (name or email) when conducting official business.

Do not post SBU data (including PII and tax information) online, including IRS official internal or external websites or cloud-based systems or services, unless secured with IT-approved access controls by the IRS (or by an IRS vendor bound by contract to protect the information).

The IRS e-signature principles and federally mandated authentication controls describe how the IRS protects an individual’s identity and assures that only authorized signers are completing the transaction.

For detailed information on the e-signature program, refer to IRM 10.10.1, Identity Assurance, IRS Electronic Signature (e-Signature) Program.

Interim Guidance Memo PGLD-10-0220-0001 details the Risk Management for Authentication in Non-Electronic Channels policy, owned by PGLD’s IA as part of their Omni Channel approach to authentication and authorization for all interactions.

For electronic interactions, this policy defers to the DIRA process (see IRM 10.5.1.7.9) for electronic interactions. For all other interactions, this policy applies to assessing the risk in the authentication process of telephone, in-person, and correspondence exchanges of sensitive information with individuals in authenticated customer contact channels.

Identity Assurance created a SharePoint site to provide guidance and house business unit risk assessments.

For more information, email *OS P GLD IA Risk Assessments.

Use of SSNs is acceptable when any of these options mandates such use:

SSN ER compliance requires owners of forms, notices, letters, and systems to apply the following SSN necessary-use criteria to determine whether SSN use is justifiable and necessary:

The IRS must provide information on IRS.gov/privacy to enable individuals to have access to the elements of their personally identifiable information that the IRS collects, as governed by the applicable laws and regulations. [NIST SP 800-53] [OMB M-21-04]

The privacy concerns are that individuals have access to the information that the IRS has on them, as governed by the applicable laws and regulations. The IRS requires publishing SORNs and PCLIAs and handling requests for information under the Privacy Act, IRC, and FOIA.

In this IRM, PGLD policies on the individual access control include, but are not limited to, the sections:

PGLD and IRS also address the individual access control in the following:

This is a joint security and privacy control about literacy training and awareness. For the full text of the control, see the AT-2 Literacy Training and Awareness section of IRM 10.8.1.

The privacy concerns are keeping personnel current on privacy training and awareness. The IRS requires annual mandatory briefings on security and privacy. PGLD contributes to the content of the mandatory briefings, incorporating lessons learned or issues of concern. PGLD employs awareness techniques such as all-employee communications, awareness events, and ad-hoc sessions.

In this IRM, PGLD policies on the literacy training and awareness control include, but are not limited to, the sections listed in the AT-1 references, IRM 10.5.1.8.2.

PGLD and IRS also address the literacy training and awareness control in the sections listed in the AT-1 references, IRM 10.5.1.8.2

This is a joint security and privacy control about role-based training. For the full text of the control, see the AT-3 Role-Based Training section of IRM 10.8.1.

The privacy concerns are keeping personnel current on privacy training and awareness. The IRS requires role-based privacy training for roles with specialized privacy responsibilities.

In this IRM, PGLD policies on the role-based training control include, but are not limited to, the sections listed in the AT-1 references, IRM 10.5.1.8.2.

PGLD and IRS also address the role-based training control in the sections listed in the AT-1 references, IRM 10.5.1.8.2

Provide all personnel with access to PII with initial and annual training in the employment and operation of personally identifiable information processing and transparency controls. [NIST SP 800-53]

The privacy concerns are that all personnel processing PII understand how to protect privacy. The IRS requires annual mandatory role-based briefings on security and privacy.

In this IRM, PGLD policies on the processing personally identifiable information control include, but are not limited to, the sections listed in the AT-1 references, IRM 10.5.1.8.2.

PGLD and IRS also address the processing personally identifiable information control in the sections listed in the AT-1 references, IRM 10.5.1.8.2

This is a joint security and privacy control about training records. For the full text of the control, see the AT-4 Training Records section of IRM 10.8.1.

The privacy concerns are tracking the training records to ensure that all personnel are current on privacy training and awareness. The IRS requires keeping and reviewing records that personnel have taken the annual mandatory briefings on security and privacy.

In this IRM, PGLD policies on the training records control include, but are not limited to, the sections listed in the AT-1 references, IRM 10.5.1.8.2.

PGLD and IRS also address the training records control in the sections listed in the AT-1 references, IRM 10.5.1.8.2.

This is a joint security and privacy control about event logging. For the full text of the control, see the AU-2 Event Logging section of IRM 10.8.1.

The privacy concerns are that logging events (audit logs, audit trails, event logs, etc.) can reveal information about individuals. The IRS requires systems limit the SBU data (including PII and FTI) in audit logs to only that needed for its intended use, grant access only on a need-to-know basis, and document the justification for information collected and shared.

In this IRM, PGLD policies on the event logging control include, but are not limited to, the section IRM 10.5.1.6.14.3, Monitoring Individuals.

PGLD and IRS also address the event logging control in the following:

Limit personally identifiable information contained in audit records to the following elements identified in the privacy risk assessment: Minimum necessary PII identified in the PCLIA. [NIST SP 800-53]

The privacy concerns are that "Limiting personally identifiable information in audit records when such information is not needed for operational purposes helps reduce the level of privacy risk created by a system." The IRS requires systems limit PII in audit records to the minimum necessary.

In this IRM, PGLD policies on the limit personally identifiable information elements control include, but are not limited to, the sections:

PGLD and IRS also address the limit personally identifiable information elements control in the following:

This is a joint security and privacy control about audit record retention. For the full text of the control, see the AU-11 Audit Record Retention section of IRM 10.8.1.

The privacy concerns are that the IRS retains audit records relative to Freedom of Information Act (FOIA) requests, subpoenas, and law enforcement actions for the proper period to maintain transparency. The IRS requires adherence to the IRS records managements requirements.

In this IRM, PGLD policies on the audit record retention control include, but are not limited to, the sections:

PGLD and IRS also address the audit record retention control in the following:

This is a joint security and privacy control about control assessments. For the full text of the control, see the CA-2 Control Assessments section of IRM 10.8.1.

The privacy concerns are to ensure controls operate as intended, sufficiently ensure compliance with applicable privacy requirements, and manage privacy risks. The IRS requires assessing privacy controls.

In this IRM, PGLD policies on the control assessments control include, but are not limited to, the sections listed in the CA-1 references, IRM 10.5.1.8.4.

PGLD and IRS also address the control assessments control in the sections listed in the CA-1 references, IRM 10.5.1.8.4.

This is a joint security and privacy control about plan of action and milestones (POA&Ms). For the full text of the control, see the CA-5 Plan of Action and Milestones section of IRM 10.8.1.

The privacy concerns are to monitor privacy on POA&Ms. The IRS requires System Owners monitor and address privacy risks identified on the PCLIA in a POA&M.

In this IRM, PGLD policies on the plan of action and milestones control include, but are not limited to, the section IRM 10.5.1.4.4, System Owners.

PGLD and IRS also address the plan of action and milestones control in IRM 10.5.2: Roles and Responsibilities.

This is a joint security and privacy control about authorization. For the full text of the control, see the CA-6 Authorization section of IRM 10.8.1.

The privacy concerns are to address privacy requirements before authorization to operate. The IRS requires including privacy in the ELC (specifically PCLIAs).

In this IRM, PGLD policies on the authorization control include, but are not limited to, the sections listed in the CA-1 references, IRM 10.5.1.8.4.

PGLD and IRS also address the authorization control in the sections listed in the CA-1 references, IRM 10.5.1.8.4.

This is a joint security and privacy control about continuous monitoring. For the full text of the control, see the CA-7 Continuous Monitoring section of IRM 10.8.1.

The privacy concerns are to maintain ongoing awareness of developing vulnerabilities. The IRS requires following the IRS Privacy Program Plan.

In this IRM, PGLD policies on the continuous monitoring control include, but are not limited to, the sections listed in the CA-1 references, IRM 10.5.1.8.4.

PGLD and IRS also address the continuous monitoring control in the sections listed in the CA-1 references, IRM 10.5.1.8.4.

This is a joint security and privacy control about risk monitoring. For the full text of the control, see the CA-7 Continuous Monitoring section of IRM 10.8.1.

The privacy concerns are to monitor and address privacy risks. The IRS requires monitoring risks identified in PCLIAs, BPRAs, POA&Ms, and other assessment practices.

In this IRM, PGLD policies on the risk monitoring control include, but are not limited to, the sections listed in the CA-1 references, IRM 10.5.1.8.4.

PGLD and IRS also address the risk monitoring control in the sections listed in the CA-1 references, IRM 10.5.1.8.4.

This is a joint security and privacy control about incident response training. For the full text of the control, see the IR-2 Incident Response Training section of IRM 10.8.1.

The privacy concerns are that IRS personnel need to know who to call or how to recognize an incident or a breach. The IRS requires providing mandatory training on Incident Management that is updated annually, and IM conducts a tabletop annually per OMB M-17-12.

In this IRM, PGLD policies on the incident response training control include, but are not limited to, the sections listed in the IR-1 references, IRM 10.5.1.8.7.

PGLD and IRS also address the incident response training control in the following:

Provide incident response training on how to identify and respond to a breach, including the organization’s process for reporting a breach. [NIST SP 800-53]

The privacy concerns are that IRS personnel need to know who to call or how to recognize a breach involving PII. The IRS requires providing mandatory training that includes information on how to identify and respond to a breach. The training includes links to how to respond to a breach.

In this IRM, PGLD policies on the breach control include, but are not limited to, the sections listed in the IR-1 references, IRM 10.5.1.8.7.

PGLD and IRS also address the breach control in the following:

This is a joint security and privacy control about incident response testing. For the full text of the control, see the IR-3 Incident Response Testing section of IRM 10.8.1.

The privacy concerns are that IRS personnel test incident response capabilities to determine their effectiveness and identify potential weaknesses or deficiencies. The IRS requires testing the breach response plan annually in compliance with OMB M-17-12.

In this IRM, PGLD policies on the incident response testing control include, but are not limited to, the sections listed in the IR-1 references, IRM 10.5.1.8.7.

PGLD and IRS also address the incident response testing control in the following:

This is a joint security and privacy control about incident handling. For the full text of the control, see the IR-4 Incident Handling section of IRM 10.8.1.

The privacy concerns are the IRS has the capability to handle all types of incidents consistent with the incident response plan. The IRS requires coordinating incident handling with IM, Cyber, CSIRC, and other business units as needed.

In this IRM, PGLD policies on the incident handling control include, but are not limited to, the sections listed in the IR-1 references, IRM 10.5.1.8.7.

PGLD and IRS also address the incident handling control in the following:

This is a joint security and privacy control about incident monitoring. For the full text of the control, see the IR-5 Incident Monitoring section of IRM 10.8.1.

The privacy concerns are the IRS tracks and documents incidents. The IRS requires using a tracking system.

In this IRM, PGLD policies on the incident monitoring control include, but are not limited to, the sections listed in the IR-1 references, IRM 10.5.1.8.7.

PGLD and IRS also address the incident monitoring control in the following:

This is a joint security and privacy control about incident reporting. For the full text of the control, see the IR-6 Incident Reporting section of IRM 10.8.1.

The privacy concerns are that the IRS reports incidents or breaches. The IRS requires all personnel report when an incident or breach occurs.

In this IRM, PGLD policies on the incident reporting control include, but are not limited to, the sections listed in the IR-1 references, IRM 10.5.1.8.7.

PGLD and IRS also address the incident reporting control in the following:

This is a joint security and privacy control about incident response assistance. For the full text of the control, see the IR-7 Incident Response Assistance section of IRM 10.8.1.

The privacy concerns are that IRS provides a support resource that offers advice and assistance to personnel for the handling and reporting of incidents. The IRS requires offering a hotline.

In this IRM, PGLD policies on the incident response assistance control include, but are not limited to, the sections listed in the IR-1 references, IRM 10.5.1.8.7.

PGLD and IRS also address the incident response assistance control in the following:

This is a joint security and privacy control about incident response plan. For the full text of the control, see the IR-8 Incident Response Plan section of IRM 10.8.1.

The privacy concerns are that IRS develop and implement a coordinated approach to incident response. The IRS requires following Document 13347, Data Breach Response Playbook, and Document 13347-A, IRS Data Breach Response Plan.

In this IRM, PGLD policies on the incident response plan control include, but are not limited to, the sections listed in the IR-1 references, IRM 10.5.1.8.7.

PGLD and IRS also address the incident response plan control in the following:

Include the following in the Incident Response Plan for breaches involving personally identifiable information:

The privacy concerns are that IRS develop and implement a coordinated approach to incidents. The IRS requires following Document 13347, Data Breach Response Playbook, and Document 13347-A, IRS Data Breach Response Plan.

In this IRM, PGLD policies on the breaches control include, but are not limited to, the sections listed in the IR-1 references, IRM 10.5.1.8.7.

PGLD and IRS also address the breaches control in the following:

This is a joint security and privacy control about media sanitization. For the full text of the control, see the MP-6 Media Sanitization section of IRM 10.8.1.

The privacy concerns are preventing the disclosure of information to unauthorized individuals when such media is reused or released for disposal. The IRS requires compliance with the IRS Records and Information program.

In this IRM, PGLD policies on the media sanitization control include, but are not limited to, the sections:

PGLD and IRS also address the media sanitization control in the following:

Limit personally identifiable information contained in visitor access records to the following elements identified in the privacy risk assessment: Minimum necessary PII. [NIST SP 800-53]

The privacy concerns are that limiting PII elements in visitor access records when such information is not needed for operational purposes helps reduce the level of privacy risk. The IRS requires collecting only minimum necessary information.

In this IRM, PGLD policies on the limit personally identifiable information elements control include, but are not limited to, the sections:

PGLD and IRS also address the limit personally identifiable elements control in the following:

This is a joint security and privacy control about system security and privacy plan. For the full text of the control, see the PL-2 System Security and Privacy Plan section of IRM 10.8.1.

The privacy concerns are that privacy needs to be incorporated into the system development lifecycle. The IRS requires following the ELC, completing the PCLIA process, and including privacy requirements in the system security and privacy plans.

In this IRM, PGLD policies on the system security and privacy plan control include, but are not limited to, the sections listed in the PL-1 references, IRM 10.5.1.8.10.

PGLD and IRS also address the system security and privacy plan control in the sections listed in the PL-1 references, IRM 10.5.1.8.10.

This is a joint security and privacy control about rules of behavior. For the full text of the control, see the PL-4 Rules of Behavior section of IRM 10.8.1.

The privacy concerns are that all personnel with access to PII understand and comply with the rules of behavior. The IRS requires using an IRS-approved access control system [such as Online 5081 (OL5081) or Business Entitlement Access Request System (BEARS)] to communicate and document acknowledgement of the IRS System Security Rules.

In this IRM, PGLD policies on the rules of behavior control include, but are not limited to, the section IRM 10.5.1.4, IRS-Wide Privacy Roles and Responsibilities.

PGLD and IRS also address the rules of behavior control in the following:

This is a joint security and privacy control about social media and external site/application usage restrictions. For the full text of the control, see the PL-4 Rules of Behavior section of IRM 10.8.1.

The privacy concerns are that all personnel with access to PII understand and comply with the rules of behavior. The IRS requires using an IRS-approved access control system (such as OL5081 or BEARS) to communicate and document acknowledgement of the IRS System Security Rules.

In this IRM, PGLD policies on the social media and external site/application usage restrictions control include, but are not limited to, the sections:

PGLD and IRS also address the social media and external site/application usage restrictions control in the following:

This is a joint security and privacy control about security and privacy architecture. For the full text of the control, see the PL-8 Security and Privacy Architecture section of IRM 10.8.1.

The privacy concerns are that privacy needs to be incorporated into the system development lifecycle. The IRS requires following the ELC, completing the PCLIA process, and including privacy requirements in the system security and privacy architecture.

In this IRM, PGLD policies on the security and privacy architecture control include, but are not limited to, the sections listed in the PL-1 references, IRM 10.5.1.8.10.

PGLD and IRS also address the security and privacy architecture control in the sections listed in the PL-1 references, IRM 10.5.1.8.10.

This is a joint security and privacy control about central management. For the full text of the control, see the PL-9 Central Management section of IRM 10.8.1.

The privacy concerns are to support privacy continuous monitoring and risk-based decision-making within the organization. The IRS requires managing the control assessment through the Enterprise FISMA Compliance program.

In this IRM, PGLD policies on the central management control include, but are not limited to, the sections listed in the PL-1 references, IRM 10.5.1.8.10.

PGLD and IRS also address the central management control in the sections listed in the PL-1 references, IRM 10.5.1.8.10.

This is a joint security and privacy control about information security and privacy resources. For the full text of the control, see the PM-3 Information Security and Privacy Resources section of IRM 10.8.1.

The privacy concerns are that privacy programs have the resources needed to manage federal information resources that involve PII. The IRS requires senior management and executives ensure their programs and policies meet this responsibility.

In this IRM, PGLD policies on the information security and privacy resources control include, but are not limited to, the sections:

PGLD and IRS also address the information security and privacy resources control in the following:

This is a joint security and privacy control about plan of action and milestones. For the full text of the control, see the PM-4 Plan of Action and Milestones section of IRM 10.8.1.

The privacy concerns are to reduce privacy risk by documenting and tracking planned remediations on POA&Ms. The IRS requires that System Owners include privacy risks identified on the PCLIA are in a POA&M.

In this IRM, PGLD policies on the plan of action and milestones control include, but are not limited to, the section, IRM 10.5.1.4.4, System Owners.

PGLD and IRS also address the plan of action and milestones control in IRM 10.5.2: Roles and Responsibilities.

Establish, maintain, and update every three years an inventory of all systems, applications, and projects that process personally identifiable information. [NIST SP 800-53]

The privacy concerns are the IRS uses this inventory to ensure that systems only process the PII for authorized purposes and that this processing is still relevant and necessary for the purpose specified therein. The IRS requires using the PCLIA process.

In this IRM, PGLD policies on the inventory of personally identifiable information control include, but are not limited to, the sections:

PGLD and IRS also address the inventory of personally identifiable information control in the following:

This is a joint security and privacy control about measures of performance. For the full text of the control, see the PM-6 Measures of Performance section of IRM 10.8.1.

The privacy concerns are to measure the effectiveness or efficiency of the privacy programs and the controls employed. The IRS requires measuring privacy performance on the PGLD Internal and External Reports site.

In this IRM, PGLD policies on the measures of performance control include, but are not limited to, the sections:

PGLD and IRS also address the measures of performance control in the following:

This is a joint security and privacy control about enterprise architecture. For the full text of the control, see the PM-7 Enterprise Architecture section of IRM 10.8.1.

The privacy concerns are to ensure that privacy considerations are addressed throughout the system development life cycle and are explicitly related to the organization’s mission and business processes. The IRS requires compliance with Enterprise Architecture’s standards.

In this IRM, PGLD policies on the enterprise architecture control include, but are not limited to, the sections:

PGLD and IRS also address the enterprise architecture control in the following:

This is a joint security and privacy control about critical infrastructure plan. For the full text of the control, see the PM-8 Critical Infrastructure Plan section of IRM 10.8.1.

The privacy concerns are the IRS address privacy issues in critical infrastructure, assets, resources, and processes in the mission life cycle. The IRS requires embedding data protection through the life cycle of critical infrastructure, assets, resources, and processes.

In this IRM, PGLD policies on the critical infrastructure plan control include, but are not limited to, the sections:

PGLD and IRS also address the critical infrastructure plan control in the following:

This is a joint security and privacy control about risk management strategy. For the full text of the control, see the PM-9 Risk Management Strategy section of IRM 10.8.1.

The privacy concerns are that the IRS manage privacy risk to individuals resulting from the authorized processing of PII. The IRS requires:

In this IRM, PGLD policies on the risk management strategy control include, but are not limited to, the sections:

PGLD and IRS also address the risk management strategy control in the following:

This is a joint security and privacy control about authorization process. For the full text of the control, see the PM-10 Authorization Process section of IRM 10.8.1.

The privacy concerns are to address privacy requirements before authorization to operate. The IRS requires including privacy in the ELC (specifically PCLIAs).

In this IRM, PGLD policies on the authorization process control include, but are not limited to, the sections:

PGLD and IRS also address the authorization process control in the following:

This is a joint security and privacy control about mission and business process definition. For the full text of the control, see the PM-11 Mission and Business Process Definition section of IRM 10.8.1.

The privacy concerns are the IRS protects privacy in systems and safeguards privacy in everyday business processes supporting the IRS mission. The IRS requires a privacy culture, wherein all personnel think about privacy before acting. The mission of the service requires the IRS safeguard privacy and protect privacy rights.

In this IRM, PGLD policies on the mission and business process definition control include, but are not limited to, the sections:

PGLD and IRS also address the mission and business process definition control in the following:

This is a joint security and privacy control about security and privacy workforce. For the full text of the control, see the PM-13 Security and Privacy Workforce section of IRM 10.8.1.

The privacy concerns are the IRS develop and institutionalize the core privacy capabilities of personnel needed to protect organizational operations, assets, and individuals. The IRS requires defining and developing privacy training for PGLD and other privacy-minded personnel.

In this IRM, PGLD policies on the security and privacy workforce control include, but are not limited to, the sections:

PGLD and IRS also address the security and privacy workforce control in the following:

This is a joint security and privacy control about testing, training, and monitoring. For the full text of the control, see the PM-14 Testing, Training, and Monitoring section of IRM 10.8.1.

The privacy concerns are that the IRS coordinates the training for personnel with access to PII and the testing of privacy controls. The IRS requires reviewing testing, training, and monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.

In this IRM, PGLD policies on the testing, training, and monitoring control include, but are not limited to, the sections:

PGLD and IRS also address the testing, training, and monitoring control in the following:

This is a joint security and privacy control about security and privacy groups and associations. For the full text of the control, see the PM-15 Security and Privacy Groups and Associations section of IRM 10.8.1.

The privacy concerns are the IRS maintain ongoing contact with security and privacy groups and associations in an environment of rapidly changing technologies and threats. The IRS requires encouraging participation in appropriate groups, such as Federal Privacy Council (FPC), International Association of Privacy Professionals (IAPP), etc.

In this IRM, PGLD policies on the security and privacy groups and associations control include, but are not limited to, the sections:

PGLD and IRS also address the security and privacy groups and associations control in the following:

This is a joint security and privacy control about protecting controlled unclassified information (CUI) on external systems. For the full text of the control, see the PM-17 Protecting Controlled Unclassified Information on External Systems section of IRM 10.8.1.

The privacy concerns are that all sensitive information is protected on external systems. The IRS requires that contractors and external partners protect all SBU data (including PII and tax information).

In this IRM throughout, and specifically, PGLD policies on the protecting controlled unclassified information/SBU data on external systems control include, but are not limited to, the sections:

PGLD and IRS also address the protecting controlled unclassified information/SBU data on external systems control in the following:

Develop and disseminate an organization-wide privacy program plan that provides an overview of the agency’s privacy program, and:

Update the plan every three years or more frequently to address changes in federal privacy laws and policy and organizational changes and problems identified during plan implementation or privacy control assessments. [NIST SP 800-53]

The privacy concerns are that the IRS formally documents its privacy program. The IRS requires publishing the IRS Privacy Program Plan.

In this IRM, PGLD policies on the Privacy Program Plan control include, but are not limited to, the sections:

PGLD and IRS also address the Privacy Program Plan control in the following:

Appoint a senior agency official for privacy with the authority, mission, accountability, and resources to coordinate, develop, and implement, applicable privacy requirements and manage privacy risks through the organization-wide privacy program. [NIST SP 800-53]

The privacy concerns are that the IRS has a senior official responsible for ensuring that IRS implements sound policies to protect SBU data (including PII and tax information). The IRS requires designating a Chief Privacy Officer (CPO); Treasury appoints the senior agency official for privacy (SAOP).

In this IRM, PGLD policies on the privacy program leadership role control include, but are not limited to, the sections:

PGLD and IRS also address the privacy program leadership role control in the following:

Maintain a central resource webpage on the organization’s principal public website that serves as a central source of information about the organization’s privacy program and that:

The privacy concerns are that people have a way to see privacy policies and contact the IRS regarding concerns. The IRS requires maintaining the IRS.gov Privacy Policy page https://www.irs.gov/privacy and giving the email [email protected].

In this IRM, PGLD policies on the dissemination of privacy program information control include, but are not limited to, the sections:

PGLD and IRS also address the dissemination of privacy program information control in the following:

Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services, that:

The privacy concerns are the public can make an informed decision about sharing their information. The IRS requires both maintaining the IRS.gov Privacy Policy page https://www.irs.gov/privacy and a link to that page for all external facing online services.

In this IRM, PGLD policies on the privacy policies on websites, applications, and digital services control include, but are not limited to, the sections:

PGLD and IRS also address the privacy policies on websites, applications, and digital services control in the following:

Develop and maintain an accurate accounting of disclosures of personally identifiable information, including:

Retain the accounting of disclosures for the length of the time the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer; and

Make the accounting of disclosures available to the individual to whom the personally identifiable information relates upon request. [NIST SP 800-53]

The privacy concerns are to allow individuals to learn to whom their PII has been disclosed. The IRS requires that employees authorized to make disclosures of non-tax Privacy Act records must account for such disclosures.

In this IRM, PGLD policies on the accounting of disclosures control include, but are not limited to, the section IRM 10.5.1.2.7, Privacy Act Information.

PGLD and IRS also address the accounting of disclosures control in the following:

Develop and document organization-wide policies and procedures for:

The privacy concerns are to confirm the accuracy and relevance of PII throughout the information life cycle. The IRS requires accuracy, completeness, and timeliness of PII to ensure fair treatment of all individuals. IRS personnel will collect information, to the greatest extent practicable, directly from the individual to whom it relates.

In this IRM, PGLD policies on the personally identifiable information quality management control include, but are not limited to, the sections:

PGLD and IRS also address the personally identifiable information quality management control in the following:

This is a joint security and privacy control about data governance body. For the full text of the control, see the PM-23 Data Governance Body section of IRM 10.8.1.

The privacy concerns are that data, including PII, is effectively managed and maintained in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidance. The IRS requires using the Cybersecurity & Privacy Management Level Governance Board to establish policies, procedures, and standards that facilitate data governance.

In this IRM, PGLD policies on the data governance body control include, but are not limited to, the sections:

Establish a Data Integrity Board to:

The privacy concerns are the IRS monitor the agency’s matching activities. The IRS requires having the CPO representing the IRS as a member of the Treasury Data Integrity Board.

In this IRM, PGLD policies on the data integrity board control include, but are not limited to, the sections:

PGLD and IRS also address the data integrity board control in the following: